Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,421 detections
Filters
Last updated
All Time
Detection languages
4,217
105
40
25
13
Contributors
1,327
1,003
725
627
332
Categories
2,253
2,239
1,434
1,144
973
Platforms
4,107
453
295
83
82
Products / Services
10,670
9,758
6,693
4,421
3,749
MITRE Techniques
886
774
552
505
456
CVEs
18
12
12
12
10
IDS Classtypes
1,868
466
446
362
230
IDS Protocols
2,366
846
388
301
93
MSSQL Database DROP Destruction
Suricata
This rule detects attempts to drop a database on an MSSQL server. It specifically looks for the string "DROP DATABASE" in TCP traffic destined for port 1433 (the default MSSQL port). This activity is indicative of data destruction or sabotage.
This rule detects a mass account lockout pattern over LDAP. It triggers an alert if 20 or more LDAP requests containing the string "lockoutTime" are observed from a single destination IP address within a 60-second window. This behavior is indicative of an attacker attempting to lock out multiple user accounts, potentially as a denial-of-service attack or to facilitate other attacks like password spraying by preventing legitimate users from logging in.
This rule detects a TFTP (Trivial File Transfer Protocol) firmware upload attempt where the data size is greater than 10000 bytes. This could indicate an attempt to corrupt or replace the firmware on a device, potentially leading to denial of service or unauthorized control. The rule specifically looks for UDP traffic on port 69 (TFTP) with a specific content pattern and a large data size.
This rule detects an active IP block scan by monitoring TCP SYN packets. It triggers an alert if more than 100 SYN packets are observed from a single source IP address within a 10-second window, indicating a potential reconnaissance activity where an attacker is scanning a range of IP addresses to identify live hosts or open ports.
Detects unusually large HTTP POST requests which may indicate data exfiltration activity over web protocols. The rule specifically looks for HTTP POST methods and is designed for Suricata, a network intrusion detection system.
This rule detects HTTP requests made to the Shodan API (api.shodan.io). This activity is often associated with reconnaissance, where an attacker or security researcher uses Shodan to gather information about internet-connected devices and services. The rule specifically looks for the 'api.shodan.io' string within the HTTP host header, indicating an attempt to query the Shodan service.
This rule detects attempts to create new user accounts via SMB (Server Message Block) by looking for the 'NetUserAdd' function call within SMB traffic. This could indicate an attacker attempting to establish persistence or escalate privileges by creating new accounts on a target system.
This rule detects attempts to upload a web shell, specifically targeting PHP files, by looking for HTTP POST requests to a .php URI that contain the string "eval(" in the file data. This combination suggests an attacker is trying to upload or execute malicious PHP code, often used for persistence or further compromise.
This rule detects attempts to execute remote services over SMB, specifically looking for traffic on port 445 containing both the SMB signature and the 'Service Control' string. This combination suggests an attempt to interact with or manipulate services on a remote system via SMB, which is a common technique used by attackers for lateral movement or privilege escalation.
This rule detects network connections to port 9090 on the home network. The rule is specifically tagged with MITRE ATT&CK technique T1072 (System Configuration Discovery) and mentions 'Ansible/Remote Deploy', suggesting it aims to identify potential remote management or deployment activities that might use this port. It triggers on TCP SYN packets (flags:S) and uses a threshold of 5 connections from the same source within 60 seconds to reduce noise.
This rule detects the delivery of a malicious document exploiting CVE-2021-40444, an MSHTML remote code execution vulnerability. It specifically looks for HTTP traffic containing a Word document (word/document.xml) with embedded relationships that include an HTTP reference, indicating an attempt to fetch remote content, which is characteristic of the exploit delivery mechanism.
This rule detects HTTP web requests where the URI contains the string "/bin/sh" (case-insensitive). This pattern is often indicative of an attempt to execute a Unix shell command via a web application, which could be part of a command injection attack (ATT&CK T1059.004).
This rule detects potential NTLM Relay attacks over SMB. It specifically looks for TCP traffic on port 445 (SMB) directed to the home network, and within that traffic, it identifies the presence of both the SMB protocol signature ('|FF|SMB') and the NTLMSSP (NTLM Security Support Provider) signature. This combination suggests an attempt to relay NTLM authentication.
This rule detects potential network sniffing by identifying an unusual mix of network protocols originating from a single source IP address. Specifically, it triggers an alert if a source IP sends 10 or more packets within 60 seconds that are neither TCP (protocol 6), UDP (protocol 17), nor ICMP (protocol 1). This behavior could indicate an attacker using tools to capture raw network traffic, as these tools often process protocols beyond the common ones.
This rule detects an FTP brute force attempt by monitoring TCP connections to port 21 (FTP) on the home network. It triggers an alert if 20 or more TCP SYN packets (indicating new connection attempts) are observed from the same source IP address within a 60-second window. This behavior is indicative of an attacker repeatedly trying to guess FTP credentials.
This rule detects DNS queries for typosquatted domains related to npmjs. Specifically, it looks for queries to domains ending in 'npmjs.net', 'npmjs.org', 'npmjs.io', or 'npmjs.co'. This is indicative of potential supply chain attacks or attempts to trick users into downloading malicious packages from fake registries.
This rule detects Address Resolution Protocol (ARP) spoofing attempts by looking for ARP reply packets (opcode 2) on the network. A threshold is applied to trigger an alert if 20 or more ARP replies are observed from the same source within a 10-second window, which is indicative of malicious ARP activity.
This rule detects potential Tor network traffic by looking for specific byte patterns (TLS handshake ClientHello with version 1.0 or 1.1) in TCP traffic flowing from the internal network to any external destination. It uses a threshold of 3 occurrences within 60 seconds from the same source IP to reduce false positives. The rule specifically targets the initial bytes of a TLS handshake, which is a common characteristic of Tor's encrypted communication.
This rule detects HTTP requests where the URI contains the string "/var/log/" (case-insensitive). This pattern is indicative of an attempt to access system log files directly via a web server, which could be part of an information gathering or defense evasion tactic.
This rule detects HTTP requests where the User-Agent header appears to be faked or malformed. Specifically, it looks for a User-Agent string that starts with 'Mozilla/5.0' followed by an opening parenthesis, and then contains at least 200 characters before a closing parenthesis. This pattern is often used by malicious actors to evade detection by making their User-Agent string unusually long and potentially obfuscated, while still mimicking a common browser prefix.
This rule detects potential keylogger data exfiltration over HTTP POST requests. It specifically looks for HTTP POST requests with a URI containing "keys" (case-insensitive) and a data size greater than 500 bytes. This combination suggests a large amount of data, possibly keystrokes, being sent to a server.
Page 170 of 211