Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,253 detections
Filters
Last updated
All Time
Detection languages
1,543
1,191
352
288
225
Contributors
792
520
494
349
298
Categories
1,711
1,489
400
382
376
Platforms
3,052
528
334
314
254
Products / Services
779
648
634
283
238
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
4,253
CVEs
6
6
6
5
5
IDS Classtypes
75
63
37
23
9
IDS Protocols
127
66
6
4
4
Detects scenarios where a potentially unauthorized application or user modifies the system time. This can be an indicator of defense evasion or an attempt to disrupt system operations or forensic analysis.
This rule detects specific command-line activities associated with the Turla APT group's lateral movement and discovery tactics. It looks for the use of 'net use' to connect to administrative shares (specifically C$) with a hardcoded password, and 'dir' commands used for file and directory discovery, targeting document files and executables in the TEMP directory. These commands are indicative of an adversary attempting to move laterally within a network and gather information about the environment.
Detects potential MuddyWater APT activity involving the use of mshta for execution, PowerShell for system information discovery (operating system, network configuration, security center), and a PowerShell-based backdoor with base64 encoding and web requests.
Detects the installation of suspicious packages using common Linux package managers (apt, yum, rpm, dpkg). The rule specifically looks for keywords associated with network scanning, sniffing, and proxy tools, which could indicate reconnaissance, network analysis, or attempts to bypass network controls by an adversary.
This rule detects the usage of cleartext protocols over a network by monitoring firewall logs for allowed connections to specific destination ports commonly associated with unencrypted services. These ports include HTTP (80, 8080), FTP (21), Telnet (23), and various database or application-specific ports (e.g., 1433, 3306, 1521, 27017, 50000, 11211, 15672, 5900-5904). The rule specifically looks for 'forward' or 'accept' actions, or connections not marked as 'blocked', indicating active cleartext communication. The primary goal is to identify potential credential exposure or sensitive data transmission over insecure channels.
Detects the execution of 'net.exe' or 'net1.exe' with command-line arguments commonly used for discovery activities related to accounts, groups, shares, and services. This rule aims to identify potential reconnaissance or privilege escalation attempts.
This rule detects the creation of specific files that are commonly generated by the BloodHound collection tool, SharpHound. These files, such as 'BloodHound.zip', '_computers.json', '_domains.json', '_groups.json', and others, contain collected Active Directory information. The presence of these files on a system indicates that BloodHound or SharpHound has been used for reconnaissance, which is often a precursor to further malicious activity within an Active Directory environment.
Detects when Google Cloud Storage buckets are enumerated. This activity involves listing storage buckets or their channels, which can be an indicator of reconnaissance by an attacker attempting to understand the environment's data storage landscape.
This rule detects the loading of the 'Microsoft.ActiveDirectory.Management.dll' DLL via PowerShell's 'Import-Module' or its alias 'ipmo'. This DLL is part of the Active Directory module for PowerShell and is frequently used by attackers to perform Active Directory enumeration, especially in environments where RSAT tools are not installed or administrative privileges are not readily available. The detection focuses on the command line payload containing both the module import command and the specific DLL name.
This rule detects attempts to harvest Wi-Fi credentials using the `netsh.exe` utility. Specifically, it looks for `netsh.exe` execution with command-line arguments that indicate an attempt to display WLAN profiles and their keys in clear text, which is a common technique used by malware like Agent Tesla to steal Wi-Fi passwords.
Detects potential container discovery by monitoring for common Linux utilities (awk, cat, grep, head, less, more, nl, tail) being used to read specific files within the '/proc' virtual filesystem. Specifically, it looks for access to '/proc/2/' (which would typically be kthreadd outside a container) or '/proc/cgroup' and '/proc/sched' which can reveal containerized environments due to differences in their content or PID mappings.
This rule detects suspicious sub-processes spawned by common web server processes on Linux systems. It specifically looks for web server processes (Apache, Nginx, Lighttpd, Node, Caddy, Tomcat, WebSphere) executing common system utilities and commands such as 'whoami', 'ifconfig', 'ip', 'uname', 'cat', 'crontab', 'hostname', 'iptables', 'netstat', 'pwd', and 'route'. This behavior is indicative of a web shell being used to execute commands on the compromised server.
Detects the execution of Advanced IP Scanner, a tool often used by ransomware groups for network discovery. The rule identifies the tool by its image name, original file name, description, or specific command-line arguments indicating portable execution.
This rule detects attempts to enumerate remote systems on a macOS host using the 'arp' and 'ping' utilities. Specifically, it looks for 'arp -a' commands, which list all current ARP entries, and 'ping' commands targeting common private IP address ranges (10.0.0.0/8, 192.168.0.0/16, 172.16.0.0/12) as well as localhost (127.0.0.0/8) and APIPA (169.254.0.0/16) ranges. This activity is indicative of an adversary performing network discovery to identify other systems for potential lateral movement.
Detects the use of the 'grep' utility on macOS to search for common security software names. This activity can indicate an adversary attempting to discover installed security solutions on a compromised system.
Detects the usage of the 'find' command on macOS with specific permission-related arguments. These arguments are often used by attackers during discovery phases to locate files with unusual permissions, such as SUID/SGID binaries or world-writable files, which could indicate potential privilege escalation vectors or misconfigurations.
Detects the creation of temporary files associated with Advanced IP Scanner, a tool often used by ransomware groups for network discovery. This rule specifically looks for the creation of files within the user's temporary directory that contain the string '\AppData\Local\Temp\Advanced IP Scanner 2'.
This rule detects attempts to discover if a process is running inside a Docker container by listing or reading the '.dockerenv' file. Attackers often perform container discovery to understand their environment and plan subsequent actions. The rule specifically looks for common Linux utilities like 'cat', 'ls', 'find', 'dir', 'stat', 'test', or 'grep' being executed with '.dockerenv' in their command line arguments.
Detects the use of the built-in Windows utility 'gpresult.exe' with specific command-line arguments ('/z' or '/v') to display detailed Resultant Set of Policy (RSoP) information. This activity can be indicative of an adversary performing discovery to understand the group policy configuration of a system or domain.
This rule detects attempts to enumerate local network configuration on Linux systems. It specifically looks for the execution of common network utilities such as 'firewall-cmd', 'ufw', 'iptables', 'netstat', 'ss', 'ip', 'ifconfig', 'systemd-resolve', and 'route'. Additionally, it triggers if '/etc/resolv.conf' is present in the command line, indicating an attempt to inspect DNS resolver configuration.
Detects the execution of common network scanning or service enumeration tools like telnet, nmap, and netcat on Linux systems, as captured by auditd logs. This activity can indicate an adversary attempting to discover local or remote network services.
Page 184 of 203