Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,421 detections
Filters
Last updated
All Time
Detection languages
4,217
105
40
25
13
Contributors
1,327
1,003
725
627
332
Categories
2,253
2,239
1,434
1,144
973
Platforms
4,107
453
295
83
82
Products / Services
10,670
9,759
6,693
4,421
3,749
MITRE Techniques
886
774
552
505
456
CVEs
18
12
12
12
10
IDS Classtypes
1,868
466
446
362
230
IDS Protocols
2,366
846
388
301
93
This rule detects potential organization information harvesting via web scraping. It triggers when a client makes 25 or more HTTP GET requests to URIs containing the string "about" (case-insensitive) within a 20-second window. This behavior could indicate an automated script or tool attempting to gather information from a website's 'about us' or similar pages.
This rule detects the delivery of a JavaScript payload that has been hex encoded. It specifically looks for the hex representation of the string "script" (\x73\x63\x72\x69\x70\x74) within HTTP response data flowing to the client. This technique is often used by attackers to obfuscate malicious JavaScript code and evade signature-based detection.
This rule detects attempts to delete files or directories using the 'rm -rf' command within a web request URI. This often indicates an attacker attempting to clean up traces of their activity or cause denial of service by removing critical files on a compromised web server.
This rule detects attempts to delete files on a web server using a web shell. It specifically looks for the 'unlink' command within HTTP URI requests, indicating a potential file deletion operation initiated through a compromised web application.
This rule detects attempts to exploit the Zerologon (CVE-2020-1472) vulnerability, a critical privilege escalation flaw in Microsoft's Netlogon Remote Protocol. It specifically looks for network traffic on TCP port 445 (SMB) containing the 'NetrServerAuthenticate3' function call with a specific sequence of null bytes, which is indicative of an unauthenticated Netlogon session setup without signing and sealing, a key characteristic of the Zerologon exploit.
This rule detects attempts to remotely install Windows services over Server Message Block (SMB). It specifically looks for network traffic on port 445 (SMB) containing the strings "svcctl" and "CreateService" in a case-insensitive manner, indicating a service control request to create a new service. This activity is often associated with adversaries establishing persistence on a compromised system.
This rule detects attempts to enumerate USB devices on a system via a web shell. It specifically looks for HTTP URI requests containing 'wmic' and 'path Win32_USBHub', which are commands used to query USB device information using Windows Management Instrumentation (WMI). The 'nocase' modifier indicates that the content matching is case-insensitive.
This rule detects NTP amplification DDoS attacks by looking for UDP traffic on port 123 (NTP) with a specific content signature ('|17 00 03 2a|') and a high threshold of 50 packets within 5 seconds from the same destination. This pattern is indicative of an NTP monlist request, which can be abused for amplification attacks.
This rule detects HTTP requests to a server that contain both 'password' and 'username' in the URI, case-insensitively. This pattern is indicative of a potential credential harvesting attempt where an attacker is trying to collect user credentials via a crafted web page or phishing site. The rule specifically looks for these keywords in the URI of an established HTTP connection flowing to the server.
This rule detects Kerberoasting activity, specifically looking for multiple Kerberos Ticket Granting Service (TGS) requests over UDP port 88 within a short timeframe from the same source IP. Kerberoasting is a post-exploitation technique used by attackers to obtain service principal name (SPN) hashes, which can then be cracked offline to retrieve the associated plaintext passwords. The rule uses a threshold of 20 TGS requests within 10 seconds from a single source to identify this suspicious behavior.
This rule detects the delivery of a kernel exploit via HTTP. It specifically looks for HTTP responses (flow:to_client) containing a file with the 'MZ' header (indicating a Windows executable) and the string 'exploit' (case-insensitive) in the HTTP URI. This combination suggests an attempt to deliver a malicious executable, potentially a kernel exploit, to a client system.
This rule detects a possible port knocking sequence, which is a method of externally opening ports on a firewall by generating a sequence of connection attempts to a set of closed ports. The rule specifically looks for 5 TCP SYN packets from the same source IP within a 5-second window to any port on the home network, indicating a potential port knocking attempt.
This rule detects the presence of GRE (Generic Routing Encapsulation) tunnel traffic (IP protocol 47) originating from any source IP address to the local network. It triggers an alert if three such GRE packets are observed from the same source within a 60-second window. This could indicate an attempt to establish a GRE tunnel, potentially for defense evasion or to bypass network security controls.
This rule detects large internal data transfers within the network. Specifically, it triggers when the data size of an established TCP flow exceeds 65000 bytes. A threshold is applied, alerting if 50 such transfers occur from the same source within a 60-second window. This behavior is often associated with internal data staging, a technique used by attackers to collect and consolidate data before exfiltration.
This rule detects a high rate of DNS queries from a single source IP address to the local network (HOME_NET) on UDP port 53. Specifically, it triggers an alert if more than 100 DNS queries are observed from the same source within a 10-second window. This behavior is indicative of network reconnaissance, where an attacker might be rapidly querying DNS to map out internal network resources or identify potential targets.
This rule detects large data transfers over FTP, specifically looking for FTP data connections (flow:to_server,established) where the data size exceeds 65000 bytes. It uses a threshold of 10 such transfers within 60 seconds from the same source to trigger an alert, indicating potential data exfiltration. This aligns with MITRE ATT&CK technique T1048.003, which involves exfiltrating data over FTP.
This rule detects an ICMP flood Denial of Service (DoS) attack. It triggers an alert when more than 200 ICMP echo request (type 8) packets are observed targeting a single destination within a 5-second window. This high volume of ICMP traffic is indicative of an attempt to overwhelm a target system or network, leading to service disruption.
This rule detects the execution of a VDSO hijacking payload over an SSH connection. It specifically looks for the case-insensitive strings "vdso" and "mmap" within the TCP payload of an established SSH session, indicating an attempt to manipulate the Virtual Dynamic Shared Object (VDSO) for privilege escalation or other malicious purposes.
This rule detects potential Process Doppelganging attempts by looking for specific Windows API calls related to Transactional NTFS (TxF) within HTTP traffic. Specifically, it looks for the presence of "NtCreateTransaction" and "NtCreateSection" in the file data of HTTP responses, indicating a payload that might be attempting to leverage TxF for process creation manipulation.
This rule detects potential process hollowing activity by looking for specific strings in HTTP client-to-server traffic. It triggers if the traffic contains both 'CREATE_SUSPENDED' and 'NtUnmapViewOfSection' (case-insensitive). These strings are indicative of a technique where a legitimate process is created in a suspended state, its memory unmapped, and then malicious code is injected and executed.
This rule detects the presence of a TLS Callback Injection payload in HTTP traffic flowing from the server to the client. It specifically looks for the case-insensitive strings "TlsCallback" and "IMAGE_TLS_DIRECTORY" within the file data of the HTTP response. This technique is often used by malware to achieve code injection and execution.
Page 147 of 211