Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,421 detections
Filters
Last updated
All Time
Detection languages
4,217
105
40
25
13
Contributors
1,327
1,003
725
627
332
Categories
2,253
2,239
1,434
1,144
973
Platforms
4,107
453
295
83
82
Products / Services
10,670
9,758
6,693
4,421
3,749
MITRE Techniques
886
774
552
505
456
CVEs
18
12
12
12
10
IDS Classtypes
1,868
466
446
362
230
IDS Protocols
2,366
846
388
301
93
This rule detects HTTP web requests that contain the string "cmd.exe" in the URI, indicating an attempt to execute a command shell via a web request. This is often associated with web application attacks where an attacker tries to leverage a vulnerability to run system commands.
This rule detects HTTP requests where the URI contains the string "-EncodedCommand" case-insensitively. This pattern is commonly associated with PowerShell commands that are base64 encoded, often used by attackers to obfuscate malicious scripts. The rule specifically looks for this string in the HTTP URI, indicating an attempt to download or execute an encoded PowerShell command.
This rule detects HTTP requests that contain patterns indicative of a PowerShell download cradle. Specifically, it looks for 'powershell' and 'IEX' (Invoke-Expression) within the HTTP URI, suggesting an attempt to download and execute a script using PowerShell.
This rule detects attempts to execute the Unix shell '/bin/bash' via HTTP requests. Specifically, it looks for the string '/bin/bash' within the URI of HTTP traffic flowing to the server. This could indicate an attacker attempting command injection or other web-based exploitation to gain shell access.
This rule detects network service scanning activity by identifying a high volume of TCP SYN packets (flags:S) from a single source IP address to multiple destinations within the HOME_NET over a short period. Specifically, it triggers if 50 or more SYN packets are observed from the same source within 10 seconds. This behavior is indicative of an attacker attempting to discover open ports and services on internal network hosts, a common reconnaissance technique.
This rule detects a potential SSH password brute force attack. It triggers an alert if there are 30 or more TCP connections to port 22 (SSH) on the home network from a single source IP address within a 60-second window. The 'flow:to_server' and 'flags:S' indicate that it's looking for new connection attempts (SYN packets) directed towards the server.
This rule detects potential DNS tunneling activity by identifying DNS queries with high entropy subdomains. Specifically, it looks for subdomains that consist of 30 or more alphanumeric characters (a-z, 0-9). A threshold is applied, triggering an alert if 5 such queries are observed from the same source IP within a 60-second window. This pattern is often indicative of data exfiltration or command and control communication over DNS.
This rule detects outbound TCP connections from any source to the local network ($HOME_NET) on port 9150. This port is commonly used by Tor Browser for its SOCKS proxy, indicating potential use of Tor for anonymization or to bypass network restrictions. The rule specifically looks for the SYN flag in the TCP handshake, signifying the initiation of a connection.
This rule detects outbound TCP connections from any source to the local network ($HOME_NET) on port 9050, specifically looking for the SYN flag. Port 9050 is commonly associated with Tor SOCKS proxy services. This activity is classified as a policy violation and is linked to the MITRE ATT&CK technique T1090.003, which involves using a Tor proxy for defense evasion.
This rule detects a high volume of IMAP/SSL connections to port 993 from a single source IP address within a short timeframe, which could indicate an attempt to collect emails in bulk, potentially associated with MITRE ATT&CK technique T1114 (Email Collection). The threshold is set to 30 connections within 60 seconds from the same source.
This rule detects attempts to establish a WinRM HTTPS connection (port 5986) to a host on the home network. It specifically looks for TCP SYN packets (flags:S) and triggers if three such connection attempts are made from the same source within 60 seconds. This pattern can indicate lateral movement activity using WinRM over HTTPS.
This rule detects potential data exfiltration to Dropbox cloud storage. It specifically looks for HTTP POST requests to 'api.dropboxapi.com' with a data size greater than 5000 bytes, indicating a significant upload.
This rule detects large HTTP POST requests originating from the internal network ($HOME_NET) to any external destination. It specifically looks for HTTP POST methods and a data size greater than 10,000 bytes. A detection filter is applied to track by source IP, triggering an alert if 20 such large POST requests are observed within a 60-second window. This behavior is indicative of potential data exfiltration over command and control (C2) channels, as large amounts of data are being sent out of the network.
This rule detects HTTP downloads of common script file types (PowerShell, VBScript, JavaScript, HTML Application, Batch, Command) from any source to the internal network. This activity is often associated with initial access or execution techniques where adversaries download malicious scripts to a compromised host.
This rule detects HTTP C2 beaconing activity characterized by regular interval GET requests. It specifically looks for 20 GET requests within a 60-second window from the same source IP address to any destination. This pattern is indicative of command and control communication, often used by malware to check in with its operators.
This rule detects DNS queries for known cryptomining pool domains. It specifically looks for patterns like 'pool.monero', 'pool.xmr', 'pool.minexmr', 'pool.nanopool', and 'pool.supportxmr' within DNS queries, indicating potential cryptomining activity on the network.
This rule detects DNS queries for domains ending with '.onion', which are typically associated with the Tor network. In the context of ransomware, this pattern can indicate communication with Command and Control (C2) servers hosted on the dark web, often used for exfiltration or receiving further instructions.
This rule detects HTTP requests where the URI contains the string "ransom" (case-insensitive). This pattern is indicative of potential ransomware command and control (C2) check-ins, as ransomware often uses terms like 'ransom' in its communication with C2 servers.
This rule detects potential data exfiltration attempts characterized by a high volume of small HTTP POST requests from a single source IP address within a short timeframe. Specifically, it looks for 50 or more HTTP POST requests within 60 seconds, where each request has a body size between 101 and 1999 bytes. This pattern is indicative of 'chunked exfiltration' (ATT&CK T1030), where an attacker breaks down data into smaller pieces to evade detection.
This rule detects HTTP PUT requests to onedrive.live.com with a body size greater than 5000 bytes. This behavior is indicative of data exfiltration to OneDrive cloud storage, aligning with MITRE ATT&CK technique T1567.
This rule detects potential data exfiltration attempts via Microsoft Teams webhook connectors. It specifically looks for HTTP POST requests to 'outlook.office.com' with a URI containing '/webhook/' and a data size greater than 500 bytes. This combination suggests that data might be sent out through a Teams webhook, which can be abused for exfiltration.
Page 179 of 211