Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20 detections
Filters
Last updated
All Time
Detection languages
6
6
4
2
1
Contributors
7
6
2
2
1
Categories
11
9
8
4
3
Platforms
10
5
4
2
2
Products / Services
6
3
2
2
2
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
IDS Classtypes
4
2
IDS Protocols
6
Detects modifications to AWS S3 bucket policies, access control lists (ACLs), or public access block configurations that result in public bucket exposure. The rule specifically flags broad permissions such as 'AllUsers' or wildcard principal entities, and correlates these findings with AWS Config or Access Analyzer data to confirm public reachability.
This rule monitors for the execution of common penetration testing tools (nuclei, ffuf, sqlmap) and detects network activity towards OpenRouter.ai, a platform that provides access to various Large Language Models (LLMs), often used in automation or script-assisted reconnaissance and exploitation. It also flags instances where container runtimes are used to execute these same tools.
Detects anomalous Microsoft Graph API usage patterns where a single account interacts with a high number of unique request paths using common API pagination or search parameters, indicating potential resource enumeration or reconnaissance activity.
Detects high-volume, unauthenticated REST API requests to ServiceNow endpoints, specifically those identified as coming from a 'guest' user account or lacking authentication tokens, which may indicate reconnaissance, vulnerability scanning, or automated data extraction attempts.
This rule monitors web server access logs for suspicious activity targeting sensitive Flowise API endpoints (credentials, variables, secretvariable, apikey). It flags two types of threats: 1) Case-bypass evasion attempts, where canonical endpoints are bypassed via non-standard casing while requesting sensitive data (e.g., matching a status 200 on non-canonical casing for sensitive paths), and 2) High-frequency requests indicative of bulk enumeration or directory/wordlist scanning.
This rule detects the execution of common security reconnaissance and enumeration tools (e.g., subfinder, nuclei, gobuster, httpx) or suspicious Python scripts typically associated with scanning and discovery activities. It uses Sysmon Process Creation events and flags instances where high-volume scanning parameters are used or where multiple distinct tools or executions are observed on a single host.
Detects directory brute force tools like Gobuster, ffuf, feroxbuster
Detects an unusually high volume of web requests (1000 or more per minute) originating from a single IP address to an IIS web server. This pattern can indicate various malicious activities such as brute-force attacks, denial-of-service (DoS) attempts, or aggressive web scanning.
This rule detects a high rate of HTTP GET requests that are likely resulting in 404 (Not Found) errors, indicative of a directory brute-force attack. The rule triggers if a single source IP makes 50 or more HTTP GET requests within a 10-second window, suggesting an automated attempt to discover hidden directories or files on a web server.
This rule detects HTTP requests where the User-Agent header contains the string "ffuf" (case-insensitive). FFUF (Ffuf is a Fast Web Fuzzer) is a common tool used for web enumeration, including directory and file brute-forcing. Detection of this User-Agent indicates a potential reconnaissance activity or an attempt to discover hidden web resources.
This rule detects web directory brute-force attempts by identifying HTTP requests where the User-Agent header contains the string "DirBuster". DirBuster is a well-known tool used for brute-forcing directories and file names on web servers.
This rule detects web directory brute-force attempts by identifying the 'gobuster' string in the HTTP User-Agent header. Gobuster is a common tool used for directory and file enumeration on web servers, often as part of reconnaissance or vulnerability scanning activities. The rule specifically targets HTTP traffic flowing to the server.
This rule detects HTTP requests where the User-Agent header contains the string "feroxbuster" (case-insensitive). Feroxbuster is a command-line tool used for content discovery on web servers, often employed in penetration testing or reconnaissance phases to find hidden directories and files. Detecting its User-Agent can indicate an active directory brute-force or content discovery scan against the network.
This rule detects web path fuzzing activity by identifying the 'dirsearch' string in the HTTP User-Agent header. Dirsearch is a common tool used for discovering web directories and files, often employed in reconnaissance phases of attacks or security assessments.
This rule detects attempts at Local File Inclusion (LFI) or Remote File Inclusion (RFI) vulnerabilities by analyzing web server logs for specific patterns in the request URI. It looks for directory traversal sequences ('../'), attempts to access common sensitive files like '/etc/passwd', or patterns indicating file inclusion via HTTP or file:// protocols.
KQL Query
KQL Query from file: Perimeter Defense - Attack Surface Reduction
'Detects suspicious user agent strings used by known hack tools'
This rule detects the execution of various known hacktools on Linux systems by monitoring process creation events and matching against a predefined list of tool names in the 'Image' field. The tools covered include C2 frameworks (e.g., Cobalt Strike, Metasploit, Havoc, Merlin, Sliver), network scanners (e.g., Nmap derivatives, Nuclei, Recon-ng), web enumeration tools (e.g., Dirb, Ffuf, Gobuster), web vulnerability scanners (e.g., Nikto, WPSCan), and other exploit/post-exploitation tools (e.g., Aircrack-ng, Bloodhound-Python, Hashcat, Hydra, John, SQLMap, PEASS-ng).
This rule detects suspicious user agent strings commonly used by various hacking tools, including vulnerability scanners, brute-force tools, and SQL injection tools, within proxy logs. The rule identifies specific strings indicative of tools like Arachni, Hydra, DirBuster, SQLMap, and others, which are often employed during reconnaissance, initial access, and credential access phases of an attack.