Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,421 detections
Filters
Last updated
All Time
Detection languages
4,217
105
40
25
13
Contributors
1,327
1,003
725
627
332
Categories
2,253
2,239
1,434
1,144
973
Platforms
4,107
453
295
83
82
Products / Services
10,670
9,758
6,693
4,421
3,749
MITRE Techniques
886
774
552
505
456
CVEs
18
12
12
12
10
IDS Classtypes
1,868
466
446
362
230
IDS Protocols
2,366
846
388
301
93
This rule detects potential malicious script injection from ad networks. It looks for HTTP responses (flow:to_client) that contain common ad-related terms in the HTTP referer header (ad., ads., advert., banner.) and also contain JavaScript code obfuscation techniques like 'eval(' and 'fromCharCode' within the file data. This combination suggests an ad network might be serving malicious JavaScript to clients.
This rule detects HTTP response content injection via a Man-in-the-Middle (MitM) attack. It specifically looks for HTML content (indicated by 'Content-Type: text/html') in the HTTP response that contains a '<script' tag and a 'src' attribute pointing to an IP address (e.g., 'src="https?://[0-9]{1,3}\.[0-9]{1,3}'). This pattern suggests that an attacker might be injecting malicious scripts into legitimate web traffic.
This rule detects potential phishing attempts delivered via WhatsApp Business by monitoring HTTP traffic for connections to 'api.whatsapp.com' with 'message' in the URI. It specifically looks for a high volume (10 times in 60 seconds) of such connections from a single source, which could indicate an automated or widespread delivery of malicious links.
This rule detects potential command and control (C2) activity where an internal HTTP proxy port (8080) is used as a relay. Specifically, it looks for HTTP CONNECT requests, which are commonly used for tunneling through proxies, directed to port 8080 within the home network. A threshold of 10 such requests within 60 seconds from a single source IP triggers the alert, indicating suspicious proxy usage for C2 communication.
This rule detects the use of SFTP (Secure File Transfer Protocol) as a covert command and control (C2) data channel. It specifically looks for TCP traffic on port 22 (SFTP's default port) with a specific content pattern ('|00 00 00|') within the first 4 bytes of the payload, a payload size between 100 and 500 bytes, and a high frequency (20 times in 60 seconds) from a single source IP address. This pattern and frequency could indicate an attempt to exfiltrate data or maintain C2 communication disguised as legitimate SFTP traffic.
This rule detects C2 traffic that attempts to impersonate legitimate Microsoft Update services. It specifically looks for HTTP traffic where the host header contains 'windowsupdate.com' or 'update.microsoft.com' (case-insensitive) and the User-Agent header contains 'Windows-Update-Agent'. A threshold of 10 occurrences within 60 seconds from the same source IP triggers the alert, indicating potential command and control activity trying to blend in with normal Windows update traffic.
This rule detects DNS queries that contain unusually long, seemingly random strings (50 or more alphanumeric characters) in the query name. This pattern is often used by malware for Command and Control (C2) communication, where the long string serves as 'junk data padding' to obfuscate the actual C2 data or to make detection more difficult. The rule specifically looks for DNS queries (port 53) and applies a threshold to prevent excessive alerts from a single source, triggering if 5 such queries are observed within 30 seconds from the same source IP.
This rule detects suspicious TLS certificates that are valid for only one day and have a common name (CN) consisting of 6 or more alphanumeric characters. This pattern is often associated with malware or command and control (C2) activity, where certificates are generated on the fly with short validity periods to evade detection.
This rule detects a pattern of dynamic DNS queries that could indicate Command and Control (C2) activity. Specifically, it triggers an alert if a single source IP address makes 50 or more DNS queries within a 60-second window. This high frequency of DNS lookups from a single source is often characteristic of malware attempting to resolve dynamically generated C2 domains.
This rule detects a high volume of file read operations from a network share that contains the string "USBSTOR" in its content, indicating potential access to removable media. It triggers an alert if more than 50 such events occur within a 30-second window from the same source IP address. This could signify an attempt to exfiltrate data from a removable device shared over the network.
This rule detects a high volume of HTTP requests to GitHub's archive endpoint for repository cloning, specifically looking for 10 or more requests within 60 seconds from a single source IP. This behavior could indicate an attempt to collect data from multiple GitHub repositories, potentially for reconnaissance or data exfiltration purposes. The rule targets HTTP traffic where the host is 'github.com' and the URI contains '/archive/'.
This rule detects a high volume of Real-time Transport Protocol (RTP) video stream traffic originating from the home network and destined for external servers. Specifically, it triggers an alert if more than 100 UDP packets with a data size greater than 1000 bytes are observed from a single source IP address within a 10-second window. This pattern could indicate unauthorized video streaming or data exfiltration.
This rule detects the upload of a potential screen recording file to a remote server over HTTP. It specifically looks for HTTP POST requests where the URI contains the string "video" (case-insensitive) and the file data contains the byte sequence "|00 00 00|" within the first 4 bytes, indicating a common video file header. Additionally, the file size must be greater than 500KB, which helps to filter out small, non-video files.
This rule detects the exfiltration of a webcam video stream over HTTP POST. It specifically looks for HTTP POST requests containing file data, where the data starts with the hexadecimal sequence '52 49 46 46' (which corresponds to 'RIFF', a common header for multimedia file formats like AVI and WAV) and has a size greater than 100,000 bytes. This combination suggests a large multimedia file, potentially a video, being uploaded.
This rule detects the creation of an email auto-forwarding rule within Microsoft Exchange via the Exchange Web Services (EWS) interface. It specifically looks for HTTP requests to the '/EWS/Exchange.asmx' endpoint containing the string 'ForwardToRecipients' in the client body, indicating an attempt to configure email forwarding.
This rule detects a high volume of HTTP requests to graph.microsoft.com with the URI containing '/messages', indicating a potential bulk download of emails from Office 365 via the Graph API. The threshold is set to 30 requests within 60 seconds from a single source IP.
This rule detects when a file with the ".pst" extension (Outlook Personal Storage Table file) is copied locally via the Server Message Block (SMB) protocol. This could indicate data exfiltration or unauthorized access to sensitive email archives.
This rule detects the creation of in-memory archives using the .NET Compression Library by inspecting HTTP client-bound data for the presence of both "System.IO.Compression" and "ZipArchive" strings. This combination suggests that a .NET application is creating a ZIP archive in memory, which could be indicative of data staging or exfiltration activities.
This rule detects potential data exfiltration attempts where data is archived using scripting libraries. It specifically looks for HTTP traffic (flow:to_client,established) containing the strings "zipfile", "ZipFile(", and "write(" in the file data, indicating the use of a scripting library to create and write to a zip archive. This combination suggests that a client is receiving or downloading an archived file that was likely created programmatically for exfiltration.
This rule detects the string "zip -e" within TCP traffic on port 22 (SSH). This string is commonly used to create password-protected zip archives, and its presence in an SSH session could indicate an attempt to prepare data for exfiltration, especially if combined with SSH's secure tunneling capabilities. The rule specifically looks for traffic flowing from the client to the server.
This rule detects HTTP requests that contain both '7z' and '-p' in the URI, which could indicate the use of 7zip or WinRAR to archive data with a password, potentially for exfiltration. The rule specifically looks for these strings in the URI of an HTTP request flowing from the internal network to an external server.
Page 153 of 211