Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,421 detections
Filters
Last updated
All Time
Detection languages
4,217
105
40
25
13
Contributors
1,327
1,003
725
627
332
Categories
2,253
2,239
1,434
1,144
973
Platforms
4,107
453
295
83
82
Products / Services
10,670
9,758
6,693
4,421
3,749
MITRE Techniques
886
774
552
505
456
CVEs
18
12
12
12
10
IDS Classtypes
1,868
466
446
362
230
IDS Protocols
2,366
846
388
301
93
This rule detects suspicious executable downloads from email-related referers. It specifically looks for HTTP traffic where the referer header contains keywords like 'mail.', 'webmail.', 'outlook.', 'gmail.', or 'yahoo.com', indicating the download originated from an email client or webmail interface. The rule further narrows down the detection to files containing the 'MZ' header (characteristic of Windows executables) with a size greater than 10000 bytes, suggesting a potential malicious executable being delivered via email.
This rule detects HTTP traffic containing the string "duckyScript" in the file data, indicating a potential payload delivery page associated with OMG Cables or Rubber Ducky devices. These devices are often used for injecting malicious keystrokes or other payloads.
This rule detects potential cloud API access using a stolen token by monitoring HTTP requests to AWS S3, Azure management, or Google APIs that contain an 'Authorization: Bearer' header. A threshold of 50 such requests within 10 seconds from the same source IP triggers the alert, indicating a possible brute-force or high-volume access attempt with a compromised token.
This rule detects HTTP POST requests to common cloud console login pages (AWS, Microsoft Azure, Google Cloud) that originate from a suspicious IP range. The rule uses a threshold of 5 attempts within 30 seconds from the same source IP to trigger an alert, indicating potential brute-force or credential stuffing attacks against cloud accounts.
This rule detects VNC (Virtual Network Computing) remote access sessions initiated from any source IP address to any IP address within the local network ($HOME_NET) on port 5900. It specifically looks for the 'RFB 00' string within the first 7 bytes of the TCP payload, which is characteristic of the VNC protocol handshake. A threshold is applied to trigger an alert if 3 such connections are observed from the same source IP within a 60-second window, indicating potential repeated or sustained VNC activity.
This rule detects suspicious software installers being downloaded over HTTP. It looks for HTTP responses containing the 'MZ' header (indicating a Windows executable) with a file size greater than 1MB, and where the HTTP URI contains keywords like 'setup', 'install', or 'update'. The rule is thresholded to trigger if three such events occur from the same source within 60 seconds, aiming to identify potential malware or unwanted software distribution.
This rule detects the download of potentially trojanized software updates. It specifically looks for HTTP traffic flowing to the client, where the URI contains "update" (case-insensitive), the HTTP host contains "update.", "cdn.", or "download." (case-insensitive), and the file data starts with "MZ" (indicating a Windows executable) within the first 2 bytes. Additionally, the downloaded file size must be greater than 500,000 bytes.
This rule detects attempts to download Python packages from the official Python Package Index (PyPI) where the package name in the URI appears to be a typosquatted version of common legitimate packages. Specifically, it looks for HTTP requests to pypi.org with URIs containing 'requets' (instead of 'requests'), 'boto' (instead of 'boto3' or similar), 'djang0' (instead of 'django'), 'flask2' (instead of 'flask'), or 'numpy2' (instead of 'numpy'). This indicates a potential supply chain attack where an attacker has registered a similarly named malicious package to trick users into downloading it.
This rule detects a potential watering hole attack where a legitimate website has been injected with a script that attempts to load content from an IP address. Specifically, it looks for HTTP responses (flow:to_client) containing '<script src=' followed by a URL where the source is an IP address (e.g., 'src="http://1.2.3.4/script.js"'). This technique is often used by attackers to compromise visitors of a trusted site by redirecting them to malicious content or exploiting vulnerabilities.
This rule detects potential drive-by exploit kit landing pages by inspecting HTTP response data for the presence of both "exploit" and "shellcode" (case-insensitive). It specifically looks for these keywords in the data flowing from the server to the client over an established HTTP connection. The rule is categorized as an exploit-kit detection and is associated with MITRE ATT&CK technique T1189 (Drive-by Compromise) and tactic Initial Access.
This rule detects potential rogue captive portal credential harvesting pages by inspecting HTTP responses for the presence of keywords like 'captive', 'password', and 'connect' within the file data. These keywords, when found together in a client-bound HTTP response, suggest an attempt to mimic a legitimate captive portal to steal user credentials.
This rule detects attempts to capture credentials via an 'Evil Twin' access point by looking for HTTP POST requests to URIs containing both 'login' and 'wifi'. This combination suggests a malicious captive portal designed to trick users into submitting their credentials.
This rule detects potential DNS hijacking attempts via a compromised resolver. It specifically looks for UDP traffic on port 53 (DNS) to the home network, containing the DNS response code '81 80' (indicating a standard query response) and the PCRE pattern '/\x00\x01\x00\x00/' which corresponds to a single question in the DNS query. A threshold of 20 occurrences within 10 seconds from the same source IP triggers the alert, suggesting a high volume of suspicious DNS responses.
This rule detects a high volume of outbound TCP communication from the home network to any destination on port 8080. This pattern can indicate a compromised server acting as a proxy or engaging in other suspicious network activity, potentially for resource development or command and control.
This rule detects potential command and control (C2) activity where a compromised WordPress site is used as a relay. It specifically looks for HTTP POST requests to URIs containing "wp-admin" with a data size greater than 1000 bytes. A threshold of 5 such events within 60 seconds from the same source IP triggers the alert, indicating a potential high volume of C2 communication.
This rule detects attempts to sell or exchange VPN credentials by looking for the keywords "vpn" and "credentials" in the client body of HTTP traffic. This could indicate an attacker attempting to monetize stolen VPN access or an insider threat attempting to leak sensitive access information.
This rule detects potential employee directory enumeration attempts via web requests. It triggers when HTTP URI content contains both 'directory' and 'people' (case-insensitive) within a 60-second window from the same source IP, with a threshold of 10 occurrences. This behavior is indicative of an attacker attempting to discover employee information or organizational structure.
This rule detects potential email address harvesting via web scraping by identifying a high volume of HTTP GET requests to URIs containing the word "contact" within a short timeframe from a single source IP address. The threshold is set to 30 requests within 30 seconds, indicating automated or rapid access attempts often associated with scraping activities.
This rule detects a high rate of HTTP GET requests from a single source IP address to internal web servers, indicating a potential reconnaissance activity. Specifically, it triggers if a source IP makes 50 or more HTTP GET requests within a 30-second window. This behavior could be indicative of an attacker attempting to map out web application structure or discover vulnerabilities.
This rule detects attempts to harvest physical location data via web requests. It specifically looks for HTTP GET requests where the URI contains both 'location' and 'address' (case-insensitive). A threshold of 15 such requests within 30 seconds from the same source IP triggers the alert, indicating a potential network scan or automated data collection activity.
This rule detects attempts to enumerate domain trust relationships using LDAP queries. Specifically, it looks for TCP traffic on port 389 (LDAP) containing the string "(objectClass=trustedDomain)" in the server-bound flow. This string is commonly used in LDAP queries to discover trusted domains within an Active Directory environment, which can be a reconnaissance step for attackers.
Page 185 of 211