Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,421 detections
Filters
Last updated
All Time
Detection languages
4,217
105
40
25
13
Contributors
1,327
1,003
725
627
332
Categories
2,253
2,239
1,434
1,144
973
Platforms
4,107
453
295
83
82
Products / Services
10,670
9,758
6,693
4,421
3,749
MITRE Techniques
886
774
552
505
456
CVEs
18
12
12
12
10
IDS Classtypes
1,868
466
446
362
230
IDS Protocols
2,366
846
388
301
93
This rule detects attempts to overwrite critical system binaries (specifically executables in 'system32') via Server Message Block (SMB) protocol. It looks for SMB traffic to port 445, containing 'system32' and '.exe' (case-insensitive), with a payload size greater than 100,000 bytes, indicating a potential file transfer or modification of a large executable.
This rule detects network traffic that indicates a shortcut (.lnk) file is being modified or created in a 'Startup' directory, which is a common technique for establishing autostart persistence on Windows systems. The rule specifically looks for TCP traffic on port 445 (SMB) containing the strings 'Startup' and '.lnk' (case-insensitive).
This rule detects modifications to the 'com.apple.loginwindow' content over a TCP connection to port 22 (SSH). This content is associated with macOS's re-opened applications list, which can be manipulated by adversaries to establish persistence by ensuring malicious applications are launched after a user logs in or a system restarts. The detection specifically looks for the string 'com.apple.loginwindow' in the traffic, indicating an attempt to interact with or modify this critical system component.
This rule detects the delivery of potentially malicious kernel modules or extensions over HTTP. It specifically looks for HTTP responses containing files with '.ko' (Linux kernel object) or '.kext' (macOS kernel extension) file extensions in the URI, indicating a client is downloading such a file. The 'flow:to_client,established' ensures the detection occurs on files being sent from a server to a client over an established HTTP connection.
This rule detects an attempt to exploit an unquoted service path vulnerability via an SMB file drop. Specifically, it looks for SMB traffic to port 445 on the home network containing the strings "Program Files" and ".exe" (case-insensitive). This pattern suggests an attacker might be dropping an executable file into a directory within "Program Files" that is part of an unquoted service path, which could lead to arbitrary code execution upon service restart.
This rule detects attempts to exploit DLL Search Order Hijacking vulnerabilities by monitoring SMB network traffic for requests containing '.dll' and '\AppData\' in the content. This pattern suggests an attacker might be attempting to drop a malicious DLL into a user's AppData directory on a network share, which could then be loaded by a legitimate application due to search order vulnerabilities, leading to persistence or execution of malicious code.
This rule detects attempts to hijack the PATH environment variable during an SSH session. It specifically looks for the string "export PATH=" within TCP traffic on port 22 (SSH), indicating a potential malicious modification of the PATH environment variable to control command execution paths.
This rule detects attempts to hijack the dynamic linker's LD_PRELOAD mechanism over an SSH connection. It specifically looks for the string "LD_PRELOAD" within TCP traffic on port 22 (SSH). This technique is often used by attackers for persistence or privilege escalation by injecting malicious libraries into legitimate processes.
This rule detects attempts to hijack macOS applications using malicious dynamic libraries (DYLIBs). It specifically looks for HTTP responses containing a URI with the ".dylib" extension and the content "__TEXT" within the file data, indicating a Mach-O executable segment. This combination suggests the delivery of a potentially malicious dynamic library designed for hijacking purposes on macOS systems.
This rule detects the HTTP download of common boot script file types (batch, command, shell, PowerShell) that contain the string 'HKLM' (HKEY_LOCAL_MACHINE). This combination suggests an attempt to establish persistence or execute malicious code by modifying system-wide registry settings, often associated with trojan activity. The detection is based on the file extension in the URI and the content within the downloaded file's data.
This rule detects network traffic on port 445 (SMB) containing the strings "services.exe" and "ImagePath" (case-insensitive). This combination suggests an attempt to hijack the execution flow of a service by replacing its binary, specifically targeting the 'services.exe' process, which is a critical Windows component. The rule is designed to identify trojan activity related to persistence mechanisms.
This rule detects attempts to modify the shared library configuration file '/etc/ld.so' over an SSH connection. This activity is indicative of a shared library hijacking technique, often used for persistence or privilege escalation, where an attacker modifies the system's library loading paths to inject malicious libraries. The detection specifically looks for the string "/etc/ld.so" within TCP traffic destined for port 22 (SSH) on the home network.
This rule detects when an executable file (.exe) is dropped into a Windows 'Start Menu\Programs\Startup' folder via Server Message Block (SMB). This is a common technique used by attackers to establish persistence on a compromised system, ensuring that their malicious code runs every time the user logs in or the system starts.
This rule detects when a system daemon configuration file, specifically one containing ".service" in its URI and "[Service]" in its content, is delivered via HTTP from any source to the internal network. This could indicate an attempt to establish persistence or modify system services on a compromised host.
This rule detects attempts to remotely create or modify services on a target system via SMB, specifically looking for the 'CreateService' string within TCP traffic on port 445. It thresholds on 3 occurrences from the same source within 60 seconds to reduce false positives.
This rule detects attempts to deploy a Kubernetes CronJob via the Kubernetes API. It specifically looks for HTTP requests targeting the '/apis/batch' and 'cronjobs' URI paths, indicating an interaction with the batch API group for CronJob resources. This could be an indicator of an attacker attempting to establish persistence or execute malicious code within the Kubernetes cluster by scheduling tasks.
This rule detects attempts to retrieve the running configuration of a network device via an SSH session. It specifically looks for the case-insensitive string "show running-config" in TCP traffic destined for port 22 (SSH) on the home network, indicating a potential administrative action or reconnaissance activity.
This rule detects attempts to perform lateral movement using the MMC20 COM object via DCOM. It specifically looks for TCP traffic destined for port 135 (typically used by DCOM) containing the string "MMC20.Application" in a case-insensitive manner. This indicates an attempt to instantiate the MMC20.Application COM object, which can be abused for remote code execution and lateral movement.
This rule detects the download of ISO, IMG, VHD, or VHDX files over HTTP that are larger than 500KB. These file types are often used as containers for malware delivery, allowing attackers to bypass traditional file-based security controls by embedding malicious executables or scripts within disk images.
This rule detects potential HID (Human Interface Device) keystroke injection attacks via USB emulation. It specifically looks for HTTP client body content containing both the terms 'keyboard' and 'inject' (case-insensitive). This pattern suggests an attempt to simulate keyboard input, often associated with devices like 'BadUSB' or 'Rubber Ducky' that emulate a keyboard to deliver malicious keystrokes.
This rule detects HTTP traffic directed to 'management.azure.com' with a URI containing 'runCommand'. This pattern indicates an attempt to execute a command on an Azure Virtual Machine using the Azure Run Command feature. This activity is often associated with administrative actions or potential malicious execution on cloud resources.
Page 162 of 211