Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,421 detections
Filters
Last updated
All Time
Detection languages
4,217
105
40
25
13
Contributors
1,327
1,003
725
627
332
Categories
2,253
2,239
1,434
1,144
973
Platforms
4,107
453
295
83
82
Products / Services
10,670
9,758
6,693
4,421
3,749
MITRE Techniques
886
774
552
505
456
CVEs
18
12
12
12
10
IDS Classtypes
1,868
466
446
362
230
IDS Protocols
2,366
846
388
301
93
This rule detects when an AWS Systems Manager (SSM) Run Command is executed on an EC2 instance. It specifically looks for HTTP traffic to 'ssm.amazonaws.com' with the URI containing 'SendCommand'. This indicates an attempt to remotely execute commands on an EC2 instance via AWS SSM.
This rule detects HTTP POST requests to Azure Function or Azure Website domains. It specifically looks for hostnames ending in '.azurewebsites.net' or containing '.azurefunctions.' in a case-insensitive manner. A threshold of 20 such requests from the same source within 60 seconds triggers the alert, indicating potential automated activity or remote execution attempts against Azure-hosted applications.
This rule detects the remote installation of a new systemd service unit. It specifically looks for TCP traffic on port 22 (SSH) within the home network that contains the strings "/etc/systemd/system/" and ".service" (case-insensitive). This combination suggests that a new systemd service file is being transferred or created remotely, which could indicate an attacker establishing persistence or escalating privileges.
This rule detects attempts to access named pipes via Server Message Block (SMB) on port 445. It specifically looks for the SMB signature and the 'IPC$' string within the traffic, indicating an attempt to establish an Inter-Process Communication (IPC) connection. A threshold is set to trigger an alert if 10 such events occur from the same source within 30 seconds, which could indicate enumeration or exploitation attempts.
This rule detects attempts to download executable files disguised as common media file types (MP4, MP3, AVI, MOV) over HTTP. It specifically looks for the 'MZ' header, which indicates a Windows executable, within the first two bytes of the file data, combined with a URI ending in a media file extension. This technique is often used by attackers to bypass security controls and trick users into executing malicious payloads.
This rule detects an anomaly in Kerberos authentication attempts by monitoring TCP traffic to port 88 (Kerberos). It triggers an alert if a source IP address attempts Kerberos authentication 30 or more times within a 10-second window, indicating a potential brute-force or rapid authentication attempt against a domain account.
This rule detects multiple failed SSH login attempts using the username 'root' to a server on the home network. It triggers an alert if five such attempts occur within a 30-second window from the same source IP address. This behavior often indicates a brute-force attack targeting default credentials.
This rule detects attempts to log in to a web interface using default 'admin' credentials. It specifically looks for HTTP POST requests to a URI containing 'login' and a client body that contains 'admin' twice, indicating both username and password might be 'admin'.
This rule detects HTTP requests to URIs containing keywords associated with common IT management platforms (ConnectWise, Kaseya, SolarWinds, Datto, N-central). It specifically looks for established HTTP traffic flowing to the server. A threshold of 5 occurrences within 60 seconds from the same source IP is set to trigger an alert, indicating a potential remote access session or activity related to these platforms.
This rule detects RDP (Remote Desktop Protocol) sessions initiated towards the HOME_NET on port 3389. It specifically looks for the RDP connection initiation sequence (content:"|03 00|" with depth:2) and uses a threshold to detect multiple connections from the same source within a 5-minute window, which could indicate activity from a Managed Service Provider or other remote access scenarios.
This rule detects Server Message Block (SMB) access attempts from external sources to internal networks, specifically looking for NTLMSSP (NT LAN Manager Security Support Provider) authentication traffic. It triggers an alert if five such connections are observed from the same source IP within a 60-second window. This could indicate an attempt by a third-party vendor or an attacker to access internal resources via SMB.
This rule detects Address Resolution Protocol (ARP) poisoning attempts on a network segment, specifically looking for ARP reply packets (opcode 2). It uses a thresholding mechanism to trigger an alert if 10 such packets are observed from the same source within a 5-second window, indicating a potential malicious ARP spoofing activity.
This rule detects web pages that are likely part of a bank vishing callback scam. It looks for HTTP responses (flow:to_client) containing the keywords 'call', 'toll-free', and 'account' (case-insensitive) in the file data. This combination of keywords suggests a page designed to trick users into calling a fraudulent number to discuss their 'account'.
This rule detects large HTTP PUT requests (over 50KB) directed towards common cloud storage services (Amazon S3, Azure Blob Storage, Google Cloud Storage). This activity could indicate data exfiltration to an external cloud account.
This rule detects HTTP PUT requests to s3.amazonaws.com that include the 'x-amz-copy-source' header and have a data size greater than 1000 bytes. This combination of indicators suggests an attempt to copy data from one S3 bucket to another, potentially indicating data exfiltration to an attacker-controlled AWS account.
This rule detects potential VXLAN traffic duplication for exfiltration purposes. It specifically looks for TCP traffic on port 4789 (the default VXLAN port) directed towards the home network. A threshold of 10 connections from the same source within 30 seconds triggers the alert, indicating a high volume of VXLAN traffic that could be indicative of data exfiltration.
This rule detects HTTP traffic indicating a potential cloud service compromise for cryptomining. Specifically, it looks for HTTP requests to 'ec2.amazonaws.com' with the URI containing 'RunInstances' and the client body containing 'p3' (case-insensitive). This combination suggests an attempt to provision EC2 instances, possibly for cryptomining, using a compromised AWS account.
This rule detects network traffic patterns indicative of the XMRig cryptominer communicating with a mining pool. Specifically, it looks for HTTP POST requests to the URI '/api/v1/jobs' with 'job_id' present in the client body, which is a common behavior for XMRig when requesting mining jobs.
This rule detects attempts to abuse an IoT device's firmware update page by sending a large POST request containing the word "firmware" (case-insensitive) to TCP port 80 on the home network. This activity is indicative of an attempt to corrupt the device's firmware, potentially leading to denial of service or unauthorized control.
This rule detects attempts to exfiltrate sensitive data by posting it to common text sharing services. It specifically looks for HTTP POST requests with a body size greater than 1000 bytes directed towards domains associated with services like paste.ee, hastebin, ghostbin, and privatebin.
This rule detects attempts to remotely lock out user accounts via SMB (Server Message Block) by looking for specific content within TCP traffic on port 445. It specifically targets the 'NetUserSetInfo' function call, which can be used to modify user account properties, in conjunction with the keyword 'lockout'. This combination suggests an attacker is attempting to trigger a mass account lockout.
Page 163 of 211