Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,421 detections
Filters
Last updated
All Time
Detection languages
4,217
105
40
25
13
Contributors
1,327
1,003
725
627
332
Categories
2,253
2,239
1,434
1,144
973
Platforms
4,107
453
295
83
82
Products / Services
10,670
9,758
6,693
4,421
3,749
MITRE Techniques
886
774
552
505
456
CVEs
18
12
12
12
10
IDS Classtypes
1,868
466
446
362
230
IDS Protocols
2,366
846
388
301
93
This rule detects attempts to modify the macOS Transparency, Consent, and Control (TCC) database over an SSH connection. The TCC database stores user privacy settings, and its modification can indicate an attempt to bypass security controls or escalate privileges. The rule specifically looks for the string "TCC.db" within TCP traffic directed to port 22 (SSH).
This rule detects when an AWS IAM role is assumed, which can be a legitimate activity for temporary elevated access within an AWS environment. The detection is based on HTTP traffic to 'sts.amazonaws.com' with 'AssumeRole' in the URI, indicating a request to the AWS Security Token Service to assume an IAM role. This activity is often associated with privilege escalation techniques.
This rule detects attempts to escalate privileges using 'sudo su -' over an SSH connection. It specifically looks for the string 'sudo su -' within TCP traffic on port 22, indicating a potential privilege escalation attempt after an SSH session has been established.
This rule detects attempts to deliver a setuid shell payload via a web shell. It specifically looks for HTTP requests containing both 'chmod' and '+s' (case-insensitive) in the URI, indicating an attempt to modify file permissions to set the setuid bit.
This rule detects the download of a payload that might be used in a User Account Control (UAC) bypass technique. It specifically looks for HTTP traffic where the URI contains keywords like 'uac.bypass', 'elevate', 'privesc', or 'bypassuac' (case-insensitive) and the file data starts with 'MZ', indicating a Windows executable.
This rule detects the creation of a new domain trust via LDAP by looking for specific content in TCP traffic on port 389 (LDAP). It specifically targets HTTP POST requests containing "(objectClass=trustedDomain)" in the payload, indicating an attempt to establish a new trust relationship between domains.
This rule detects the creation of a new domain account via LDAP. It specifically looks for TCP traffic on port 389 (LDAP) where the flow is to the server and established. The rule then inspects the content for the strings "(objectClass=user)" and "add" (case-insensitive), indicating an LDAP operation to add a new user object.
This rule detects attempts to add an SSH key to a server's authorized_keys file via a web shell. It specifically looks for HTTP POST requests where the URI content includes "authorized_keys". This activity is indicative of an attacker establishing persistence on a compromised server by adding their SSH key for future unauthorized access.
This rule detects attempts to add email delegate permissions via the Microsoft Graph API. It specifically looks for HTTP PATCH requests to 'graph.microsoft.com' with a URI containing 'mailboxSettings'. This activity could indicate an attacker attempting to gain unauthorized access to a user's mailbox by granting delegate access to another account, which is a common persistence technique.
This rule detects when additional cloud credentials (Access Keys) are added to an AWS IAM user. It specifically looks for HTTP traffic to 'iam.amazonaws.com' containing 'CreateAccessKey' in the URI, indicating an attempt to create new access keys.
This rule detects network traffic containing the string "/etc/rc" over SSH (port 22) to a server within the home network. This pattern suggests an attempt to modify an RC script for persistence on a Linux system, potentially by an attacker who has gained SSH access.
This rule detects the deployment of a network logon script named 'logon.bat' within the 'SYSVOL' share over SMB (port 445). This activity is often associated with persistence techniques where an attacker modifies or creates logon scripts to execute malicious code when users log in to the domain.
This rule detects modifications to macOS Login Hook scripts via SSH. Login Hooks are scripts that execute when a user logs in or out, and their modification can be an indicator of persistence mechanisms used by attackers. The rule specifically looks for TCP traffic on port 22 (SSH) containing the string 'LoginHook' in a case-insensitive manner, indicating an attempt to interact with or modify these scripts.
This rule detects the string "flash write" in TCP network traffic flowing to a server, indicating a potential command to reflash component firmware. This activity could be associated with persistence techniques where an attacker modifies firmware to maintain access or control over a system.
This rule detects the delivery of potentially malicious Office add-in files (VSTO, XLA, XLAM) or COM files over HTTP. It specifically looks for these file extensions in the HTTP URI and verifies that the file content starts with 'MZ', indicating a Windows executable or DLL.
This rule detects the creation of malicious Outlook rules via Exchange Web Services (EWS). It specifically looks for HTTP traffic to '/EWS/Exchange.asmx' containing the 'CreateRule' string in the client body, indicating an attempt to establish persistence within an Outlook environment.
This rule detects network traffic attempting to register an AppCert DLL in the Windows Registry for injection purposes. Specifically, it looks for TCP traffic on port 445 (SMB) directed to the home network, containing the case-insensitive string "AppCertDlls". This activity is indicative of a persistence mechanism where a malicious DLL is configured to be loaded into processes, often for privilege escalation or code injection.
This rule detects network traffic containing the string "sethc.exe" over TCP port 445 (SMB). This is indicative of an attacker attempting to exploit the 'Sticky Keys' accessibility feature for backdoor access, often by replacing the sethc.exe binary with a malicious executable. The detection specifically looks for this string in traffic flowing to the server on an established connection.
This rule detects the string "LC_LOAD_DYLIB" within HTTP response bodies (file data). This string is associated with the loading of dynamic libraries (DYLIBs) on macOS systems. In a malicious context, this could indicate an attempt to inject a malicious DYLIB into a process, potentially for persistence or code execution. The rule specifically looks for this content in traffic flowing from the server to the client.
This rule detects attempts to modify default file associations via the remote registry, specifically looking for 'HKCR' (HKEY_CLASSES_ROOT) and 'shell\\open\\command' within TCP traffic on port 445 (SMB). This activity is often associated with persistence mechanisms where an attacker alters how certain file types are handled to execute malicious code.
This rule detects network traffic on TCP port 445 (SMB) containing the string 'lsasrv.dll' in a case-insensitive manner, indicating a potential attempt to modify the Domain Controller's authentication package. This activity is often associated with persistence techniques where an attacker modifies or replaces legitimate authentication packages to maintain access or elevate privileges.
Page 161 of 211