Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,421 detections
Filters
Last updated
All Time
Detection languages
4,217
105
40
25
13
Contributors
1,327
1,003
725
627
332
Categories
2,253
2,239
1,434
1,144
973
Platforms
4,107
453
295
83
82
Products / Services
10,670
9,758
6,693
4,421
3,749
MITRE Techniques
886
774
552
505
456
CVEs
18
12
12
12
10
IDS Classtypes
1,868
466
446
362
230
IDS Protocols
2,366
846
388
301
93
This rule detects Kerberos Pass-the-Ticket attacks where a Ticket Granting Service (TGS) request contains a forged Privilege Attribute Certificate (PAC). This is identified by specific byte sequences in UDP traffic on port 88, which is commonly used for Kerberos.
This rule detects an attempted pre-authentication Remote Code Execution (RCE) exploit against the Remote Desktop Protocol (RDP) service, commonly known as 'BlueKeep'. It specifically looks for a sequence of bytes within the RDP traffic on port 3389, indicating a potential exploit attempt.
This rule detects attempts to remotely shut down a system using the Server Message Block (SMB) protocol. It specifically looks for the string "InitiateSystemShutdown" within TCP traffic destined for port 445 (SMB). This activity can be indicative of an attacker attempting to disrupt services or systems.
This rule detects RDP access attempts from external IP addresses to the internal network ($HOME_NET) on port 3389. It uses a threshold of 3 connection attempts within 300 seconds from the same source IP to trigger an alert, indicating potential brute-force or reconnaissance activity targeting RDP services. The rule is classified under the MITRE ATT&CK technique T1133, which involves 'Remote Desktop Protocol' for initial access.
This rule detects the download of a Microsoft Office document that is macro-enabled. It specifically looks for HTTP traffic flowing to the client (download) that contains both "[Content_Types].xml" and "vbaProject" within the file data. These strings are indicative of an Office Open XML (OOXML) file (like .docx, .xlsx, .pptx) that contains VBA macros, which are often used in phishing attacks for initial access.
This rule detects web directory brute-force attempts by identifying HTTP requests where the User-Agent header contains the string "DirBuster". DirBuster is a well-known tool used for brute-forcing directories and file names on web servers.
This rule detects web directory brute-force attempts by identifying the 'gobuster' string in the HTTP User-Agent header. Gobuster is a common tool used for directory and file enumeration on web servers, often as part of reconnaissance or vulnerability scanning activities. The rule specifically targets HTTP traffic flowing to the server.
Cron Job Injection via Web Shell
Suricata
This rule detects attempts to inject cron job commands via web shell activity. It specifically looks for HTTP requests where the URI contains the case-insensitive string "crontab", indicating an attempt to modify scheduled tasks on a system through a web interface, likely a compromised web shell.
Remote AT Job Scheduled via SMB
Suricata
This rule detects attempts to schedule a remote AT job via SMB. It specifically looks for TCP traffic on port 445 (SMB) directed to the home network, containing the case-insensitive strings "atsvc" and "JobAdd". This combination indicates an attempt to use the AT service to add a scheduled task remotely, which can be a method for persistence or execution by attackers.
This rule detects the download of a compiled AutoIT script payload over HTTP. It specifically looks for the 'AU3!' magic bytes at the beginning of the file data, which is characteristic of compiled AutoIT executables. The detection is focused on traffic flowing from the server to the client (to_client) and assumes an established connection.
This rule detects potential AWS CLI API command execution by monitoring HTTP traffic for connections to 'amazonaws.com' and the presence of 'Action=' in the URI. It uses a threshold of 30 occurrences within 10 seconds from a single source IP to reduce false positives, indicating a high volume of API calls typical of automated scripts or tools.
This rule detects attempts to access the command-line interface (CLI) of a network device via Telnet, specifically looking for the 'enable' and 'configure terminal' commands. This indicates an administrative attempt to configure or manage a network device.
This rule detects HTTP responses that contain specific keywords indicative of a fake CAPTCHA paste attack page. It looks for the terms "CAPTCHA", "paste", and "Win+R" (case-insensitive) within the HTTP response body. This combination suggests a social engineering attempt where users are tricked into pasting malicious content, often after being instructed to open the 'Run' dialog (Win+R).
This rule detects multiple attempts to pull container image manifests from public Docker registries (registry.hub.docker.com or ghcr.io). A threshold of 10 pulls within 60 seconds from the same source IP is set to identify potentially malicious or excessive activity, possibly indicating an attempt to enumerate or download numerous container images.
This rule detects attempts to establish a TCP connection to port 902 on the home network, which is commonly used for VMware ESXi management. The rule specifically looks for SYN packets (flags:S) and triggers if there are at least 3 such connection attempts from the same source within a 60-second window. This could indicate an attempt to access or scan the ESXi management interface.
This rule detects attempts to deploy a container with host network mode enabled. It specifically looks for HTTP requests to the '/containers/create' endpoint, which is commonly used by container orchestration systems like Docker, and checks for the presence of 'host' within the HTTP client body, indicating the host network mode configuration. This can be a security concern as it allows the container to have direct access to the host's network interfaces, potentially bypassing network segmentation and security controls.
This rule detects attempts to execute commands within a Kubernetes pod using `kubectl exec`. It specifically looks for HTTP requests to port 8080 (often used by Kubernetes API servers or proxies) with URIs containing both '/exec' and 'pods', indicating an interactive command execution session within a pod.
This rule detects executable attachments (e.g., .exe, .bat, .cmd, .scr, .pif, .com) being delivered via SMTP email. It specifically looks for these file extensions within the 'filename' attribute of email attachments.
This rule detects the string "xdotool" within an SSH session (port 22) traffic flowing from the client to the server. xdotool is a command-line tool that simulates keyboard input and mouse activity, often used for automated input injection. Detection of this string suggests an attempt to automate actions within an SSH session, which could be indicative of malicious activity such as automated command execution or data exfiltration.
This rule detects potential mass email collection activity over IMAP (port 143). It triggers an alert if a client makes 20 or more 'FETCH BODY[]' requests within a 60-second window to an IMAP server. This behavior is indicative of an attacker or malicious script attempting to download a large number of email bodies, potentially for data exfiltration or analysis.
This rule detects an attempt at RDP lateral movement by identifying multiple RDP connection attempts to a host within a short timeframe. It specifically looks for the RDP connection initiation sequence (hexadecimal content '|03 00 00|') on port 3389 (RDP default port) and triggers an alert if 5 such attempts are observed from the same source within 60 seconds. This behavior is indicative of an attacker trying to move laterally within a network using RDP.
Page 151 of 211