Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,421 detections
Filters
Last updated
All Time
Detection languages
4,217
105
40
25
13
Contributors
1,327
1,003
725
627
332
Categories
2,253
2,239
1,434
1,144
973
Platforms
4,107
453
295
83
82
Products / Services
10,670
9,758
6,693
4,421
3,749
MITRE Techniques
886
774
552
505
456
CVEs
18
12
12
12
10
IDS Classtypes
1,868
466
446
362
230
IDS Protocols
2,366
846
388
301
93
This rule detects a high volume of HTTP GET requests to storage.googleapis.com, indicating a potential bulk download of objects from Google Cloud Storage. The threshold is set to 50 requests within 60 seconds from a single source IP address.
This rule detects potential bulk export of customer data from CRM applications like Salesforce, HubSpot, or Dynamics. It triggers when HTTP requests to these services contain 'export' in the URI, indicating a data export operation. A threshold of 5 such requests within 60 seconds from the same source IP is set to identify bulk activity.
This rule detects a high volume of TCP SYN packets from an external IP address to the internal network, indicative of an attempted remote service access or port scan. Specifically, it triggers if 5 or more TCP SYN packets are observed from the same source IP within a 30-second window, targeting any port on the home network.
This rule detects attempts to list active network connections using the 'netstat' command via a web shell. It specifically looks for HTTP requests where the URI contains the case-insensitive string 'netstat'. This activity is indicative of an attacker trying to gain reconnaissance on the compromised system's network connections.
This rule detects attempts to enumerate Wi-Fi network profiles by looking for the command 'netsh wlan show' within HTTP URI requests. This activity is often associated with web shell usage, where an attacker has gained remote access to a web server and is using it to gather information about the underlying system's network configuration.
This rule detects attempts by a client on the home network to check internet connectivity by querying external IP lookup services over HTTP. It specifically looks for requests to domains like api.ipify.org, ifconfig.me, checkip.amazonaws.com, and icanhazip.com. A threshold is set to trigger an alert if five such requests are observed from the same source within 30 seconds, indicating a potential network scan or reconnaissance activity.
This rule detects attempts to enumerate services on a system using the 'sc query' command, typically executed via a web shell. The detection is based on the presence of 'sc query' within the HTTP URI, indicating a command injection attempt through a web application.
This rule detects attempts to query the domain password policy over SMB by looking for the 'NetUserModalsGet' content within TCP traffic on port 445. This activity is often associated with reconnaissance or discovery phases by attackers to understand password complexity requirements.
This rule detects attempts to enumerate password policy information, specifically the 'pwdHistoryLength' attribute, from a domain controller via an LDAP query. It looks for TCP traffic on port 389 (LDAP) where the client sends a query containing both '(objectClass=domain)' and 'pwdHistoryLength' in a case-insensitive manner.
This rule detects attempts to query the system time using the 'net time' command via a web shell. It specifically looks for the string 'net time' within the HTTP URI of traffic flowing to the server. This activity is indicative of an attacker using a web shell to gather information about the compromised system, specifically its time synchronization status or current time.
This rule detects a potential Azure AD user account bulk enumeration attempt. It triggers when a source IP makes 20 or more HTTP requests within 30 seconds to 'graph.microsoft.com' with the URI containing '/users'. This pattern is indicative of an attacker attempting to enumerate multiple user accounts in Azure AD.
This rule detects attempts to enumerate domain group membership via LDAP queries. It specifically looks for TCP traffic to port 389 (LDAP) containing the string "(objectClass=group)" in a case-insensitive manner. A threshold is applied to trigger an alert if 10 such queries are observed from the same source within a 30-second window, indicating a potential network scan or reconnaissance activity.
This rule detects attempts to enumerate permission group memberships remotely over the Server Message Block (SMB) protocol, specifically targeting port 445. The detection is based on the presence of the case-insensitive string "NetGroupEnum" within the TCP payload, indicating a network scan or reconnaissance activity aimed at discovering group information.
This rule detects attempts to enumerate network connection tables remotely over SMB (port 445). It specifically looks for the string "NetConnectionEnum" in TCP traffic directed to port 445 on the home network, indicating a potential network discovery activity.
This rule detects HTTP requests to 'portal.azure.com', indicating access to the Azure management portal. A threshold is set to trigger an alert if 10 such requests are observed from the same source IP within 60 seconds. This activity is classified as a network scan, potentially for infrastructure discovery.
This rule detects attempts to enumerate installed software on a Windows machine via Remote WMI (Windows Management Instrumentation) over SMB (Server Message Block) on port 445. Specifically, it looks for the string "Win32_Product" within TCP traffic destined for port 445, indicating a WMI query for installed products. A threshold of 5 occurrences within 30 seconds from the same source is set to reduce false positives.
This rule detects attempts to access browser history files, specifically Google Chrome's history, over Server Message Block (SMB) protocol. The detection is triggered when SMB traffic contains the string "History" and "AppData\Local\Google\Chrome" (case-insensitive), indicating a potential reconnaissance activity where an attacker might be trying to exfiltrate or analyze browser history.
This rule detects attempts to enumerate the VMware vSphere virtual machine inventory via the API. It specifically looks for HTTP POST requests to the '/sdk/vimService' URI with 'RetrieveProperties' in the client body, indicating a query for system properties, which can include VM inventory details. The detection is focused on network traffic to port 443 (HTTPS) within the home network.
This rule detects attempts to query AWS CloudTrail logs for activity discovery. Specifically, it looks for HTTP traffic to 'cloudtrail.amazonaws.com' with the URI containing 'LookupEvents'. This activity could indicate an attacker attempting to understand the environment or their own actions.
This rule detects network traffic (HTTP response) from a server to a client that contains both 'GetUserDefaultLCID' and 'ExitProcess' in the file data, case-insensitively. This combination of strings is indicative of malware attempting to evade sandboxes or target specific locales by checking the system's default locale identifier and then potentially exiting if the environment is not suitable. This behavior is often associated with trojan activity.
This rule detects potential lateral movement attempts using alternate authentication material, specifically NTLMSSP, over SMB (port 445). It triggers an alert if five or more NTLMSSP authentications are observed from a single source IP address to the home network within a 30-second window. This behavior can indicate an attacker attempting to authenticate to multiple systems using stolen credentials or hashes.
Page 154 of 211