Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
868 detections
Filters
Last updated
All Time
Detection languages
863
4
1
Contributors
411
156
140
93
29
Categories
401
373
235
168
150
Platforms
773
171
98
28
24
Products / Services
846
413
94
47
26
MITRE Techniques
136
123
110
98
83
CVEs
9
5
5
4
4
IDS Classtypes
362
189
90
64
55
IDS Protocols
2,431
868
408
324
97
This rule detects outbound TCP connections on port 9050, which is commonly used by the Tor anonymity network. The rule is configured to trigger an alert if there are at least 3 such connections from the same source within a 60-second window, indicating potential use of Tor. The message suggests this activity is related to accessing an Initial Access Broker market.
This rule detects a brute-force attack against an IMAP email account. It triggers when a source IP attempts to connect to the IMAP port (993) on the home network 20 or more times within a 30-second window. This behavior is indicative of an attacker repeatedly trying different credentials to gain unauthorized access to an email account.
This rule detects a potential network scan targeting firewall management interfaces. It specifically looks for TCP SYN packets (flags:S) directed to port 8443 on the home network, which is a common port for firewall management. The rule triggers if 5 such connection attempts are observed from the same source within a 60-second window, indicating a threshold-based scan.
This rule detects an SNMP Hardware MIB Enumeration Walk. It triggers when a TCP connection to port 161 (SNMP) on the home network contains the byte sequence "30 82" at a depth of 2 bytes. A threshold is set to trigger an alert if 20 such events occur within 30 seconds from the same source IP address. This activity is classified as a network scan, specifically reconnaissance, as it involves querying SNMP for hardware information.
High Port Range Scan Detected
Suricata
This rule detects a high port range scan by monitoring TCP connections with the SYN flag set (indicating a new connection attempt) to ports within the high range (1025-65535) on the home network. It triggers an alert if more than 200 such connection attempts are observed from a single source IP address within a 10-second window.
his query hunts for Beagle malware indicators by correlating suspicious file artifacts (NOVupdate.exe, avk.dll, Claude.msi), process command-line executions, and potential network callbacks. It unifies multiple telemetry sources to surface persistence, DLL sideloading, and C2 activity aligned with MITRE ATT&CK techniques.
This rule detects attempts to remotely clear event logs over Server Message Block (SMB) by looking for the strings "Eventlog" and "ClearEventLog" in TCP traffic destined for port 445. This activity is often associated with adversaries attempting to remove forensic evidence of their presence on a system.
This rule detects network traffic indicative of WMI remote execution, specifically looking for the string "IWbemServices" on TCP port 135. This activity is often associated with Living Off The Land Binaries and Scripts (LOLBAS) techniques, where legitimate system tools like WMI are abused for malicious purposes such as remote code execution or lateral movement. The rule is designed to alert on potential trojan activity.
This rule detects a high volume of TCP connection attempts to port 135 (RPC) on the home network. A threshold of 20 connection attempts from a single source within 30 seconds triggers the alert. This pattern can indicate an attempt to exploit RPC services for remote execution, often seen in worm propagation or targeted attacks.
This rule detects DCOM remote execution attempts via the RPC Endpoint Mapper. It specifically looks for TCP traffic to port 135 (RPC Endpoint Mapper) with a specific content signature "|05 00 0b|" within the first 3 bytes of the payload, indicating a DCOM activation request.
This rule detects attempts to exploit the PrintNightmare vulnerability over SMB. It specifically looks for network traffic on port 445 (SMB) containing the strings "spoolss" and "RpcAddPrinterDriverEx" in a case-insensitive manner, indicating an attempt to leverage the Print Spooler service for privilege escalation.
This rule detects an attempt to escalate privileges on a system via SSH by looking for the string "sudo su" within an established TCP connection to port 22 (SSH). This indicates a user is trying to switch to the root user or another user with elevated privileges using the sudo command.
This rule detects RDP credential spraying attempts targeting multiple usernames on a single destination IP address. It triggers an alert if 30 or more RDP connection attempts are made to the same destination within a 60-second window, indicating a potential brute-force or credential-stuffing attack against RDP services.
This rule detects attempts to discover Group Policy information remotely over Server Message Block (SMB). It specifically looks for network traffic on port 445 (SMB) containing the strings "SYSVOL" and "GroupPolicy" (case-insensitive) in the same flow, indicating a potential query for Group Policy objects.
LDAP Password Policy Enumeration
Suricata
This rule detects attempts to enumerate LDAP password policy settings by looking for specific content within TCP traffic on port 389 (LDAP). Specifically, it triggers when it finds "(objectClass=domain)" and "pwdHistoryLength" in a case-insensitive manner within the network flow, indicating a query for password history length attribute of a domain object. This activity is often associated with reconnaissance or discovery phases of an attack.
This rule detects the transmission of cleartext credentials over Telnet by looking for the string "Password:" in traffic flowing to the server on port 23. Telnet is an insecure protocol that sends data, including login credentials, in plain text, making it vulnerable to eavesdropping.
SMB Authentication Brute Force
Suricata
This rule detects SMB authentication brute force attempts by looking for multiple NTLMSSP_AUTH messages over port 445 (SMB) from the same source IP within a 30-second window. A threshold of 10 attempts triggers the alert, indicating a potential brute force attack against SMB authentication.
This rule detects the download of a Meterpreter reverse shell stage by looking for a specific byte sequence ('|fc e8 8f 00 00 00|') in TCP traffic flowing to the server on an established connection. This byte sequence is characteristic of the initial stage of a Meterpreter payload, which is often used for command and control.
This rule detects attempts to enumerate Docker containers via the Docker API. Specifically, it looks for HTTP requests to the '/containers/json' endpoint on TCP port 2375, which is commonly used for unauthenticated Docker API access. This activity is indicative of an adversary trying to discover running containers on a compromised host.
This rule detects a pattern indicative of ransomware encrypting files over SMB. It specifically looks for TCP traffic on port 445 (SMB) within the home network, containing the byte sequence '|FF|SMB'. A threshold of 500 such events from a single source IP within 30 seconds triggers the alert, classifying it as trojan activity.
This rule detects network reconnaissance activity by identifying HTTP requests where the User-Agent header contains the string "masscan". Masscan is a fast internet port scanner, and its User-Agent string often indicates scanning activity, which aligns with the MITRE ATT&CK technique T1595.002 for active scanning during reconnaissance.
Page 37 of 42