Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,421 detections
Filters
Last updated
All Time
Detection languages
4,217
105
40
25
13
Contributors
1,327
1,003
725
627
332
Categories
2,253
2,239
1,434
1,144
973
Platforms
4,107
453
295
83
82
Products / Services
10,670
9,758
6,693
4,421
3,749
MITRE Techniques
886
774
552
505
456
CVEs
18
12
12
12
10
IDS Classtypes
1,868
466
446
362
230
IDS Protocols
2,366
846
388
301
93
This rule detects HTTP POST requests where the client body contains the keywords 'company', 'role', and 'email' (case-insensitive). This combination of keywords in a POST request body is indicative of a phishing reconnaissance attempt, where an attacker is trying to collect organizational data through a form submission.
This rule detects bulk phishing campaign delivery by monitoring SMTP traffic for a high volume of emails containing the 'Subject:' header. Specifically, it triggers an alert if 20 or more emails with a 'Subject:' header are sent to the internal network (HOME_NET) on port 25 within a 60-second window from the same source.
This rule detects HTTP responses that contain content indicative of a survey lure page used for information gathering. It specifically looks for the presence of keywords such as 'survey', 'name', 'email', and 'company' within the HTTP response body, suggesting an attempt to collect personal or organizational information.
This rule detects potential credential phishing pages served to a user over HTTP. It looks for HTTP responses containing both "Enter your password" and "Sign in" (case-insensitive) in the file data, and where the HTTP host is an IP address rather than a domain name. This combination of indicators suggests a generic phishing attempt designed to trick users into providing their credentials.
This rule detects HTTP requests to domains associated with corporate intelligence subscription services such as Dun & Bradstreet (dun.com, dnb.com) and Hoovers (hoovers.com). It triggers an alert if a single source IP makes 10 or more such requests within a 60-second window, indicating potential reconnaissance activity.
This rule detects HTTP requests to known data broker websites such as Spokeo, Intelius, and BeenVerified. It triggers an alert if 10 or more such requests are observed from a single source IP within a 60-second window. This activity could indicate reconnaissance efforts to gather information about individuals.
This rule detects bulk enumeration of a company's overview page by monitoring HTTP requests. It triggers an alert if a source IP makes 20 or more requests containing 'company' in the URI within a 30-second window, indicating a potential network scan or reconnaissance activity.
This rule detects web pages served to clients that contain characteristics commonly associated with tech support scams. Specifically, it looks for HTTP responses containing the words "call", "1-800", and "virus" (case-insensitive) in the file data. This combination of keywords suggests an attempt to trick users into calling a fake support number due to a fabricated "virus" infection.
MSHTA HTA Application Download
Suricata
This rule detects the download of an HTML Application (HTA) file that contains the string "<HTA:APPLICATION". HTA files can be used to execute malicious code, often bypassing browser security restrictions. The rule specifically looks for HTTP traffic where the URI contains ".hta" and the file data contains the HTA application tag, indicating a potential attempt to deliver or execute a malicious HTA.
This rule detects the delivery of shellcode via HTTP that contains a NOP sled pattern. The rule specifically looks for a sequence of eight or more '90' (hexadecimal) bytes in the HTTP response body, which is a common indicator of a NOP sled used to prepare for shellcode execution. The detection is focused on traffic flowing from the server to the client over an established HTTP connection.
This rule detects the download of a potential bootkit payload designed to overwrite the Master Boot Record (MBR). It specifically looks for HTTP traffic where the file data contains the byte sequence '|55 AA|' (which corresponds to the MBR signature) within the first 512 bytes and has a total size greater than 500 bytes. This pattern is indicative of malicious software attempting to modify the MBR for persistence or system control.
This rule detects potential JavaScript obfuscation within HTTP responses by looking for the presence of both 'eval(' and 'unescape(' within the first 500 bytes of file data in a client-bound HTTP flow. This combination of functions is often used in malicious JavaScript to hide its true intent and evade detection.
This rule detects attempts to modify the 'Run' key in the Windows Registry remotely over SMB (port 445). The 'Run' key is a common persistence mechanism used by attackers to ensure their malicious code executes every time a user logs in. The rule specifically looks for network traffic on port 445 containing the string 'SOFTWARE\Microsoft\Windows\CurrentVersion\Run', indicating a potential remote registry modification related to startup programs.
This rule detects attempts to access the AWS EC2 Instance Metadata Service (IMDS) by looking for HTTP requests containing the IP address '169.254.169.254' in the URI. This IP address is a well-known link-local address used by AWS instances to retrieve metadata. Such access attempts, especially when originating from an unexpected source or in an unusual context, can indicate a Server-Side Request Forgery (SSRF) vulnerability being exploited.
This rule detects attempts to disable the system firewall via HTTP traffic. It specifically looks for the 'netsh firewall disable' command within the HTTP flow, indicating a potential defense evasion tactic.
This rule detects attempts to modify the remote registry via Server Message Block (SMB) by looking for the strings "winreg" and "RegSetValue" in TCP traffic destined for port 445 on the home network. This activity could indicate an attacker attempting to establish persistence, elevate privileges, or evade defenses by altering system configurations.
This rule detects attempts at Server-Side Template Injection (SSTI) by looking for specific patterns in HTTP URI requests. It triggers an alert if the URI contains sequences like `{{.*}}` or `${.*}`, which are commonly used in various template engines to inject and execute code.
This rule detects attempts to execute setuid binaries via a web shell by looking for the string "chmod+s" in HTTP URI requests. This indicates an attacker trying to set the SUID bit on a file, which is a common technique for privilege escalation on Linux/Unix systems.
This rule detects Wake-on-LAN (WoL) magic packets. WoL is a network standard that allows a computer to be turned on or woken up by a network message. While legitimate, adversaries can use WoL to activate compromised systems (implants) for command and control or other malicious activities, especially if the system was previously shut down to evade detection.
This rule detects Telnet login attempts using the default credential 'admin'. It specifically looks for the string 'admin' (case-insensitive) in Telnet traffic flowing to the server. A threshold of 5 attempts within 60 seconds from the same source IP triggers the alert, indicating a potential brute-force or credential stuffing attack against Telnet services.
This rule detects the download of a file that appears to be an Office document template designed for remote template injection. It specifically looks for HTTP responses containing the strings "[Content_Types].xml" and "attachedTemplate" (case-insensitive) within the file data, which are indicators of a malicious Office document attempting to load a remote template.
Page 187 of 211