Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
868 detections
Filters
Last updated
All Time
Detection languages
863
4
1
Contributors
411
156
140
93
29
Categories
401
373
235
168
150
Platforms
773
171
98
28
24
Products / Services
846
413
94
47
26
MITRE Techniques
136
123
110
98
83
CVEs
9
5
5
4
4
IDS Classtypes
362
189
90
64
55
IDS Protocols
2,431
868
408
324
97
This rule detects attempts to query the list of system drivers on a remote Windows host via a WMI session over SMB (port 445). The detection is based on the presence of the string "Win32_SystemDriver" in the network traffic, indicating a WMI query for system driver information. This activity can be indicative of reconnaissance by an attacker.
This rule detects attempts to install a kernel module (rootkit) on a Linux system via an SSH session. It specifically looks for the 'insmod' command followed by a '.ko' file extension within TCP traffic destined for port 22 (SSH). This combination suggests an attacker is trying to load a malicious kernel object.
This rule detects attempts to push a root certificate to a Windows system via the Remote Registry service (SMB port 445). It specifically looks for network traffic containing the strings "Root\Certificates" and "RegSetValue" (case-insensitive) within the same TCP flow to a server on port 445. This activity could indicate an attacker attempting to establish persistence or bypass security controls by installing a trusted root certificate.
This rule detects network traffic on TCP port 445 (SMB) containing the string "wintrust.dll" in a case-insensitive manner. This specific DLL is associated with Windows Trust Provider functionality. The detection is flagged as 'trojan-activity' and is linked to MITRE ATT&CK technique T1553.003 (Code Signing: Code Signing Policy Modification) and tactic Defense Evasion, suggesting an attempt to bypass code signing policies by replacing or manipulating the wintrust.dll.
This Suricata rule detects network traffic on TCP port 445 (SMB) that contains the strings "SpecialAccounts" and "UserList" (case-insensitive). This pattern is indicative of an attempt to hide a user account on a Windows system by modifying the registry's SpecialAccounts\UserList key. This technique is often used by adversaries for defense evasion.
This rule detects attempts to remove a network share connection using the 'NetUseDel' command. This activity is often associated with adversaries trying to hide their access or clean up traces after establishing persistence or performing other actions on a compromised system. The detection specifically looks for the 'NetUseDel' string within TCP traffic directed to port 445 (SMB/CIFS), indicating an attempt to delete a network share.
This rule detects TCP traffic to port 389 (LDAP) where the content of the packet contains both "sAMAccountName" and "admin" (case-insensitive). This combination suggests an attempt to query or manipulate an LDAP directory for an account named 'admin' using the sAMAccountName attribute, potentially indicating user account masquerading as a service account or reconnaissance activity.
This rule detects the string "setfattr" in TCP traffic destined for port 22 (SSH). The presence of "setfattr" in SSH traffic might indicate an attempt to use Linux extended attributes to hide data or malicious payloads, a technique often associated with defense evasion.
This rule detects the string "mount --bind" within TCP traffic on port 22 (SSH). This string indicates an attempt to create a bind mount, which can be used by attackers to obscure the true location of malicious files or to manipulate file system access. The rule specifically looks for this activity on the home network, suggesting an internal system being targeted or used for malicious purposes.
This rule detects when a network device disables hardware crypto acceleration. It specifically looks for TCP traffic on port 22 (SSH) from any source to the home network, containing the case-insensitive string "no crypto engine". This could indicate a policy violation or an attempt to degrade cryptographic performance, potentially for evasion or to facilitate other attacks.
This rule detects the negotiation of a weak cipher, specifically 'arcfour', during an SSH session. It monitors TCP traffic flowing to the home network on port 22 (SSH) and triggers an alert if the string 'arcfour' is found in the established session, ignoring case.
This rule detects attempts to dump the LSASS process memory remotely over SMB. It specifically looks for network traffic on TCP port 445 (SMB) containing the string "lsass.dmp" in a case-insensitive manner, indicating a potential credential dumping activity.
This rule detects attempts to modify file permissions remotely via SMB by looking for the string "icacls" in TCP traffic directed to port 445 (SMB). The detection is case-insensitive and focuses on established connections flowing to the server. This activity is classified as trojan activity, suggesting an attacker might be attempting to alter file access controls on a remote system.
This rule detects network activity associated with password cracking tools like Hashcat or John the Ripper. It specifically looks for HTTP user agent strings containing "hashcat" or "john.the.ripper" in traffic flowing to a server.
Stealth TCP SYN Scan Detected
Suricata
Detects low-and-slow TCP SYN scanning activity where an attacker reduces scan rate to avoid basic threshold detection. This is common in stealth reconnaissance using Nmap or custom scanners.
This rule detects attempts to create a new local user account on a system via a remote Server Message Block (SMB) connection. It specifically looks for the string "NetUserAdd" (case-insensitive) within TCP traffic destined for port 445, which is commonly used by SMB. This activity is indicative of an attacker attempting to establish persistence or gain further access by creating new accounts.
This rule detects attempts to modify local or domain group memberships by monitoring TCP traffic on port 389 (LDAP). It specifically looks for the keywords "member" and "add" within the traffic, indicating an attempt to add a member to a group. A threshold of 5 occurrences within 60 seconds from the same source IP is set to reduce false positives.
This rule detects the creation of an XDG Autostart entry on a Linux host by looking for network traffic containing the string "/etc/xdg/autostart/" in a TCP flow to the server on port 22. This directory is commonly used for persistence by malware to automatically execute at system startup.
This rule detects network traffic on TCP port 445 (SMB) containing the string "Security Packages" in a case-insensitive manner. This pattern is often associated with the registration or use of Security Support Provider DLLs, which can be a persistence mechanism (T1547.005) used by adversaries to maintain access to a system.
This rule detects network traffic on port 445 (SMB) containing the string "TimeProviders" (case-insensitive). This pattern is indicative of a Time Provider DLL being registered for persistence, a technique used by attackers to maintain access to a system. The rule specifically looks for this activity in established TCP connections flowing to the home network.
This rule detects network traffic containing the string "/etc/udev/rules.d/" over TCP port 22 (SSH). This string is indicative of an attempt to modify udev rules, which can be used for Linux persistence by executing malicious scripts or commands when specific hardware events occur. The detection is focused on traffic flowing from the home network to a server on the home network, suggesting an internal system attempting to modify udev rules on another internal system via SSH.
Page 39 of 42