Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,123 detections
Filters
Last updated
All Time
Detection languages
1,062
796
474
242
137
Contributors
463
427
399
318
291
Categories
926
771
637
574
311
Platforms
2,112
365
219
214
142
Products / Services
487
482
389
167
150
MITRE Techniques
18,119
15,639
12,589
8,399
6,227
3,123
CVEs
12
12
8
8
5
IDS Classtypes
62
26
22
11
7
IDS Protocols
47
37
15
8
7
Detects exclusive file locks used to prevent security tools from accessing files
Detects web defacement attempts via HTTP PUT requests to web server content files
This rule detects HTTP traffic indicating a potential cloud service compromise for cryptomining. Specifically, it looks for HTTP requests to 'ec2.amazonaws.com' with the URI containing 'RunInstances' and the client body containing 'p3' (case-insensitive). This combination suggests an attempt to provision EC2 instances, possibly for cryptomining, using a compromised AWS account.
This rule detects network traffic patterns indicative of the XMRig cryptominer communicating with a mining pool. Specifically, it looks for HTTP POST requests to the URI '/api/v1/jobs' with 'job_id' present in the client body, which is a common behavior for XMRig when requesting mining jobs.
This rule detects attempts to abuse an IoT device's firmware update page by sending a large POST request containing the word "firmware" (case-insensitive) to TCP port 80 on the home network. This activity is indicative of an attempt to corrupt the device's firmware, potentially leading to denial of service or unauthorized control.
This rule detects attempts to remotely lock out user accounts via SMB (Server Message Block) by looking for specific content within TCP traffic on port 445. It specifically targets the 'NetUserSetInfo' function call, which can be used to modify user account properties, in conjunction with the keyword 'lockout'. This combination suggests an attacker is attempting to trigger a mass account lockout.
This rule detects a Slowloris Slow HTTP DoS attack. It triggers when a single source IP sends 100 HTTP GET requests within a 300-second window to the internal network. Slowloris attacks work by holding open many HTTP connections to a web server, eventually exhausting the server's connection pool and making it unavailable to legitimate users.
This rule detects an application layer HTTP POST flood, which is a type of Denial of Service (DoS) attack. It triggers when a single destination receives 200 or more HTTP POST requests within a 10-second window. This high volume of POST requests is indicative of an attempt to exhaust server resources or bandwidth.
This rule detects a denial-of-service attack characterized by a high volume of HTTP GET requests targeting a server within a short timeframe. Specifically, it triggers if a single destination IP address receives 500 or more HTTP GET requests within a 10-second window, indicating a potential HTTP request flood aimed at exhausting service resources.
This rule detects a CHARGEN Reflection Amplification Attack. It specifically looks for UDP traffic on port 19 (the CHARGEN service port) directed towards the home network. A threshold of 50 packets within 5 seconds, tracked by destination, is used to identify potential amplification attempts, indicating a denial-of-service attack.
This rule detects an 'Email Subscription Bomb' attack, where an attacker automates sign-ups to various services using a victim's email address. The goal is to flood the victim's inbox with confirmation emails, potentially causing a denial of service or distracting them from other malicious activities. The rule specifically looks for SMTP traffic to port 25 containing the phrase 'confirm your subscription' (case-insensitive) and triggers an alert if this content is seen 50 times within 60 seconds from the same destination IP address.
This rule detects attempts to replace cryptocurrency wallet addresses within HTTP POST requests. It specifically looks for patterns matching Bitcoin (P2PKH, P2SH, Bech32) and Ethereum (0x) wallet addresses in the client body of HTTP POST requests. This activity is indicative of clipboard hijacking or similar malware that aims to redirect cryptocurrency transactions to an attacker's wallet.
This rule detects potential tampering with financial transaction data during transit. It specifically looks for TCP traffic flowing to a server, where the data size is between 100 and 500 bytes, and the content contains both "amount" and "transfer" (case-insensitive). This combination suggests an attempt to modify financial transaction details.
This rule detects the creation of a specific mutex pattern associated with the Grixba ransomware. The mutex name starts with 'CPFATE_' and contains the .NET framework version string 'v4.0.30319', which is a unique artifact used by Grixba to ensure only one instance of itself is running.
Detects an unusually high volume (100 or more within an hour) of API calls (POST, DELETE, PUT methods to URIs containing 'api') originating from a single IP address. This activity could indicate various malicious behaviors such as brute-force attacks, credential stuffing, web application attacks, or a denial-of-service attempt against the API endpoint.
This rule identifies a high volume of HTTP 5xx errors (server-side errors) within a 5-minute interval from IIS logs. A count of 10 or more errors within this timeframe could indicate a web server under attack, a denial-of-service condition, or a critical application failure.
This rule detects an unusually high volume (10 or more within an hour) of file creations with extensions commonly associated with backup files (.backup, .bak, .old). This activity could indicate an adversary attempting to inhibit system recovery by creating numerous backup files, potentially to overwrite legitimate backups or to stage data for exfiltration or destruction.
VSS Shadow Copy Deletion
Cortex XDR
Detects the execution of vssadmin.exe to delete volume shadow copies, a common precursor to ransomware encryption utilized by Payload and other ransomware families. The rule specifically looks for `vssadmin.exe` being executed with the command-line arguments `delete shadows`, `/all`, and `/quiet`, indicating an attempt to silently remove all shadow copies.
This rule detects suspicious activity indicative of post-quantum ransomware, combining two main indicators: the execution of processes with command-line arguments related to post-quantum cryptographic algorithms (Kyber, ML-KEM, NTRU, Dilithium, Falcon, SPHINCS) and the creation of common ransomware notes (README.txt, DECRYPT.txt, RESTORE.txt, PAYMENT.txt, RANSOM.txt). The cryptographic operation detection specifically looks for high or system integrity processes and excludes common legitimate cryptographic tools. The rule correlates multiple cryptographic operations within a short timeframe and the creation of ransom notes to identify potential ransomware deployment.
MSSQL Database DROP Destruction
Suricata
This rule detects attempts to drop a database on an MSSQL server. It specifically looks for the string "DROP DATABASE" in TCP traffic destined for port 1433 (the default MSSQL port). This activity is indicative of data destruction or sabotage.
This rule detects a mass account lockout pattern over LDAP. It triggers an alert if 20 or more LDAP requests containing the string "lockoutTime" are observed from a single destination IP address within a 60-second window. This behavior is indicative of an attacker attempting to lock out multiple user accounts, potentially as a denial-of-service attack or to facilitate other attacks like password spraying by preventing legitimate users from logging in.
Page 78 of 149