Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,123 detections
Filters
Last updated
All Time
Detection languages
1,062
796
474
242
137
Contributors
463
427
399
318
291
Categories
926
771
637
574
311
Platforms
2,112
365
219
214
142
Products / Services
487
482
389
167
150
MITRE Techniques
18,116
15,638
12,587
8,397
6,227
3,123
CVEs
12
12
8
8
5
IDS Classtypes
62
26
22
11
7
IDS Protocols
47
37
15
8
7
This rule detects the launch of a GPU instance in Google Cloud Platform (GCP) by monitoring HTTP traffic. Specifically, it looks for HTTP requests to 'compute.googleapis.com' with the URI containing '/instances' and the client body containing 'acceleratorType' (case-insensitive). This combination suggests an attempt to provision a GPU-enabled virtual machine, which could be indicative of resource hijacking for purposes like cryptocurrency mining or other compute-intensive malicious activities.
This rule detects bulk account deletion attempts via LDAP. It triggers when multiple LDAP requests (at least 5 within 30 seconds from the same source IP) are observed on port 389, containing both 'userAccountControl' and 'delete' keywords, indicating an attempt to modify user account control attributes to disable or delete accounts.
This rule detects attempts to exploit applications for denial of service by looking for the string "${jndi:" (case-insensitive) within the HTTP URI. This pattern is commonly associated with JNDI injection vulnerabilities, which can be leveraged for various attacks, including denial of service. The rule is configured to trigger an alert if 10 such attempts are observed from the same destination IP within 30 seconds.
This rule detects a potential SSL/TLS Handshake Exhaustion Attack. It triggers when a high volume of TCP SYN packets (flags:S) are observed targeting port 443 (HTTPS) on the home network within a short timeframe. Specifically, it looks for more than 200 SYN packets to the same destination within a 5-second window, indicating an attempt to overwhelm the server with handshake requests, leading to a denial of service.
This rule detects attempts to manipulate application runtime memory via web shell activity. Specifically, it looks for HTTP requests where the URI content contains the string "WriteProcessMemory" (case-insensitive). This string is indicative of an attempt to use a function commonly associated with injecting code or modifying the memory of a running process, often a technique employed by web shells to achieve persistence or execute arbitrary code.
This rule detects attempts to modify stored data within a MySQL database, specifically looking for 'UPDATE' and 'WHERE' clauses in TCP traffic directed to the MySQL default port (3306). It triggers an alert if 50 such events are observed from the same source IP within a 30-second window, indicating potential malicious activity aimed at data integrity compromise.
This rule detects network traffic on TCP port 3333, which is commonly associated with the Stratum protocol used in cryptocurrency mining. The rule specifically looks for the initiation of a TCP connection (SYN flag) to this port from the home network to any destination. This activity could indicate the presence of cryptomining malware or unauthorized cryptomining operations within the network.
This rule detects potential HTTP/2 Rapid Reset or similar denial-of-service (DoS) attacks by identifying an unusually high number of streams and total requests within a single HTTP/2 network connection over a one-minute interval. Such behavior is indicative of an attacker attempting to exhaust server resources by rapidly opening and closing streams.
Detects the specific command line arguments used by Payouts King ransomware, specifically requiring the mandatory execution trigger parameter '-i' alongside at least one of the obfuscated behavior flags: '-noelevate', '-nohide', '-nopersist', or '-note'. This combination is highly indicative of Payouts King ransomware execution.
This rule identifies an anomalous surge in network connection attempts to a particular remote IP address. It establishes a baseline of average daily connection counts to each remote IP over the past week. It then compares the current hourly connection count to this baseline, triggering an alert if the current count is more than five times the baseline and surpasses a total of 500 connections within that hour. This could indicate various malicious activities such as data exfiltration, command and control communication, or a denial-of-service attack originating from the monitored environment.
This rule detects an unusually high number of network connection events originating from a single device to a remote IP address within a one-minute interval. This behavior can be indicative of various malicious activities, including network scanning, port scanning, or a denial-of-service (DoS) attempt. It could also signal a compromised host attempting to establish numerous connections for command and control, data exfiltration, or further reconnaissance.
This rule detects attempts to perform a mass device wipe or deletion using Microsoft Intune. It identifies devices that have been wiped or deleted within the last 24 hours and enriches this information with device details such as name, user, OS, and ownership. This can indicate a destructive attack or an attempt to remove evidence.
Detects the execution of the Shai-Hulud malware's dead-man switch mechanism, specifically the 'gh-token-monitor' service or its destructive wipe payload 'rm -rf ~/'.
This rule detects a high volume of HTTP/2 requests (more than 3000 per minute) originating from a single remote IP address, especially when these requests target a diverse set of URIs (more than 10 distinct URIs). This pattern can indicate a denial-of-service (DoS) attack, a web scanner, or other malicious automated activity attempting to overwhelm a service or enumerate resources.
This rule detects an unusually high number of web search queries (identified by 'search' or 'query' in the URI) originating from a single IP address within a one-hour window. A threshold of 100 or more queries triggers the alert. This behavior could indicate automated activity such as web scraping, reconnaissance, or a denial-of-service attempt against the search functionality.
This rule detects various suspicious activities associated with a cryptojacking campaign, including the execution of 'RuntimeHost.exe' from unusual directories, creation of suspicious scheduled tasks, DLL side-loading followed by silent MSI execution, process hollowing into .NET utilities, Windows Defender exclusion attempts, and persistence mechanisms via startup folder shortcuts and registry run keys. These activities are indicative of an attacker establishing persistence and evading defenses to perform unauthorized cryptocurrency mining.
Remote Service Stop via SMB
Suricata
This rule detects attempts to remotely stop a service via SMB (Server Message Block) by looking for the 'svcctl' and 'StopService' strings in TCP traffic on port 445. This activity is often associated with trojan activity or other malicious impact operations.
This rule detects a UDP flood Denial of Service (DoS) attack targeting the home network. It triggers an alert if more than 1000 UDP packets are observed from any source to any destination within the home network within a 5-second interval, tracked per destination.
This rule detects a TCP SYN Flood Denial of Service (DoS) attack. It triggers when a high volume of TCP SYN packets (1000 packets within 5 seconds) are observed targeting a single destination IP address within the HOME_NET, indicating an attempt to overwhelm the target's network resources.
This rule detects network connections to TCP port 45700, which is a default port used by the XMRig cryptocurrency miner. The detection specifically looks for the initiation of a connection (SYN flag) from the internal network ($HOME_NET) to any external host. This activity is indicative of a system within the internal network potentially running an XMRig miner, which aligns with the MITRE ATT&CK technique T1496 (Resource Hijacking).
Detects the creation of specific Payouts King ransomware artifacts, including its ransom note ('readme_locker.txt') and known encrypted file extensions ('.ZWIAAW') or temporary backup file extensions ('.esVnyj'). This rule focuses on file creation events indicative of a Payouts King ransomware infection.
Page 80 of 149