Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
6,537 detections
Filters
Last updated
All Time
Detection languages
3,970
998
598
428
233
Contributors
1,363
1,250
1,066
954
384
Categories
2,933
2,196
2,017
1,857
1,411
Platforms
39,960
7,270
6,537
3,867
3,651
Products / Services
4,107
2,418
1,587
270
254
MITRE Techniques
1,450
1,310
1,022
934
696
CVEs
46
46
33
18
12
IDS Classtypes
1,753
458
404
325
220
IDS Protocols
2,202
773
381
300
93
Detects DNS over HTTPS (DoH) traffic originating directly from edge appliances (e.g., to 8.8.8.8 on port 443), which VerdantBamboo uses to obscure BRICKSTORM C2 resolution.
This rule detects a 'ListPlanting Injection' attack via the SendMessage API payload within HTTP traffic. It specifically looks for the strings 'LVM_SORTITEMS' and 'SendMessage' (case-insensitive) in the file data of an HTTP response flowing to the client. This type of injection is often associated with shellcode or code injection techniques.
This rule detects the delivery of a Linux VDSO (Virtual Dynamic Shared Object) hijack tool via HTTP. It specifically looks for HTTP traffic to a client containing the strings "[vdso]" and "mprotect" (case-insensitive) within the file data. This combination of strings suggests the presence of code designed to manipulate the VDSO, a technique often used for privilege escalation or evasion on Linux systems.
This rule detects potential DLL injection attempts over HTTP by looking for the presence of both 'LoadLibraryA' and 'VirtualAllocEx' within the file data of an HTTP response. These functions are commonly used in conjunction during DLL injection techniques, where 'VirtualAllocEx' allocates memory in a remote process and 'LoadLibraryA' loads a DLL into that allocated memory. The 'flow:to_client,established' indicates that the detection is looking for these patterns in data flowing from the server to the client over an established HTTP connection.
This rule detects potential process injection shellcode payloads within HTTP responses. It specifically looks for the presence of the strings "OpenProcess" and "CreateRemoteThread" (case-insensitive) in the file data of HTTP responses flowing from the server to the client. These API calls are commonly used in process injection techniques to gain control over another process and execute malicious code.
This rule detects HTTP network connections to TeamViewer domains, specifically 'teamviewer.com' or 'router.teamviewer.com'. It triggers an alert if five such connections are observed from the same source IP within a 60-second window. This behavior is indicative of TeamViewer being used for persistent command and control (C2) activities, often associated with trojan activity.
This rule detects attempts to retrieve C2 configuration from Pastebin, specifically looking for HTTP requests to 'pastebin.com' that include '/raw/' in the URI. It uses a threshold of 5 occurrences within 300 seconds from the same source to reduce false positives.
This rule detects attempts to modify SSH authorized_keys files over a network connection, which could indicate an attacker establishing backdoor access. It specifically looks for the string "authorized_keys" within TCP traffic destined for port 22 (SSH).
This rule detects attempts to push potentially malicious container images to an internal registry. It specifically looks for HTTP POST requests to '/v2/' and '/blobs/uploads/' URIs, indicating an image layer upload, with a data size greater than 100KB. This behavior could be indicative of an attacker attempting to establish persistence or introduce malicious code into the container environment.
This rule detects potential DLL hijacking attempts targeting Terminal Services (RDP) by looking for the string "termsrv.dll" within TCP traffic destined for port 3389 (RDP). This could indicate an attacker attempting to load a malicious DLL in place of the legitimate termsrv.dll to maintain persistence or execute arbitrary code.
This rule detects network traffic indicating the installation of a Transport Agent on an Exchange server. It specifically looks for the strings "TransportAgent" and "Install-TransportAgent" in TCP traffic directed to port 25 of the home network, suggesting a potential malicious or unauthorized installation of an Exchange Transport Agent.
This rule detects attempts to create a stored procedure in a Microsoft SQL Server database that includes the 'xp_cmdshell' extended stored procedure. 'xp_cmdshell' allows execution of operating system commands directly from SQL Server, and its use in a newly created stored procedure can indicate an attacker establishing persistence or attempting to execute arbitrary commands on the underlying system.
This rule detects a sequence of TCP SYN packets with a zero data size, originating from any source to any destination within the home network. The detection is triggered when 5 such packets are observed from the same source within a 3-second window. This pattern is indicative of a 'Magic Packet Implant Activation Sequence', which could be used by an attacker for persistence or command and control.
This rule detects the delivery of a malicious Outlook form script over HTTP. It specifically looks for HTTP traffic flowing to the client that contains the strings "IPM.Note", "Script", and "VBScript" within the file data, indicating an attempt to deliver a VBScript-based Outlook form.
This rule detects the remote installation of a new Windows service over SMB (Server Message Block) protocol. It specifically looks for TCP traffic on port 445 (SMB) directed to the home network, containing the strings "CreateService" and "svcctl" (case-insensitive). This combination indicates an attempt to create a new service remotely, which can be a method for persistence or privilege escalation by attackers.
This rule detects attempts to modify Cisco router firmware using ROMMONkit. It specifically looks for TCP traffic to the HOME_NET on port 23 (Telnet) containing the case-insensitive strings "rommon" and "tftpdnld". This combination suggests an attempt to interact with the router's ROM Monitor mode for firmware manipulation, often associated with malicious activities like installing backdoors or persistent malware.
This rule detects network traffic on port 445 (SMB) containing the strings "LSASS" and "AddDll" (case-insensitive). This combination of strings suggests an attempt to register a malicious DLL with the Local Security Authority Subsystem Service (LSASS) for persistence, a technique often used by malware to maintain access on a compromised system. The flow is set to 'to_server' and 'established', indicating an outgoing connection from the monitored network to a server, and that the TCP connection has been successfully established.
This rule detects network traffic on TCP port 445 (SMB) containing the case-insensitive strings "powercfg" and "change". This combination suggests an attempt to modify system power settings, potentially to prevent a system from sleeping or shutting down, which could be a persistence mechanism.
This rule detects the delivery of a file over HTTP that contains the strings "AppDomainManager" and "CreateDomain" (case-insensitive). This combination of strings is indicative of an attempt to hijack the AppDomainManager, a technique used for persistence in .NET applications, often associated with T1574.014 (AppDomainManager Hijacking) from MITRE ATT&CK.
This rule detects the delivery of shellcode designed to hijack the KernelCallbackTable. It specifically looks for HTTP traffic (flow:to_client,established) containing the strings "KernelCallbackTable" and "NtUserSetWindowsHookEx" (case-insensitive) within the file data. This technique is often used for privilege escalation or persistence by redirecting kernel callbacks to malicious code.
This rule detects network traffic on TCP port 445 (SMB) containing the strings "icacls" and "grant" (case-insensitive). This combination suggests an attempt to modify file or directory permissions, specifically granting permissions, which could be indicative of an attacker exploiting a service binary file permission weakness to establish persistence or elevate privileges. The rule is triggered when these strings are observed in traffic flowing to the server.
Page 234 of 312