Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
868 detections
Filters
Last updated
All Time
Detection languages
863
4
1
Contributors
411
156
140
93
29
Categories
401
373
235
168
150
Platforms
773
171
98
28
24
Products / Services
846
413
94
47
26
MITRE Techniques
136
123
110
98
83
CVEs
9
5
5
4
4
IDS Classtypes
362
189
90
64
55
IDS Protocols
2,431
868
408
324
97
This rule detects RDP (Remote Desktop Protocol) sessions initiated towards the HOME_NET on port 3389. It specifically looks for the RDP connection initiation sequence (content:"|03 00|" with depth:2) and uses a threshold to detect multiple connections from the same source within a 5-minute window, which could indicate activity from a Managed Service Provider or other remote access scenarios.
This rule detects Server Message Block (SMB) access attempts from external sources to internal networks, specifically looking for NTLMSSP (NT LAN Manager Security Support Provider) authentication traffic. It triggers an alert if five such connections are observed from the same source IP within a 60-second window. This could indicate an attempt by a third-party vendor or an attacker to access internal resources via SMB.
This rule detects potential VXLAN traffic duplication for exfiltration purposes. It specifically looks for TCP traffic on port 4789 (the default VXLAN port) directed towards the home network. A threshold of 10 connections from the same source within 30 seconds triggers the alert, indicating a high volume of VXLAN traffic that could be indicative of data exfiltration.
This rule detects attempts to abuse an IoT device's firmware update page by sending a large POST request containing the word "firmware" (case-insensitive) to TCP port 80 on the home network. This activity is indicative of an attempt to corrupt the device's firmware, potentially leading to denial of service or unauthorized control.
This rule detects attempts to remotely lock out user accounts via SMB (Server Message Block) by looking for specific content within TCP traffic on port 445. It specifically targets the 'NetUserSetInfo' function call, which can be used to modify user account properties, in conjunction with the keyword 'lockout'. This combination suggests an attacker is attempting to trigger a mass account lockout.
This rule detects potential tampering with financial transaction data during transit. It specifically looks for TCP traffic flowing to a server, where the data size is between 100 and 500 bytes, and the content contains both "amount" and "transfer" (case-insensitive). This combination suggests an attempt to modify financial transaction details.
This rule detects the use of AMQP (Advanced Message Queuing Protocol) on port 5672, specifically looking for the 'AMQP' content within the first 4 bytes of the TCP payload. It triggers an alert if this pattern is observed 5 times within 60 seconds from the same source IP, indicating potential Command and Control (C2) activity using AMQP as a communication channel.
This rule detects unusual application traffic on TCP port 8443. It triggers an alert if a source IP address initiates more than 20 TCP connections to port 8443 within a 60-second window. This threshold-based detection aims to identify potentially malicious or anomalous communication patterns that might indicate command and control activity or data exfiltration over a non-standard port often used for HTTPS.
This rule detects potential RDP session hijacking attempts by looking for the string "tscon" within TCP traffic destined for port 3389 (RDP). The 'tscon' command can be used to connect to or take control of another user's RDP session.
This rule detects internal lateral movement attempts within a network using remote services. It specifically looks for TCP traffic originating from and destined to the home network, indicating internal communication. A threshold of 10 connections within 30 seconds from the same source IP is used to identify suspicious activity, suggesting a potential brute-force or rapid connection attempt indicative of lateral movement.
This rule detects attempts to enumerate remote registry keys via SMB. It specifically looks for network traffic on port 445 (SMB) containing the strings "winreg" and "RegQueryValue" in a case-insensitive manner. A threshold is applied to trigger an alert if 20 such events occur within a 30-second window from the same source.
This rule detects attempts to enumerate the 'Domain Admins' group over SMB (Server Message Block) using the 'NetGroupGetUsers' function. This activity is often associated with reconnaissance by attackers trying to identify high-privilege accounts within a Windows domain.
This rule detects attempts to enumerate local group memberships on a target system via the Server Message Block (SMB) protocol. Specifically, it looks for the 'NetLocalGroupEnum' function call within SMB traffic directed to the home network on port 445. This activity is often associated with reconnaissance phases of an attack, where an adversary is trying to discover local user groups to identify potential targets for privilege escalation or lateral movement.
This rule detects network traffic on TCP port 445 (SMB) containing the string "DisableRealtimeMonitoring" (case-insensitive). This string is often associated with attempts to disable real-time monitoring features of security products, typically by modifying registry keys. The detection is focused on traffic flowing from any source to the home network, specifically to the SMB port, and only on established connections. This activity is indicative of an attacker attempting to evade detection by crippling security software.
This rule detects attempts to set the hidden attribute on a file using the 'attrib +h' command over a network connection to a Windows machine (port 445). This technique is often used by attackers to hide malicious files from users and system administrators, contributing to defense evasion.
This rule detects attempts to create hidden files or directories in the /tmp directory on a remote host via SSH. Specifically, it looks for SSH traffic (tcp port 22) containing the strings "touch ." and "/tmp/." (case-insensitive). This behavior is often associated with adversaries attempting to hide their artifacts on a compromised system.
This rule detects attempts to clear the Bash history using the 'history -c' command over an established SSH connection. It specifically looks for the case-insensitive string 'history -c' within TCP traffic flowing from the client to the server on port 22 (SSH). This activity is often associated with an attacker attempting to cover their tracks after gaining unauthorized access.
This rule detects unauthorized Kerberos service ticket requests directed at a Domain Controller (DC). It specifically looks for TCP traffic to port 88 (Kerberos) on the home network, with a content match for the byte sequence '|6b|' at the beginning of the payload. A threshold of 50 requests within 10 seconds from the same source IP triggers the alert, indicating a potential brute-force or enumeration attempt against Kerberos services.
This rule detects network traffic on port 445 (SMB) containing the string "SetFileSecurity" (case-insensitive). This string is associated with modifying file security descriptors, specifically Discretionary Access Control Lists (DACLs), which can be used by attackers to hide malicious files or achieve persistence by altering permissions.
This rule detects network traffic to port 88 (Kerberos) that exhibits characteristics of a vulnerability exploit for credential access. Specifically, it triggers an alert if there are 30 or more TCP connections to port 88 on the HOME_NET within a 5-second window from a single source IP address, indicating a potential brute-force or rapid credential access attempt against a Kerberos service.
This rule detects attempts to dump memory from the 'securityd' process on macOS systems, specifically looking for the string 'securityd' and 'ptrace' in TCP traffic on port 22. This activity is indicative of credential access attempts, as 'securityd' handles sensitive security information.
Page 34 of 42