Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,421 detections
Filters
Last updated
All Time
Detection languages
4,217
105
40
25
13
Contributors
1,327
1,003
725
627
332
Categories
2,253
2,239
1,434
1,144
973
Platforms
4,107
453
295
83
82
Products / Services
10,670
9,759
6,693
4,421
3,749
MITRE Techniques
886
774
552
505
456
CVEs
18
12
12
12
10
IDS Classtypes
1,868
466
446
362
230
IDS Protocols
2,366
846
388
301
93
This rule detects attempts to modify login scripts, specifically '.profile', on a remote host via SSH. The detection is based on observing the string ".profile" within TCP traffic destined for port 22 (SSH) on the home network. This activity could indicate an attacker establishing persistence by modifying user login scripts to execute malicious commands upon subsequent logins.
This rule detects the writing of a file containing both the string "Startup" (case-insensitive) and the string ".bat" (case-insensitive) to a remote host via the Server Message Block (SMB) protocol on port 445. This activity is indicative of an attempt to establish persistence by creating a startup script on a remote system.
This rule detects when a batch script (.bat) is dropped onto a network share, specifically targeting the NETLOGON share, which is often used for logon scripts. This activity can be indicative of an attacker attempting to establish persistence or execute malicious code on systems that process logon scripts from this share. The rule triggers if three such events are observed from the same source within 60 seconds.
This rule detects when a third-party cloud application is authorized to access a Google account. It specifically looks for HTTP traffic to 'accounts.google.com' with a URI containing 'oauth2/auth' and 'scope', indicating an OAuth 2.0 authorization request. A threshold is set to trigger an alert if this activity occurs 3 times within 60 seconds from the same source IP address.
This rule detects the delivery of a Windows Dynamic Link Library (DLL) file via HTTP that could be used for execution flow hijacking. It specifically looks for HTTP responses containing a URI with '.dll', the 'MZ' magic bytes at the beginning of the file data, and a file size greater than 10,000 bytes, indicating a potentially legitimate or malicious DLL being downloaded to a client.
This rule detects attempts to plant a DLL file in an application's 'Program Files' directory over SMB. This is a common technique used in DLL hijacking attacks, where a malicious DLL is placed in a location where a legitimate application will load it instead of the intended system DLL. The rule specifically looks for SMB traffic to port 445, containing '.dll' and '\Program Files\' in a case-insensitive manner, indicating a file transfer to a sensitive application directory.
This rule detects network traffic on TCP port 445 (SMB) containing the strings "system32" and "msv1_0.dll" in a case-insensitive manner. This pattern is indicative of an attempt to replace the authentication DLL (msv1_0.dll) on a remote Windows host, which is a known technique for persistence and credential manipulation.
This rule detects attempts to modify authentication configuration via LDAP by looking for the string "msDS-SupportedEncryptionTypes" in TCP traffic destined for port 389 (LDAP). This string is associated with changes to supported encryption types in Active Directory, which could be an indicator of persistence or privilege escalation.
This rule detects attempts to add an autostart entry via a remote registry write operation targeting TCP port 445 (SMB). It specifically looks for network traffic containing the strings "Run", "HKCU" (HKEY_CURRENT_USER), and "\Software\Microsoft\Windows", indicating a modification to the current user's run keys for persistence. This activity is often associated with malware or adversaries establishing persistence on a compromised Windows system.
This rule detects HTTP requests made to 'whois.domaintools.com', indicating a WHOIS domain lookup activity via a web service. It triggers an alert if five such requests are observed from the same source within 60 seconds. This activity is often associated with reconnaissance.
This rule detects potential subdomain enumeration activity by identifying a high volume of DNS queries (100 queries within 30 seconds) originating from a single source IP address to port 53 (DNS) on the home network. This behavior is indicative of an attacker attempting to discover subdomains of a target domain.
This rule detects attempts to use search engine filetype dorking techniques to discover sensitive files. It specifically looks for HTTP requests containing the string "filetype:" in the URI, which is a common operator used in search engines to filter results by file extension. This activity is often associated with reconnaissance efforts by attackers to find publicly exposed documents, spreadsheets, or other files that might contain sensitive information.
This rule detects attempts to fingerprint the version of a Drupal Content Management System (CMS) by requesting the 'CHANGELOG.txt' file. This file often contains version information and is a common target for attackers performing reconnaissance to identify potential vulnerabilities.
Stealth FIN Scan Port Probe
Suricata
This rule detects a stealth FIN scan port probe. A FIN scan is a type of port scan that sends TCP segments with only the FIN flag set. If the target port is closed, it should respond with an RST segment. If the port is open, it should ignore the FIN segment. This rule triggers if 10 such FIN packets are observed from a single source within a 30-second window, indicating a potential port scan attempt.
This rule detects potential Remote Access Trojan (RAT) callbacks occurring after a remote support session. It specifically looks for HTTP GET requests where the URI contains keywords like 'setup', 'install', 'support', or 'remote' (case-insensitive) and the User-Agent header contains 'MSIE'. This combination suggests a possible RAT communicating with its command and control server, masquerading as legitimate remote support or installation traffic.
This rule detects potential credential phishing attempts by identifying HTTP responses (flow:to_client,established) that contain common keywords associated with login pages, specifically 'password', 'username', and 'action='. The rule looks for these keywords within the file data of the HTTP response, indicating a web page being served to the client that mimics a login form.
This rule detects HTTP requests made to 'search.censys.io', indicating a query to the Censys Internet Asset Database. This activity is often associated with reconnaissance efforts, where an attacker or security researcher gathers information about internet-facing assets.
This rule detects WMI DCOM port reconnaissance activity targeting the Endpoint Mapper service on port 135. It triggers an alert when a source IP initiates 10 or more TCP SYN packets to port 135 on the HOME_NET within a 30-second window, indicating a potential network scan.
This rule detects exploitation attempts targeting the Spring4Shell vulnerability (CVE-2022-22965). It specifically looks for HTTP requests containing the string "class.module.classLoader" in the URI, which is a known indicator of this RCE exploitation attempt.
This rule detects DNS TXT record responses containing a Base64 encoded payload of at least 60 characters. This pattern is often used by malware for command and control (C2) communication or data exfiltration, leveraging DNS tunneling to evade detection.
This rule detects attempts to exploit a Local File Inclusion (LFI) vulnerability to read the `/etc/passwd` file on a web server. It specifically looks for HTTP requests where the URI contains the string `/etc/passwd`.
Page 150 of 211