Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,421 detections
Filters
Last updated
All Time
Detection languages
4,217
105
40
25
13
Contributors
1,327
1,003
725
627
332
Categories
2,253
2,239
1,434
1,144
973
Platforms
4,107
453
295
83
82
Products / Services
10,670
9,759
6,693
4,421
3,749
MITRE Techniques
886
774
552
505
456
CVEs
18
12
12
12
10
IDS Classtypes
1,868
466
446
362
230
IDS Protocols
2,366
846
388
301
93
This rule detects network connections from devices that might be Raspberry Pis or Hak5 devices, based on their HTTP User-Agent string. Specifically, it looks for User-Agents containing 'python-requests' or 'curl/' followed by a digit, indicating the use of common command-line tools or Python libraries for making HTTP requests. The rule is configured to trigger an alert if 10 such connections are observed from the same source IP within 10 seconds, suggesting automated or frequent activity.
This rule detects DHCP requests originating from a MAC address that is not recognized or expected within the network. It uses a threshold to prevent excessive alerts from a single source, triggering if a source makes more than one DHCP request within a 5-second window. This could indicate an unauthorized device attempting to join the network or a spoofed MAC address.
This rule detects HTTP requests where the 'Host' header contains patterns indicative of free hosting services (000webhost, infinityfree, byethost). These services are often abused by attackers to host malicious infrastructure due to their low cost and ease of setup. The rule specifically looks for these patterns in HTTP traffic flowing from the home network to any destination.
This rule detects a pattern of bulk account registration attempts by monitoring HTTP POST requests to URIs containing 'register'. It triggers an alert if 10 such requests are observed from the same source IP within a 60-second window, indicating potential automated account creation or abuse.
This rule detects attempts to download malware builder tools (such as builders, generators, crypters, or packers) from raw.githubusercontent.com. It specifically looks for HTTP traffic where the host is 'raw.githubusercontent.com' and the URI contains keywords commonly associated with malware development tools.
This rule detects the download of files from raw.githubusercontent.com that contain keywords commonly associated with exploit frameworks, CVEs, or Proof-of-Concepts (PoCs). It specifically looks for 'exploit', 'cve-[0-9]{4}', or 'poc' within the HTTP URI. This activity could indicate an attacker downloading tools or modules for exploitation during resource development or initial access phases.
This rule detects the installation of a new self-signed TLS certificate that might be used by a Command and Control (C2) server. It specifically looks for TLS certificates where both the issuer and subject Common Name (CN) are at least 5 alphanumeric characters long and the 'not before' date is in the current or future years (2024-2029). This combination of characteristics can indicate a newly generated, potentially malicious self-signed certificate.
This rule detects HTTP responses that appear to be phishing pages designed to capture credentials. It specifically looks for HTTP traffic flowing to the client that contains both the words "password" and "submit" (case-insensitive) in the file data, and where the HTTP host is an IP address. This combination suggests a credential input form on a page served from an IP address, which is a common characteristic of phishing attempts.
Offshore VPS Provider API Access
Suricata
This rule detects HTTP traffic to specific domains associated with offshore VPS providers (frantech.ca, serverius.net, combahton.net). This could indicate API access or other interactions with these services, which might be suspicious depending on the environment.
This rule detects potential VPN gateway fingerprinting attempts via the Internet Key Exchange (IKE) protocol. It triggers an alert when a source IP sends 5 or more UDP packets to port 500 (the standard IKE port) on the home network within a 30-second window. This behavior can indicate an attacker attempting to identify active VPN services or their configurations.
This rule detects a network scan targeting TCP port 4444 on the home network. It specifically looks for SYN packets (flags:S) indicating an attempt to establish a connection. A threshold of 5 connection attempts from the same source within 60 seconds triggers the alert, suggesting a port scan activity. Port 4444 is often associated with security appliance management interfaces or backdoors, making probes to this port suspicious.
This rule detects HTTP requests to known IP geolocation lookup services (ip-api.com, ipinfo.io, ipgeolocation.io). A high frequency of such requests from a single source IP within a short timeframe (10 requests in 60 seconds) could indicate reconnaissance activity, where an attacker is gathering information about target IP addresses.
This rule detects network host discovery attempts using a TCP SYN sweep. It triggers when a source IP sends 30 or more TCP SYN packets (indicated by the 'flags:S' option) to any destination on the HOME_NET within a 10-second window. This behavior is characteristic of an attacker attempting to identify active hosts on a network by sending SYN packets and observing which hosts respond with a SYN-ACK.
This rule detects HTTP requests to github.com that contain sensitive file names or patterns in the URI, such as '.env', 'config.php', 'credentials', 'secrets', or 'api_key'. This activity could indicate an attacker or malicious actor searching for sensitive information exposed in public or private GitHub repositories.
This rule detects attempts to fingerprint WordPress login pages by monitoring HTTP requests for the 'wp-login.php' URI. It triggers an alert if a source IP makes 5 such requests within 60 seconds, indicating a potential reconnaissance activity against WordPress installations.
This rule detects network traffic generated by the OpenVAS vulnerability scanner. It specifically looks for HTTP requests where the User-Agent header contains the string "OpenVAS" (case-insensitive). This indicates that an OpenVAS scanner is actively probing the network, which could be part of a legitimate security assessment or a malicious reconnaissance effort.
Stealth NULL Scan Port Probe
Suricata
This rule detects a Stealth NULL Scan Port Probe. A NULL scan is a type of port scan where all the TCP flags (URG, ACK, PSH, RST, SYN, FIN) are turned off. If the target port is closed, the target system should respond with an RST packet. If the port is open, the target system should not respond at all. This behavior can be used by attackers to map out open ports on a system while attempting to evade detection by some firewalls or intrusion detection systems that might be configured to only look for SYN packets.
This rule detects potential credential phishing attempts by identifying HTTP URIs that contain the keywords 'redirect', 'login', and 'microsoft' (case-insensitive). This combination of keywords in a URI is often indicative of a phishing link designed to trick users into providing credentials, especially targeting Microsoft accounts, by redirecting them to a fake login page.
This rule detects potential adversary-in-the-middle (AiTM) phishing attempts, specifically those leveraging tools like Evilginx. It triggers on HTTP requests where the URI contains the keywords "verify", "session", and "token" (case-insensitive). This combination of keywords in the URI is indicative of phishing pages designed to capture session tokens or verification codes.
This rule detects HTTP responses containing a PDF file that also includes the string "/URI" and "login" (case-insensitive). This combination is indicative of a malicious PDF credential phishing page being served to a client. The rule specifically looks for the PDF magic bytes at the beginning of the file data.
This rule detects suspicious HTTP traffic indicating a LinkedIn message that contains an external link. It specifically looks for HTTP requests to 'linkedin.com' with a URI containing '/messaging/' and triggers if 10 such events occur within 60 seconds from the same source IP address. This pattern is often associated with social engineering attempts where attackers use LinkedIn messaging to direct users to malicious external sites.
Page 146 of 211