Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
18,128 detections
Filters
Last updated
All Time
Detection languages
6,549
6,208
1,473
1,005
661
Contributors
3,555
2,652
2,153
2,087
1,515
Categories
7,572
3,901
1,465
1,393
1,330
Platforms
13,733
1,392
1,319
824
738
Products / Services
3,828
3,137
2,448
912
908
MITRE Techniques
18,128
15,651
12,599
8,410
6,235
CVEs
19
18
17
16
14
IDS Classtypes
305
51
24
23
22
IDS Protocols
308
136
13
10
10
This rule detects attempts to remotely clear event logs over Server Message Block (SMB) by looking for the strings "Eventlog" and "ClearEventLog" in TCP traffic destined for port 445. This activity is often associated with adversaries attempting to remove forensic evidence of their presence on a system.
This rule detects network traffic indicative of WMI remote execution, specifically looking for the string "IWbemServices" on TCP port 135. This activity is often associated with Living Off The Land Binaries and Scripts (LOLBAS) techniques, where legitimate system tools like WMI are abused for malicious purposes such as remote code execution or lateral movement. The rule is designed to alert on potential trojan activity.
This rule detects the download of a COM scriptlet (.sct file) over HTTP that contains XML and the keyword 'scriptlet'. This behavior is characteristic of the 'Squiblydoo' technique, which abuses legitimate Windows binaries like Regsvr32 to execute arbitrary code, often for defense evasion.
This rule detects HTTP traffic where the User-Agent header contains the string 'CertUtil' (case-insensitive). This pattern is often associated with adversaries using the Windows built-in utility CertUtil to download malicious payloads, a common technique for defense evasion.
This rule detects HTTP downloads where the file is disguised as an image (e.g., .jpg, .png) but its content starts with 'MZ', indicating it's a Windows executable. This is a common technique used by adversaries to bypass security measures that might block executable downloads but allow image files.
This rule detects attempts to drop a DLL file to a network share, specifically targeting the 'ADMIN$' share, which could indicate a DLL hijacking attempt. It monitors SMB traffic on port 445 for established connections and looks for content containing '.dll' and 'ADMIN$' (case-insensitive).
Bitsadmin Tool Transfer Download
Suricata
This rule detects the use of the 'bitsadmin' tool in HTTP user agent strings during a file transfer download. Bitsadmin is a legitimate Windows command-line tool used to create, manage, and monitor download and upload jobs, but it is frequently abused by adversaries for command and control, data transfer, and persistence.
Detects the creation or modification of TxF CLFS log files (FsTxLog.blf) within the System Volume Information directory, which is a primary staging mechanism for the YellowKey BitLocker bypass. The rule also identifies potential VMware MAC OUI within the Resource Manager GUID, indicating a high-confidence proof-of-concept artifact.
This rule detects an SSH brute force attack by monitoring TCP connections to port 22 (SSH) on the home network. It triggers an alert if more than 20 TCP SYN packets are observed from a single source IP address within a 60-second window, indicating a high volume of connection attempts characteristic of a brute force.
This rule set detects various stages of the JFMBackdoor and Showboat malware, including DLL sideloading of FLTLIB.dll by fltMC.exe from non-standard directories, network connections to known C2 and staging infrastructure (namefuture.site or 23.27.201.160), command-line activity referencing a specific Pastebin URL used by Showboat for process-hiding code, and the creation of JFMBackdoor payload artifacts (flt.bin, scr.mui).
This rule detects HTTP requests that contain 'gcc' and '-o' in the URI, which could indicate an attempt to compile malware on a host using the GCC compiler. This activity is often associated with defense evasion techniques where an attacker compiles malicious code directly on a compromised system.
This rule detects attempts to install a kernel module (rootkit) on a Linux system via an SSH session. It specifically looks for the 'insmod' command followed by a '.ko' file extension within TCP traffic destined for port 22 (SSH). This combination suggests an attacker is trying to load a malicious kernel object.
This rule detects attempts to push a root certificate to a Windows system via the Remote Registry service (SMB port 445). It specifically looks for network traffic containing the strings "Root\Certificates" and "RegSetValue" (case-insensitive) within the same TCP flow to a server on port 445. This activity could indicate an attacker attempting to establish persistence or bypass security controls by installing a trusted root certificate.
This rule detects network traffic on TCP port 445 (SMB) containing the string "wintrust.dll" in a case-insensitive manner. This specific DLL is associated with Windows Trust Provider functionality. The detection is flagged as 'trojan-activity' and is linked to MITRE ATT&CK technique T1553.003 (Code Signing: Code Signing Policy Modification) and tactic Defense Evasion, suggesting an attempt to bypass code signing policies by replacing or manipulating the wintrust.dll.
This rule detects the delivery of a payload designed to bypass trust controls via HTTP. It specifically looks for HTTP responses (flow:to_client) containing the 'MZ' magic bytes (indicating an executable file) within the first 2 bytes of the file data, combined with URI paths that include keywords like 'bypass', 'unsigned', or 'notrust'. This combination suggests an attempt to deliver malicious or untrusted executables that aim to circumvent security mechanisms.
This rule detects the string "DisableAntiSpyware" in HTTP response bodies. This string is often associated with commands or responses related to disabling security defenses, specifically anti-spyware features, which is a common tactic used by malware or attackers for defense evasion. The rule is designed to alert when such a command or response is delivered to a client within an established HTTP flow.
This Suricata rule detects network traffic on TCP port 445 (SMB) that contains the strings "SpecialAccounts" and "UserList" (case-insensitive). This pattern is indicative of an attempt to hide a user account on a Windows system by modifying the registry's SpecialAccounts\UserList key. This technique is often used by adversaries for defense evasion.
This rule detects HTTP responses containing a Windows executable (identified by the 'MZ' header) where the URI path suggests it's masquerading as a legitimate Windows system binary like svchost.exe, winlogon.exe, lsass.exe, services.exe, or csrss.exe. This is a common technique used by malware to evade detection by appearing as a trusted process.
This rule detects attempts to remove a network share connection using the 'NetUseDel' command. This activity is often associated with adversaries trying to hide their access or clean up traces after establishing persistence or performing other actions on a compromised system. The detection specifically looks for the 'NetUseDel' string within TCP traffic directed to port 445 (SMB/CIFS), indicating an attempt to delete a network share.
This rule detects the delivery of a hidden virtual file system container over HTTP. It looks for HTTP traffic flowing to the client that contains both the string "VirtualDisk" (case-insensitive) and the "MZ" header (indicating a Windows executable or DLL) within the file data. This combination suggests the download of a malicious executable designed to create or utilize a hidden virtual disk.
This rule detects TCP traffic to port 389 (LDAP) where the content of the packet contains both "sAMAccountName" and "admin" (case-insensitive). This combination suggests an attempt to query or manipulate an LDAP directory for an account named 'admin' using the sAMAccountName attribute, potentially indicating user account masquerading as a service account or reconnaissance activity.
Page 466 of 864