Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
18,128 detections
Filters
Last updated
All Time
Detection languages
6,549
6,208
1,473
1,005
661
Contributors
3,555
2,652
2,153
2,087
1,515
Categories
7,572
3,901
1,465
1,393
1,330
Platforms
13,733
1,392
1,319
824
738
Products / Services
3,828
3,137
2,448
912
908
MITRE Techniques
18,128
15,651
12,599
8,410
6,235
CVEs
19
18
17
16
14
IDS Classtypes
305
51
24
23
22
IDS Protocols
308
136
13
10
10
This rule detects network traffic on TCP port 445 (SMB) containing the string "DisableRealtimeMonitoring" (case-insensitive). This string is often associated with attempts to disable real-time monitoring features of security products, typically by modifying registry keys. The detection is focused on traffic flowing from any source to the home network, specifically to the SMB port, and only on established connections. This activity is indicative of an attacker attempting to evade detection by crippling security software.
This rule detects attempts to disable Windows Defender via a registry modification, specifically looking for the string "DisableAntiSpyware" in HTTP client body traffic. This activity is often associated with malware or adversary actions to evade defense mechanisms.
Detects enabling Hide500Users in com.apple.loginwindow plist preferences, which suppresses
sub-500 UID accounts from the login screen and System Settings.
sub-500 UID accounts from the login screen and System Settings.
This rule detects attempts to set the hidden attribute on a file using the 'attrib +h' command over a network connection to a Windows machine (port 445). This technique is often used by attackers to hide malicious files from users and system administrators, contributing to defense evasion.
This rule detects attempts to create hidden files or directories in the /tmp directory on a remote host via SSH. Specifically, it looks for SSH traffic (tcp port 22) containing the strings "touch ." and "/tmp/." (case-insensitive). This behavior is often associated with adversaries attempting to hide their artifacts on a compromised system.
This rule detects a TLS downgrade attack where a client attempts to establish a connection using a weaker TLS protocol version, specifically TLS 1.0. This could indicate an attacker forcing a less secure communication channel to exploit vulnerabilities in older TLS versions.
This rule detects HTTP traffic indicating an Amazon EC2 instance is being reverted to a snapshot. Specifically, it looks for HTTP requests to 'ec2.amazonaws.com' with the URI containing 'RestoreSnapshotTier'. This activity could be part of a cleanup process or an attempt to restore a compromised instance to a known good state, but could also be used by an attacker for defense evasion by reverting changes.
This rule detects attempts to create new cloud instances, specifically targeting AWS EC2, by monitoring HTTP traffic for requests to 'ec2.amazonaws.com' with the 'RunInstances' URI. The rule is designed to identify suspicious activity related to the provisioning of new virtual machines in a cloud environment, potentially indicating unauthorized resource creation or evasion tactics.
This rule detects the presence of an MSBuild inline task payload within HTTP traffic. It specifically looks for the combination of the strings "<UsingTask", "TaskFactory", and "Code" (case-insensitive) within the file data of an HTTP response. This pattern is indicative of an MSBuild inline task, which can be used by attackers for proxy execution, often as a defense evasion technique.
This rule detects HTTP requests where the URI contains common developer utility executables (msbuild, csc, vbc, jsc) being used as a proxy for code execution. This behavior is often associated with defense evasion techniques where legitimate tools are leveraged for malicious purposes.
This rule detects attempts to load a PowerShell assembly reflectively in memory. It specifically looks for the string "[System.Reflection.Assembly]::Load(" within HTTP response data flowing to a client. This technique is often used by malware to execute malicious code without writing it to disk, making it a common defense evasion tactic.
This rule detects attempts to build a Docker image on a compromised host via the Docker API. It specifically looks for HTTP POST requests to the '/build' endpoint on port 2375, which is the default unsecured Docker API port. This activity could indicate an attacker leveraging a compromised system to build malicious Docker images.
This rule detects HTTP requests where the URI contains "SyncAppvPublishingServer" case-insensitively. This pattern is often associated with script proxy execution, a technique used by attackers to execute malicious scripts by leveraging legitimate system utilities. The rule specifically looks for this string in the URI of established, to-server HTTP flows, indicating potential trojan activity or defense evasion.
This rule detects HTTP requests where the URI contains both 'pubprn' and '.sct' (case-insensitive). This combination is indicative of an attempt to use the 'pubprn.vbs' script for COM scriptlet execution, a technique often employed by attackers for defense evasion.
This rule detects potential modification of a network device's system image via TFTP. It specifically looks for UDP traffic on port 69 (TFTP) where the packet size is greater than 50000 bytes and contains the byte sequence "|00 02|" at a depth of 2 bytes, which is indicative of a TFTP write request (opcode 2). The large packet size suggests a system image transfer.
This rule detects unauthorized Kerberos service ticket requests directed at a Domain Controller (DC). It specifically looks for TCP traffic to port 88 (Kerberos) on the home network, with a content match for the byte sequence '|6b|' at the beginning of the payload. A threshold of 50 requests within 10 seconds from the same source IP triggers the alert, indicating a potential brute-force or enumeration attempt against Kerberos services.
This rule detects HTTP traffic where the User-Agent header contains 'Microsoft', 'Google', or 'Amazon' (case-insensitive) and the Host header contains an IPv4 address. This combination could indicate an attacker impersonating a legitimate vendor's API client while making direct IP-based requests, potentially bypassing DNS-based security controls or targeting internal services.
This rule detects HTTP responses from a server to a client that contain the case-insensitive strings "IT Support", "helpdesk", and "password" within the file data. This combination of keywords suggests a web page designed to impersonate IT support, potentially for phishing or credential harvesting purposes.
This rule detects the string "ComRegisterFunction" within HTTP response bodies (file.data). This string is associated with .NET assembly registration, specifically when tools like Regsvcs or Regasm are used for 'Assembly Proxy Execution'. This technique is often employed by attackers for defense evasion, as it allows them to execute malicious code via legitimate Microsoft utilities.
This rule detects network traffic (specifically HTTP responses) that contains patterns indicative of timing-based anti-debugging techniques. It looks for the presence of "__rdtsc" (Read Time-Stamp Counter) and "ExitProcess" within the file data of an HTTP response, suggesting that a program might be attempting to detect a debugger by measuring execution time and exiting if debugging is detected. This is a common technique used by malware to evade analysis.
This rule detects potential in-memory PE loading without disk write by looking for specific strings in HTTP file data. It specifically searches for the strings "Assembly.Load(" and "Invoke(" (case-insensitive) within the HTTP response body (flow:to_client,established; file.data). This combination of strings is indicative of .NET applications dynamically loading assemblies into memory and then executing methods, which can be a technique used by malware to avoid writing executables to disk.
Page 460 of 864