Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,421 detections
Filters
Last updated
All Time
Detection languages
4,217
105
40
25
13
Contributors
1,327
1,003
725
627
332
Categories
2,253
2,239
1,434
1,144
973
Platforms
4,107
453
295
83
82
Products / Services
10,670
9,758
6,693
4,421
3,749
MITRE Techniques
886
774
552
505
456
CVEs
18
12
12
12
10
IDS Classtypes
1,868
466
446
362
230
IDS Protocols
2,366
846
388
301
93
This rule detects attempts to dump the macOS Keychain via a remote SSH connection. It specifically looks for the string "security dump-keychain" within TCP traffic on port 22 (SSH). This command is used to extract credentials and other sensitive information stored in the macOS Keychain.
This rule detects HTTP requests to the Docker API endpoint '/containers/*/json' which could indicate an attempt to query container environment secrets. The rule specifically looks for requests to the '/containers/' path followed by '/json' in the HTTP URI.
This rule detects a specific HTTP POST request pattern associated with the Mirai botnet's check-in mechanism. It looks for HTTP POST requests to the '/report' URI with a body size between 21 and 99 bytes. A threshold of 10 such requests from the same source within 60 seconds triggers the alert, indicating potential botnet activity.
This rule detects potential automated social media account creation attempts by monitoring HTTP traffic for requests to common social media platforms (twitter.com, x.com, facebook.com) that include 'signup' in the URI. A threshold of 5 such requests within 60 seconds from the same source IP triggers the alert, indicating a possible automated or high-volume registration process.
This rule detects the download of potential proof-of-concept (PoC) exploit code for CVEs. It specifically looks for HTTP responses containing a URI that matches the pattern 'CVE-YYYY-NNNN' (e.g., CVE-2023-1234) and also contains the word 'exploit' in the file data. This combination suggests that a client on the internal network is downloading code related to a known vulnerability, which could be for research, testing, or malicious purposes.
This rule detects potential vendor relationship page scraping activity. It triggers an alert when a client makes 20 or more HTTP requests containing the word "vendor" (case-insensitive) in the URI within a 30-second window. This behavior could indicate an attacker or automated script attempting to gather information about an organization's vendors, which is a reconnaissance technique.
Kerberos Realm Trust Discovery
Suricata
This rule detects Kerberos Realm Trust Discovery attempts by looking for specific byte patterns in TCP traffic destined for port 88 (Kerberos). The rule triggers if the byte sequence "6b 82" is found within the first 2 bytes of the payload. A threshold is applied to prevent excessive alerts, triggering if 10 such events occur from the same source within 30 seconds.
This rule detects potential GitHub organization repository enumeration by monitoring HTTP traffic to api.github.com with URIs containing '/orgs/'. A threshold of 20 requests within 60 seconds from a single source IP address is used to trigger an alert, indicating a possible network scan or reconnaissance activity targeting GitHub organizations.
This rule detects attempts to fingerprint a browser's configuration using JavaScript by looking for the presence of 'navigator.userAgent' and 'navigator.platform' within HTTP response data. This technique is often used during reconnaissance phases by attackers to gather information about a target's browser environment.
This rule detects HTTP requests to 'api.shodan.io', indicating a potential query to the Shodan Internet Scan Database. This activity could be part of reconnaissance efforts by an attacker or security researcher to gather information about internet-connected devices and services.
This rule detects HTTP requests to known Certificate Transparency (CT) log query services such as crt.sh, censys.io, and certspotter.com. These services are often used by attackers during the reconnaissance phase to gather information about an organization's SSL certificates and subdomains.
This rule detects HTTP requests to VirusTotal's domain lookup service (www.virustotal.com/domain/). This activity is often associated with passive DNS lookups, which can be part of reconnaissance efforts by attackers or security researchers to gather information about a target's infrastructure.
This rule detects HTTP requests made to the SecurityTrails API (api.securitytrails.com). SecurityTrails is a service that provides access to passive DNS databases and other domain-related intelligence. Such queries can indicate reconnaissance activity by an attacker or security researcher gathering information about a target domain.
This rule detects HTTP requests where the User-Agent header contains the string "feroxbuster" (case-insensitive). Feroxbuster is a command-line tool used for content discovery on web servers, often employed in penetration testing or reconnaissance phases to find hidden directories and files. Detecting its User-Agent can indicate an active directory brute-force or content discovery scan against the network.
Stealth XMAS Scan Port Probe
Suricata
This rule detects a Stealth XMAS Scan Port Probe. An XMAS scan is a type of port scan where the FIN, PSH, and URG flags are set in the TCP header. This type of scan attempts to determine if a port is open by exploiting the TCP RFC 793. If a port is closed, the target system should respond with an RST packet. If the port is open, no response is expected. The rule specifically looks for TCP packets with the FPU (FIN, PSH, URG) flags set, originating from any source IP and port, destined for any IP on the local network ($HOME_NET) on any port. A threshold is applied to trigger an alert if 10 such packets are observed from the same source within a 30-second window, indicating a scanning activity.
This rule detects potential business partner directory scraping by monitoring HTTP requests to the server. It triggers an alert if a client makes 15 or more requests containing 'partners' (case-insensitive) in the URI within a 30-second window. This behavior could indicate an attacker or automated tool attempting to enumerate or collect information about an organization's business partners.
This rule detects spearphishing emails sent over SMTP that contain an Office document attachment. It specifically looks for emails with a 'Content-Type: application/' header, a 'filename=' attribute, and the '.docx' extension in the content, indicating a Microsoft Word document.
This rule detects HTTP requests to known threat intelligence portals associated with dark web monitoring. It specifically looks for hostnames containing 'intel471', 'kela.io', 'recordedfuture', or 'flashpoint'. This could indicate an analyst or system accessing threat intelligence, or potentially an adversary performing reconnaissance.
This rule detects attempts to harvest credentials using a fake Microsoft login page. It triggers when HTTP traffic from the server to the client contains both "microsoftonline" and "password" in the file data, and the HTTP host is an IP address. This combination suggests a phishing attempt where a malicious server is impersonating a Microsoft login page to capture user credentials.
This rule detects access to known dark web credential markets by inspecting HTTP host headers for specific domain patterns. It triggers an alert if a client on the home network attempts to connect to 'genesis.market', 'russianmarket', or '2easy.shop'. This indicates potential reconnaissance or direct access to platforms where stolen credentials are traded.
This rule detects HTTP traffic to 'zoominfo.com' with a high frequency (15 times in 60 seconds from the same source IP). This behavior is indicative of automated data harvesting or reconnaissance activities targeting corporate information.
Page 168 of 211