Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
84 detections
Filters
Last updated
All Time
Detection languages
39
30
6
4
3
Contributors
21
10
9
9
8
Categories
36
31
15
12
12
Platforms
45
25
8
4
4
Products / Services
15
10
10
7
7
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
CVEs
3
1
IDS Classtypes
2
1
1
IDS Protocols
4
Detects the use of the 'netsh trace' command to initiate network packet capture, executed via cmd.exe or powershell.exe. This activity is a known technique used by The Gentlemen RaaS group to perform credential harvesting from unencrypted internal network traffic by saving packet capture files to administrative shares.
Detects the execution of the 'diagnose sniffer packet' command on FortiOS devices. This command can be abused by malware, such as FortigateSniffer, to intercept authentication traffic, as observed in campaigns like FortiBleed.
SearchProtocolExecution
YARA-L
Detects execution of processes containing 'search' or 'search-ms' in command line with 'crumb=location' parameter.
This rule detects potential cleartext leakage of usernames and passwords over FTP (port 21) by identifying HTTP requests containing common credential-related keywords in the URL, while explicitly excluding HTTPS traffic. This could indicate sensitive information being transmitted insecurely.
Detects the execution of the 'diagnose sniffer packet' command on FortiOS devices. This command can be abused by malware, such as FortigateSniffer, to intercept authentication traffic, as observed in campaigns like FortiBleed.
This rule detects potential cleartext leakage of usernames and passwords over FTP (port 21) by identifying HTTP requests containing common credential-related keywords in the URL, while explicitly excluding HTTPS traffic. This could indicate sensitive information being transmitted insecurely.
Detects credential harvesting portals from evil twin Wi-Fi access points
Detects network events where a remote URL contains repeated null bytes (\0 or \x00) on port 21, which could indicate an attempt to exploit the Squidbleed vulnerability or similar memory dump patterns.
Detects network events where a remote URL contains repeated null bytes (\0 or \x00) on port 21, which could indicate an attempt to exploit the Squidbleed vulnerability or similar memory dump patterns.
This rule detects potential leakage of HTTP Authorization headers (including 'Authorization', 'Basic', 'Bearer', 'Digest', and 'X-API-Key') over FTP (port 21) within network traffic. This could indicate a misconfiguration or an attempt to exfiltrate credentials or sensitive API keys in an unencrypted manner.
This rule detects potential leakage of HTTP Authorization headers (including 'Authorization', 'Basic', 'Bearer', 'Digest', and 'X-API-Key') over FTP (port 21) within network traffic. This could indicate a misconfiguration or an attempt to exfiltrate credentials or sensitive API keys in an unencrypted manner.
Detects the execution of the 'search:' or 'search-ms:' URI handlers utilizing the 'crumb=location:' parameter pointing to a UNC path. This behavior forces outbound NTLM authentication and can be abused to leak Net-NTLMv2 hashes, exploiting an unpatched vulnerability similar to CVE-2026-33829 in the Snipping Tool.
Detects the execution of the 'search:' or 'search-ms:' URI handlers utilizing the 'crumb=location:' parameter pointing to UNC path. This behavior forces outbound NTLM authentication and can be abused to leak Net-NTLMv2 hashes, exploiting an unpatched vulnerability similar to CVE-2026-33829 in the Snipping Tool.
Based off of rule https://systemtwosecurity.com/rules/019e8d90-1f73-76f9-8f67-d534a63a37ec
Based off of rule https://systemtwosecurity.com/rules/019e8d90-1f73-76f9-8f67-d534a63a37ec
Detects unusual protocol combinations indicative of network sniffing activity
This rule detects potential network sniffing by identifying an unusual mix of network protocols originating from a single source IP address. Specifically, it triggers an alert if a source IP sends 10 or more packets within 60 seconds that are neither TCP (protocol 6), UDP (protocol 17), nor ICMP (protocol 1). This behavior could indicate an attacker using tools to capture raw network traffic, as these tools often process protocols beyond the common ones.
Network sniffing refers to using the network interface on a system to monitor or capture information sent over a wired or wireless connection.
An adversary may place a network interface into promiscuous mode to passively access data in transit over the network, or use span ports to capture a larger amount of data.
An adversary may place a network interface into promiscuous mode to passively access data in transit over the network, or use span ports to capture a larger amount of data.
Cisco Sniffing
Sigma
Show when a monitor or a span/rspan is setup or modified
Windows Pcap Drivers
Sigma
Detects Windows Pcap driver installation based on a list of associated .sys files.
Detects the execution of various compiled Windows binaries from the Impacket toolset. This rule identifies the tools based on their filenames or partial filenames, which could lead to false positives due to legitimate software having similar names or adversaries renaming the tools. Impacket is a collection of Python classes for working with network protocols, often used by adversaries for lateral movement, credential access, and execution.
Detects the loading of the WinDivert driver, which is a powerful user-mode package for Windows capable of capturing, sniffing, modifying, blocking, and re-injecting network traffic. This driver can be used by adversaries for network sniffing, credential access, and defense evasion techniques.
Detects the execution of PktMon.exe, a legitimate Windows utility that can be used to capture network packets. Adversaries may abuse this tool for network sniffing to gather information about the environment, including potential credentials or network configurations.
Page 2 of 4