Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,123 detections
Filters
Last updated
All Time
Detection languages
1,062
796
474
242
137
Contributors
463
427
399
318
291
Categories
926
771
637
574
311
Platforms
2,112
365
219
214
142
Products / Services
487
482
389
167
150
MITRE Techniques
18,116
15,638
12,587
8,397
6,227
3,123
CVEs
12
12
8
8
5
IDS Classtypes
62
26
22
11
7
IDS Protocols
47
37
15
8
7
This rule detects attempts to upload web shells for website defacement. It specifically looks for HTTP POST requests where the URI contains the string "deface" (case-insensitive). This combination suggests an attacker is trying to modify a website's content, potentially by uploading a malicious script or file.
This rule detects the creation of an Azure Blob Lifecycle Management rule that is configured for deletion. It specifically looks for HTTP PUT requests to blob.core.windows.net with 'managementPolicies' in the URI, indicating an attempt to define or modify lifecycle policies for Azure Blob Storage, potentially for data deletion.
Direct TCP SYN Flood DoS Attack
Suricata
This rule detects a direct TCP SYN flood Denial of Service (DoS) attack. It triggers when a destination IP address receives 1000 or more TCP SYN packets within a 5-second window. The 'flags:S' indicates that only packets with the SYN flag set are counted. This type of attack aims to exhaust the target's resources by initiating many half-open connections.
This rule detects attempts to overwrite the Master Boot Record (MBR) or disk structure using the 'dd' command via a remote SSH connection. Specifically, it looks for the string 'dd if=/dev/zero of=/dev/sda' within TCP traffic on port 22 (SSH). This command, if executed, would wipe the primary disk, leading to system destruction.
This rule detects when a single computer executes 5 or more process termination commands (taskkill or Stop-Process) within a one-hour window. This behavior can be indicative of an adversary attempting to disrupt system operations or evade defenses by stopping security tools or critical services.
Detects Windows Error Reporting (Event ID 1000) events associated with lsass.exe crashes. Memory corruption exploits, such as CVE-2026-41089 (Netlogon RCE), often cause service instability. Monitoring for lsass.exe crashes can reveal failed exploitation attempts or other critical system issues.
Detects the creation or deletion of Kubernetes namespaces and nodes via the API server. This activity can indicate an adversary attempting to establish persistence, expand their control, or disrupt the environment within a Kubernetes cluster.
This rule detects a high volume of HTTP/2 requests (more than 3000 per minute) originating from a single remote IP address, especially when these requests target a diverse set of URIs (more than 10 distinct URIs). This pattern can indicate a denial-of-service (DoS) attack, a web scanner, or other malicious automated activity attempting to overwhelm a service or enumerate resources.
This rule detects potential Business Email Compromise (BEC) attempts by identifying emails where the sender's address contains keywords like 'ceo', 'finance', or 'hr', and the subject contains keywords like 'wire', 'payment', or 'invoice', but the sender's domain does not match the internal company domain. This pattern suggests an attempt to impersonate a high-ranking individual or department to trick recipients into making unauthorized financial transactions.
Detects the creation of files with names commonly associated with LockBit ransomware, such as '.lockbit', 'lockbit_note', or '.abcd'. This rule specifically looks for these file names being created on devices, which is indicative of ransomware activity.
Detects C2 commands triggering disk wipe operations for destructive impact
Detects HTTP application-layer flood attacks for denial of service impact
Detects raw disk volume access used to bypass file system security controls
This rule detects attempts to overwrite router firmware via an SSH session. It specifically looks for the string "flash write" within TCP traffic directed to port 22 (SSH) on the home network. This activity is indicative of an attacker attempting to modify the router's operating system, potentially for persistence, backdooring, or other malicious purposes.
This rule detects a direct User Datagram Protocol (UDP) flood Denial of Service (DoS) attack. It triggers an alert if more than 1000 UDP packets are observed targeting a single destination within a 5-second window. This high volume of UDP traffic is indicative of an attempt to overwhelm a target system or network resource, making it unavailable to legitimate users.
This rule detects a high volume of inbound emails to port 25 (SMTP), indicating a potential email bombing attack. It triggers an alert if more than 100 emails are received from a single source IP address within a 60-second window.
Detects Shellshock bash CGI exploitation attempts
This rule detects a high volume of web requests (20 or more within 5 minutes from a single IP address) containing keywords commonly associated with denial-of-service (DoS) attacks, performance testing, or reconnaissance activities against web applications. Keywords include 'sleep', 'benchmark', and 'loadtest' in the URI query string.
Detects NTP reflection amplification DDoS attack traffic
Detects IP addresses generating a high volume of web requests to an IIS server where the referrer is external to the host. This can indicate web scraping, reconnaissance, or denial-of-service attempts.
This rule detects a high volume (50 or more) of HTTP errors (status codes 400 and above) originating from a single client IP address within a 5-minute time window. This behavior can be indicative of various malicious activities such as brute-force attacks, web application vulnerability scanning, or denial-of-service attempts against a web server.
Page 74 of 149