Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
868 detections
Filters
Last updated
All Time
Detection languages
863
4
1
Contributors
411
156
140
93
29
Categories
401
373
235
168
150
Platforms
773
171
98
28
24
Products / Services
846
413
94
47
26
MITRE Techniques
136
123
110
98
83
CVEs
9
5
5
4
4
IDS Classtypes
362
189
90
64
55
IDS Protocols
2,431
868
408
324
97
This rule detects large attachments being exfiltrated via SMTP. Specifically, it looks for SMTP traffic on port 25, flowing to the server, that contains the 'Content-Transfer-Encoding: base64' header and has a data size greater than 50,000 bytes. This combination suggests a large, base64-encoded file being sent as an email attachment, which could indicate data exfiltration.
This Suricata rule detects C2 port hopping behavior by identifying a single source IP initiating 10 or more TCP SYN packets to different non-standard ports within a 30-second window. This pattern is indicative of command and control (C2) communication attempting to evade detection by frequently changing ports.
This rule detects network reconnaissance activity by identifying HTTP user-agent strings commonly associated with vulnerability scanners like Nmap or Masscan. It specifically looks for the string 'Nmap' within the HTTP user-agent header in traffic flowing from the internal network to a server.
This rule detects a potential RDP brute force attack by monitoring for a high number of TCP SYN packets directed to port 3389 (RDP) on the home network from a single source IP address within a short timeframe. Specifically, it triggers an alert if 10 or more SYN packets are observed from the same source within 60 seconds, indicating an attempt to establish multiple RDP connections, which is characteristic of a brute force attempt.
This rule detects attempts to modify user accounts via LDAP. It specifically looks for TCP traffic on port 389 (LDAP) containing the hexadecimal representation of '0' (likely part of an LDAP message structure) and the case-insensitive string 'modify'. A threshold of 5 such events within 60 seconds from the same source IP triggers the alert, indicating potential malicious activity related to account manipulation.
This rule detects a password spraying attack targeting LDAP services. It triggers an alert if there are 50 or more TCP connections to port 389 (LDAP) on the home network within a 60-second window, originating from the same destination IP address. This pattern is indicative of an attacker attempting to authenticate with a small set of passwords against many accounts.
This rule detects internal Server Message Block (SMB) lateral movement attempts. It triggers when there are 10 or more SMB connections (identified by the "|FF|SMB" content signature) from a single source IP address to any destination on port 445 within a 60-second window, within the home network. This behavior is indicative of an attacker attempting to move laterally within a network using SMB.
This rule detects potential Global Catalog LDAP enumeration attempts. It triggers when a source IP makes 10 or more TCP connections to destination port 3268 (the default port for Global Catalog LDAP) within a 60-second window. This behavior can indicate an attacker attempting to discover information about users, groups, and computers within an Active Directory environment.
This rule detects TCP connections to port 8888, which is commonly used by Remote Access Trojans (RATs) for Command and Control (C2) communications. The rule specifically looks for the SYN flag in the TCP handshake, indicating the initiation of a new connection from the internal network ($HOME_NET) to any external destination.
This rule detects network connections to TCP port 4444, which is a commonly used default handler port for Metasploit, a popular penetration testing framework. The rule specifically looks for the initial SYN packet (flags:S) of a TCP connection from any source to any destination on port 4444 within the home network. This activity is often associated with command and control (C2) communication or reverse shells established by attackers using Metasploit.
This rule detects a TCP SYN Flood Denial of Service (DoS) attack. It triggers when a high volume of TCP SYN packets (1000 packets within 5 seconds) are observed targeting a single destination IP address within the HOME_NET, indicating an attempt to overwhelm the target's network resources.
This rule detects network connections to TCP port 45700, which is a default port used by the XMRig cryptocurrency miner. The detection specifically looks for the initiation of a connection (SYN flag) from the internal network ($HOME_NET) to any external host. This activity is indicative of a system within the internal network potentially running an XMRig miner, which aligns with the MITRE ATT&CK technique T1496 (Resource Hijacking).
This rule detects network connections initiated by specific executables (clawdbot, node, moltbot, openclaw) from a local port (18789, 3000, or 8080) to a remote IP address that is not localhost, not within private IP ranges (10.0.0.0/8, 192.168.0.0/16, 172.16.0.0/12), and not within the 17.0.0.0/8 CIDR block. This could indicate command and control (C2) communication or unauthorized data exfiltration by potentially malicious bots or applications.
Esta detección identifica posibles conexiones relacionadas con el uso de VPNs dentro del entorno corporativo, correlacionando puertos asociados a protocolos VPN, dominios no habituales, procesos iniciadores y adaptadores de red virtuales o tunelizados. El objetivo es descubrir actividad de VPN no autorizada, conexiones cifradas ocultas dentro de tráfico HTTPS y el uso de extensiones de navegador que actúan como túneles tipo VPN.
La lógica de esta consulta aplica múltiples capas de filtrado para reducir falsos positivos:
- Filtra conexiones salientes hacia puertos característicos de IPsec, OpenVPN, WireGuard, L2TP y PPTP.
- Detecta túneles sobre puerto 443 cuando el proceso iniciador no corresponde a aplicaciones del sistema.
- Excluye ruido generado por procesos de Windows y dominios legítimos asociados a Microsoft, Google y servicios cloud corporativos.
- Identifica adaptadores TAP, TUN, Wintun, WireGuard, Tailscale o ZeroTier presentes en el host.
- Clasifica el tipo probable de VPN según el puerto utilizado y el proceso que inicia la conexión.
Esta detección permite encontrar:
- Clientes VPN instalados sin autorización.
- Extensiones de navegador que establecen túneles SSL-VPN encubiertos.
- Herramientas de túneles encubiertos como WireGuard stealth, Tailscale o ZeroTier.
- Actividad anómala desde navegadores que podría indicar proxies cifrados o VPNs embebidas.
La lógica de esta consulta aplica múltiples capas de filtrado para reducir falsos positivos:
- Filtra conexiones salientes hacia puertos característicos de IPsec, OpenVPN, WireGuard, L2TP y PPTP.
- Detecta túneles sobre puerto 443 cuando el proceso iniciador no corresponde a aplicaciones del sistema.
- Excluye ruido generado por procesos de Windows y dominios legítimos asociados a Microsoft, Google y servicios cloud corporativos.
- Identifica adaptadores TAP, TUN, Wintun, WireGuard, Tailscale o ZeroTier presentes en el host.
- Clasifica el tipo probable de VPN según el puerto utilizado y el proceso que inicia la conexión.
Esta detección permite encontrar:
- Clientes VPN instalados sin autorización.
- Extensiones de navegador que establecen túneles SSL-VPN encubiertos.
- Herramientas de túneles encubiertos como WireGuard stealth, Tailscale o ZeroTier.
- Actividad anómala desde navegadores que podría indicar proxies cifrados o VPNs embebidas.
This rule detects WebSocket C2 authentication attempts by the Frogblight mobile banking malware. It specifically looks for the hardcoded login key '{"login_key":"fg_a1b2c3d4e5f6"}' within TCP traffic destined for external networks.
SQL Database Version Discovery
Suricata
This rule detects attempts to discover the version of a SQL database, often a precursor to SQL injection attacks or other reconnaissance activities. It specifically looks for SQL queries containing keywords like 'select' and 'version' in various common formats used to retrieve database version information.
This rule detects network traffic indicative of a Windows Shortcut Link (LNK) file containing an unusually large amount of padded whitespace in its command line arguments. This technique is often used to obfuscate malicious commands or exploit vulnerabilities like ZDI-CAN-25373, which was a zero-day exploit related to Windows shortcuts. The rule specifically looks for the LNK file header signature and then uses a PCRE to identify repeated whitespace characters (tab, newline, vertical tab, form feed, carriage return, space) within the file data, suggesting padding for obfuscation or to bypass security controls.
This rule detects the 'Zip Slip' vulnerability pattern within incoming ZIP archives. Specifically, it looks for the sequence '..\' (dot dot backslash) in the file data of a ZIP archive, which is indicative of an attempt to extract files outside of the intended directory. This vulnerability can lead to directory traversal and arbitrary file overwrite.
This rule detects attempts to exploit the Zip Slip vulnerability within TAR archives. Specifically, it looks for the sequence `../` (dot dot slash) within the file data of an inbound TAR archive, which indicates an attempt to write files outside of the intended directory during extraction. This is a common technique used in Zip Slip attacks to achieve directory traversal and potentially overwrite critical system files or place malicious files in arbitrary locations.
This rule detects the 'Zip Slip' vulnerability pattern within TAR archive uploads. Specifically, it looks for the sequence '../' (dot dot slash) in the file data of a TAR archive, which indicates an attempt to traverse directories and potentially write files outside the intended extraction directory. This is a common technique used in Zip Slip attacks to achieve arbitrary file write.
This rule detects inbound network traffic attempting to exploit an open redirect vulnerability within the Google APIs 'AddItNow' service. Specifically, it looks for requests to 'apis.google.com/additnow/l?__lu=' which could be used to redirect users to arbitrary malicious websites.
Page 41 of 42