Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,421 detections
Filters
Last updated
All Time
Detection languages
4,217
105
40
25
13
Contributors
1,327
1,003
725
627
332
Categories
2,253
2,239
1,434
1,144
973
Platforms
4,107
453
295
83
82
Products / Services
10,670
9,759
6,693
4,421
3,749
MITRE Techniques
886
774
552
505
456
CVEs
18
12
12
12
10
IDS Classtypes
1,868
466
446
362
230
IDS Protocols
2,366
846
388
301
93
This rule detects attempts to create a new container service via the Docker API. It specifically looks for HTTP POST requests to the '/services/create' URI on port 2375, which is the default unencrypted Docker API port. This activity could indicate an attacker attempting to establish persistence or execute malicious containers on a compromised Docker host.
This rule detects the delivery of a macOS Launch Daemon Property List (.plist) file via HTTP. Attackers often use Launch Daemons for persistence on macOS systems. The rule specifically looks for HTTP traffic containing '.plist' in the URI and 'LaunchDaemon' within the file data, indicating a potential attempt to establish persistence.
This rule detects the download of potential malware source code by inspecting HTTP URI paths and file data. It triggers if the HTTP URI contains keywords like 'rat', 'trojan', 'keylogger', 'ransomware', or 'botnet' (case-insensitive) and the downloaded file data contains the string 'import socket' (case-insensitive). This combination suggests the download of Python-based malware source code.
This rule detects when a TFTP (Trivial File Transfer Protocol) boot image is potentially pushed to a network device. It specifically looks for UDP traffic on port 69 (TFTP default port) directed to the home network, containing the byte sequence "|00 02|" (which often indicates a TFTP write request or a specific TFTP opcode) and having a data size greater than 10000 bytes, suggesting a large file transfer like a boot image.
Dual-Use Hacking Tool Download
Suricata
This rule detects the download of dual-use hacking tools by inspecting HTTP URI paths for keywords like 'nmap', 'metasploit', 'cobaltstrike', 'empire', 'covenant', and 'sliver'. It specifically looks for these keywords in a case-insensitive manner within the HTTP URI, indicating a potential attempt to download tools that can be used for both legitimate security testing and malicious activities.
This rule detects network traffic patterns indicative of an attempt to use the 'Active Setup' registry key for persistence. Specifically, it looks for TCP traffic on port 445 (commonly used for SMB/CIFS) directed to the home network, containing the strings 'Active Setup' and 'StubPath' (case-insensitive). This combination suggests an attacker might be trying to establish persistence by modifying the 'StubPath' value within an 'Active Setup' registry key, which Windows uses to run commands during user logon.
This rule detects network connections to known vulnerability intelligence purchase platforms (zerodium.com, crowdfense.com, exodus.gl). These platforms are often used by threat actors to acquire zero-day exploits or other vulnerabilities. Accessing these sites could indicate an organization or individual is attempting to purchase or sell such intelligence, which can be a precursor to malicious activity or a violation of organizational policy.
This rule detects attempts to upload files containing the 'MZ' magic bytes (indicating a Windows executable) to known file-sharing services such as transfer.sh, mega.nz, mediafire, or anonfiles. It specifically looks for HTTP POST requests with file data.
This rule detects HTTP responses that indicate a potential drive-by download infrastructure redirect. Specifically, it looks for HTTP responses to clients that contain the word "redirect" (case-insensitive) in the URI and also contain the "MZ" magic bytes at the beginning of the file data, suggesting an executable file is being served. This combination implies a server is redirecting to or serving an executable file, which is a common tactic in drive-by download attacks.
This rule detects network traffic containing the string "HKCU\\Software\\Classes\\CLSID" on TCP port 135 (DCE/RPC) directed towards the home network. This pattern is indicative of an attempt to modify registry keys related to COM objects, which can be used for persistence or privilege escalation by hijacking COM object execution.
This rule detects HTTP responses that originate from search engines (Google, Bing, Yahoo) and contain a Windows executable (MZ header) in the file data. This behavior is indicative of SEO poisoning, where malicious actors manipulate search engine results to redirect users to malware downloads.
This rule detects the download of executable installer files (MSI or EXE) over HTTP that are larger than 500KB and contain the 'MZ' header, which is characteristic of Windows executables. The rule specifically looks for these files being delivered to a client within the home network. The message indicates a potential 'Executable Installer with Weak File Permission Exploit', suggesting that the downloaded file might be malicious or used in an exploit chain related to weak file permissions.
This rule detects attempts to modify hybrid identity federation settings by monitoring HTTP POST requests to graph.microsoft.com with a URI containing 'federationConfiguration'. This activity could indicate an attacker attempting to establish persistence or gain unauthorized access by manipulating identity federation.
This rule detects network traffic indicating that reversible password encryption might be enabled in Active Directory. It specifically looks for the string "AllowReversiblePasswordEncryption" in TCP traffic destined for port 389 (LDAP). Enabling reversible password encryption stores passwords in a format that can be easily decrypted, making them vulnerable to theft if the system is compromised.
This rule detects a potential network device authentication bypass attempt via SSH. Specifically, it looks for SSH traffic (port 22) directed to the home network that contains the strings "aaa authentication" and "none" (case-insensitive). This combination suggests a configuration where authentication, authorization, and accounting (AAA) is set to 'none', which could allow unauthorized access.
This rule detects network traffic on TCP port 445 (SMB) containing the string "Notification Packages" in a case-insensitive manner, flowing to the server. This pattern is indicative of an attempt to install a password filter DLL for credential harvesting, a technique used by attackers to capture user credentials.
This rule detects multiple TFTP (Trivial File Transfer Protocol) transfers to port 69 on the home network within a short timeframe. Specifically, it triggers an alert if three or more TFTP transfers from the same source IP address occur within a 30-second window. This activity can be indicative of a Pre-Boot Execution Environment (PXE) boot process, which often uses TFTP to transfer boot files, or potentially malicious activity involving file transfers via TFTP.
This rule detects attempts to upload web shell files to a server's application directory. It specifically looks for HTTP POST requests where the URI contains common web shell file extensions (php, asp, aspx, jsp, cfm) and the file data contains the string "eval(" (case-insensitive), which is a common function used in web shells for code execution.
This rule detects attempts to upload malicious web server modules, plugins, or components. It specifically looks for HTTP PUT requests to URIs containing '/modules/', '/plugins/', or '/components/' and checks the file data for the 'MZ' header, indicating an executable file (likely a Windows executable or DLL). This combination suggests an attacker is trying to upload a malicious executable to a web server's module/plugin directory for persistence or further compromise.
This rule detects attempts to drop a payload into the Microsoft Word startup folder via SMB. The detection is based on the presence of the string "Word\STARTUP" (case-insensitive) in SMB traffic flowing to the server on port 445. This activity is indicative of persistence mechanisms used by attackers to ensure malicious code executes when Word starts.
This rule detects when a file containing the string "XLSTART" (case-insensitive) is written to a network share via SMB. This is indicative of an attempt to establish persistence by placing malicious files in the Microsoft Office startup folder, which will be executed when Office applications launch.
Page 149 of 211