Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,421 detections
Filters
Last updated
All Time
Detection languages
4,217
105
40
25
13
Contributors
1,327
1,003
725
627
332
Categories
2,253
2,239
1,434
1,144
973
Platforms
4,107
453
295
83
82
Products / Services
10,670
9,758
6,693
4,421
3,749
MITRE Techniques
886
774
552
505
456
CVEs
18
12
12
12
10
IDS Classtypes
1,868
466
446
362
230
IDS Protocols
2,366
846
388
301
93
This rule detects attempts to enumerate security products on a target system via Remote WMI over SMB (port 445). It specifically looks for the string "AntiVirusProduct" in TCP traffic directed to port 445, indicating a potential query for installed antivirus software. This activity is often associated with discovery tactics used by attackers to understand the security posture of a compromised system or network.
This rule detects attempts to discover password policy information by executing the 'net accounts' command via a web shell. The rule specifically looks for HTTP requests where the URI content contains 'net accounts' in a case-insensitive manner, indicating a potential web-based command execution to gather system information related to password policies.
This rule detects HTTP requests to the AWS EC2 service (ec2.amazonaws.com) that specifically attempt to enumerate Amazon Machine Images (AMIs) using the 'DescribeImages' API call. This activity could indicate an attacker performing reconnaissance to understand the available virtual machine images within an AWS environment.
This rule detects attempts to enumerate Linux system logs via remote SSH connections. Specifically, it looks for the string "cat /var/log/" within TCP traffic on port 22 (SSH). A threshold of 10 occurrences within 30 seconds from the same source IP is set to reduce false positives.
This rule detects attempts to query the list of system drivers on a remote Windows host via a WMI session over SMB (port 445). The detection is based on the presence of the string "Win32_SystemDriver" in the network traffic, indicating a WMI query for system driver information. This activity can be indicative of reconnaissance by an attacker.
This rule detects the delivery of a kernel driver enumeration tool via HTTP. Specifically, it looks for the string "EnumDeviceDrivers" (case-insensitive) within HTTP response data flowing to a client. This string is indicative of tools or malware attempting to enumerate loaded kernel drivers, which is a common reconnaissance technique used by attackers.
This rule detects HTTP requests that contain 'gcc' and '-o' in the URI, which could indicate an attempt to compile malware on a host using the GCC compiler. This activity is often associated with defense evasion techniques where an attacker compiles malicious code directly on a compromised system.
This rule detects attempts to install a kernel module (rootkit) on a Linux system via an SSH session. It specifically looks for the 'insmod' command followed by a '.ko' file extension within TCP traffic destined for port 22 (SSH). This combination suggests an attacker is trying to load a malicious kernel object.
This rule detects attempts to push a root certificate to a Windows system via the Remote Registry service (SMB port 445). It specifically looks for network traffic containing the strings "Root\Certificates" and "RegSetValue" (case-insensitive) within the same TCP flow to a server on port 445. This activity could indicate an attacker attempting to establish persistence or bypass security controls by installing a trusted root certificate.
This rule detects network traffic on TCP port 445 (SMB) containing the string "wintrust.dll" in a case-insensitive manner. This specific DLL is associated with Windows Trust Provider functionality. The detection is flagged as 'trojan-activity' and is linked to MITRE ATT&CK technique T1553.003 (Code Signing: Code Signing Policy Modification) and tactic Defense Evasion, suggesting an attempt to bypass code signing policies by replacing or manipulating the wintrust.dll.
This rule detects potential steganography where a payload is embedded within an image file, specifically a JPEG. It triggers when an HTTP response contains JPEG magic bytes (`FF D8 FF`) within the first 3 bytes, and the file size is unusually large (over 1MB), suggesting additional data might be hidden within the image. The rule also includes a threshold to prevent excessive alerts from legitimate large images.
This rule detects the delivery of a payload designed to bypass trust controls via HTTP. It specifically looks for HTTP responses (flow:to_client) containing the 'MZ' magic bytes (indicating an executable file) within the first 2 bytes of the file data, combined with URI paths that include keywords like 'bypass', 'unsigned', or 'notrust'. This combination suggests an attempt to deliver malicious or untrusted executables that aim to circumvent security mechanisms.
This rule detects the string "DisableAntiSpyware" in HTTP response bodies. This string is often associated with commands or responses related to disabling security defenses, specifically anti-spyware features, which is a common tactic used by malware or attackers for defense evasion. The rule is designed to alert when such a command or response is delivered to a client within an established HTTP flow.
This Suricata rule detects network traffic on TCP port 445 (SMB) that contains the strings "SpecialAccounts" and "UserList" (case-insensitive). This pattern is indicative of an attempt to hide a user account on a Windows system by modifying the registry's SpecialAccounts\UserList key. This technique is often used by adversaries for defense evasion.
This rule detects HTTP responses containing a Windows executable (identified by the 'MZ' header) where the URI path suggests it's masquerading as a legitimate Windows system binary like svchost.exe, winlogon.exe, lsass.exe, services.exe, or csrss.exe. This is a common technique used by malware to evade detection by appearing as a trusted process.
This rule detects attempts to remove a network share connection using the 'NetUseDel' command. This activity is often associated with adversaries trying to hide their access or clean up traces after establishing persistence or performing other actions on a compromised system. The detection specifically looks for the 'NetUseDel' string within TCP traffic directed to port 445 (SMB/CIFS), indicating an attempt to delete a network share.
This rule detects the delivery of a hidden virtual file system container over HTTP. It looks for HTTP traffic flowing to the client that contains both the string "VirtualDisk" (case-insensitive) and the "MZ" header (indicating a Windows executable or DLL) within the file data. This combination suggests the download of a malicious executable designed to create or utilize a hidden virtual disk.
This rule detects TCP traffic to port 389 (LDAP) where the content of the packet contains both "sAMAccountName" and "admin" (case-insensitive). This combination suggests an attempt to query or manipulate an LDAP directory for an account named 'admin' using the sAMAccountName attribute, potentially indicating user account masquerading as a service account or reconnaissance activity.
This rule detects the presence of an XOR decoding routine within a downloaded script. It specifically looks for the keywords "XOR" and "fromCharCode" (case-insensitive) in the file data of HTTP traffic flowing to the client. This combination is often used by malicious scripts to deobfuscate their payload.
This rule detects HTTP traffic indicating an attempt to terminate an EC2 instance on AWS. Specifically, it looks for HTTP requests to 'ec2.amazonaws.com' with 'TerminateInstances' in the URI, which is a common API call used to delete cloud instances. This activity could be performed by an attacker to remove evidence of their presence or to disrupt services.
This rule detects when a cloud disk snapshot is created, specifically targeting AWS EC2 'CreateSnapshot' API calls. This activity can be indicative of data exfiltration attempts, where an attacker creates a snapshot of a compromised disk to move data out of the environment.
Page 181 of 211