Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,421 detections
Filters
Last updated
All Time
Detection languages
4,217
105
40
25
13
Contributors
1,327
1,003
725
627
332
Categories
2,253
2,239
1,434
1,144
973
Platforms
4,107
453
295
83
82
Products / Services
10,670
9,758
6,693
4,421
3,749
MITRE Techniques
886
774
552
505
456
CVEs
18
12
12
12
10
IDS Classtypes
1,868
466
446
362
230
IDS Protocols
2,366
846
388
301
93
This rule detects attempts to create a stored procedure in a Microsoft SQL Server database that includes the 'xp_cmdshell' extended stored procedure. 'xp_cmdshell' allows execution of operating system commands directly from SQL Server, and its use in a newly created stored procedure can indicate an attacker establishing persistence or attempting to execute arbitrary commands on the underlying system.
This rule detects a sequence of TCP SYN packets with a zero data size, originating from any source to any destination within the home network. The detection is triggered when 5 such packets are observed from the same source within a 3-second window. This pattern is indicative of a 'Magic Packet Implant Activation Sequence', which could be used by an attacker for persistence or command and control.
This rule detects the delivery of a malicious Outlook form script over HTTP. It specifically looks for HTTP traffic flowing to the client that contains the strings "IPM.Note", "Script", and "VBScript" within the file data, indicating an attempt to deliver a VBScript-based Outlook form.
This rule detects the remote creation of a WMI event subscription, specifically looking for '__EventFilter' and 'CommandLineEventConsumer' within TCP traffic on port 445. This activity is often associated with persistence mechanisms used by attackers.
This rule detects the remote installation of a new Windows service over SMB (Server Message Block) protocol. It specifically looks for TCP traffic on port 445 (SMB) directed to the home network, containing the strings "CreateService" and "svcctl" (case-insensitive). This combination indicates an attempt to create a new service remotely, which can be a method for persistence or privilege escalation by attackers.
This rule detects attempts to modify Cisco router firmware using ROMMONkit. It specifically looks for TCP traffic to the HOME_NET on port 23 (Telnet) containing the case-insensitive strings "rommon" and "tftpdnld". This combination suggests an attempt to interact with the router's ROM Monitor mode for firmware manipulation, often associated with malicious activities like installing backdoors or persistent malware.
This rule detects network traffic on port 445 (SMB) containing the strings "LSASS" and "AddDll" (case-insensitive). This combination of strings suggests an attempt to register a malicious DLL with the Local Security Authority Subsystem Service (LSASS) for persistence, a technique often used by malware to maintain access on a compromised system. The flow is set to 'to_server' and 'established', indicating an outgoing connection from the monitored network to a server, and that the TCP connection has been successfully established.
This rule detects network traffic on TCP port 445 (SMB) containing the case-insensitive strings "powercfg" and "change". This combination suggests an attempt to modify system power settings, potentially to prevent a system from sleeping or shutting down, which could be a persistence mechanism.
This rule detects the delivery of a file over HTTP that contains the strings "AppDomainManager" and "CreateDomain" (case-insensitive). This combination of strings is indicative of an attempt to hijack the AppDomainManager, a technique used for persistence in .NET applications, often associated with T1574.014 (AppDomainManager Hijacking) from MITRE ATT&CK.
This rule detects the delivery of shellcode designed to hijack the KernelCallbackTable. It specifically looks for HTTP traffic (flow:to_client,established) containing the strings "KernelCallbackTable" and "NtUserSetWindowsHookEx" (case-insensitive) within the file data. This technique is often used for privilege escalation or persistence by redirecting kernel callbacks to malicious code.
This rule detects network traffic on TCP port 445 (SMB) containing the strings "icacls" and "grant" (case-insensitive). This combination suggests an attempt to modify file or directory permissions, specifically granting permissions, which could be indicative of an attacker exploiting a service binary file permission weakness to establish persistence or elevate privileges. The rule is triggered when these strings are observed in traffic flowing to the server.
This rule detects the deployment of a potentially malicious middleware component on an application server. It specifically looks for HTTP POST requests to port 8080 with a URI containing 'deploy' (case-insensitive) and a data size greater than 10000 bytes. This pattern is indicative of a large payload being sent to deploy an application or component, which could be malicious in nature.
This rule detects HTTP requests that contain both 'config' and 'lock' in the URI, suggesting an attempt to access or manipulate configuration files that might be locked, potentially indicating an exclusive lock on a security tool's configuration file. The rule is classified as 'trojan-activity'.
This rule detects attempts to write shell event hook scripts, specifically those using 'trap' and 'SIGHUP', over an SSH connection. This activity is often associated with persistence mechanisms where an attacker sets up a script to execute upon certain shell signals, such as a hangup signal, to maintain access or execute malicious code.
This rule detects network traffic indicative of a remote WMI event subscription being registered. Specifically, it looks for TCP traffic on port 135 (typically used by Microsoft RPC and DCOM, which WMI can leverage) directed to the home network, containing the string "__EventConsumer" case-insensitively. This activity can be a sign of persistence mechanisms being established by attackers.
This rule detects attempts to register a new system service via a remote SSH connection. It specifically looks for the string "service install" within TCP traffic on port 22 (SSH) flowing from a client to a server within the home network. This activity could indicate an attacker establishing persistence on a compromised system.
This rule detects attempts to drop a systemd timer unit file via a web shell. It specifically looks for HTTP POST requests (flow:to_server) containing both '.timer' and '[Timer]' in the client body, indicating the creation or modification of a systemd timer unit.
This rule detects when a cron job is created or modified via a remote SSH session. It specifically looks for the string "crontab -e" within TCP traffic destined for port 22 (SSH), indicating an interactive session where a user is editing their crontab file. This activity, when originating from a remote SSH session, could be indicative of an attacker establishing persistence or scheduling malicious tasks on a compromised system.
This rule detects attempts to execute AT commands via a web shell. It specifically looks for HTTP requests containing both 'at+' and 'cmd' in the URI, case-insensitively. This pattern is indicative of an attacker trying to run system commands through a compromised web application.
This rule detects the download of JavaScript files (.js or .jse extensions) over HTTP that contain the string "WScript.Shell" (case-insensitive). This string is often used in malicious JavaScript to interact with the Windows operating system, indicating potential trojan activity.
This rule detects the download of a Python script that appears to be a reverse shell. It specifically looks for HTTP traffic (flow:to_client,established) containing the strings "import socket" and "connect(" within the file data, case-insensitive. These strings are common indicators of Python code attempting to establish a network connection, often used in reverse shell implementations.
Page 172 of 211