Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
6,537 detections
Filters
Last updated
All Time
Detection languages
3,970
998
598
428
233
Contributors
1,363
1,250
1,066
954
384
Categories
2,933
2,196
2,017
1,857
1,411
Platforms
39,960
7,270
6,537
3,867
3,651
Products / Services
4,107
2,418
1,587
270
254
MITRE Techniques
1,450
1,310
1,022
934
696
CVEs
46
46
33
18
12
IDS Classtypes
1,753
458
404
325
220
IDS Protocols
2,202
773
381
300
93
This rule detects the deployment of a potentially malicious middleware component on an application server. It specifically looks for HTTP POST requests to port 8080 with a URI containing 'deploy' (case-insensitive) and a data size greater than 10000 bytes. This pattern is indicative of a large payload being sent to deploy an application or component, which could be malicious in nature.
This rule detects HTTP requests that contain both 'config' and 'lock' in the URI, suggesting an attempt to access or manipulate configuration files that might be locked, potentially indicating an exclusive lock on a security tool's configuration file. The rule is classified as 'trojan-activity'.
This rule detects attempts to register a new system service via a remote SSH connection. It specifically looks for the string "service install" within TCP traffic on port 22 (SSH) flowing from a client to a server within the home network. This activity could indicate an attacker establishing persistence on a compromised system.
This rule detects when a cron job is created or modified via a remote SSH session. It specifically looks for the string "crontab -e" within TCP traffic destined for port 22 (SSH), indicating an interactive session where a user is editing their crontab file. This activity, when originating from a remote SSH session, could be indicative of an attacker establishing persistence or scheduling malicious tasks on a compromised system.
This rule detects attempts to execute AT commands via a web shell. It specifically looks for HTTP requests containing both 'at+' and 'cmd' in the URI, case-insensitively. This pattern is indicative of an attacker trying to run system commands through a compromised web application.
This rule detects the download of JavaScript files (.js or .jse extensions) over HTTP that contain the string "WScript.Shell" (case-insensitive). This string is often used in malicious JavaScript to interact with the Windows operating system, indicating potential trojan activity.
This rule detects the download of a Python script that appears to be a reverse shell. It specifically looks for HTTP traffic (flow:to_client,established) containing the strings "import socket" and "connect(" within the file data, case-insensitive. These strings are common indicators of Python code attempting to establish a network connection, often used in reverse shell implementations.
This rule detects the download of a potentially malicious LNK shortcut file over HTTP. It specifically looks for HTTP responses (flow:to_client) containing a URI with ".lnk" (nocase) and the byte sequence "|4C 00 00 00|" at the beginning of the file data (depth:4), which is characteristic of an LNK file header. This activity is often associated with initial access or execution techniques where attackers use shortcut files to deliver malware or execute malicious commands.
This rule detects when a user clicks on a malicious link, indicated by a referrer from common email/webmail services (mail., webmail., outlook., gmail.), and the subsequent HTTP response contains a Windows executable (MZ header). This suggests a drive-by download attempt or a user being tricked into downloading malware after clicking a phishing link.
This rule detects the delivery of a malicious DLL (Dynamic Link Library) file via HTTP download. It specifically looks for HTTP responses (flow:to_client) containing a URI with ".dll" (case-insensitive) and the "MZ" magic bytes at the beginning of the file data, indicating an executable file. This combination suggests a DLL being downloaded to a client system, which could be part of a malware delivery chain.
This rule detects potential API injection payloads, specifically looking for the strings "CreateRemoteThread" and "OpenProcess" within HTTP response data. These API calls are commonly used in techniques like process injection to execute malicious code within another process. The rule is designed to identify the delivery of such payloads to client systems.
This rule detects attempts to abuse native Windows API functions, specifically 'NtCreateProcess', via web shell execution. It looks for HTTP requests where the URI content includes 'NtCreateProcess' in a case-insensitive manner, indicating a potential web shell trying to create a new process on the server.
This rule detects HTTP POST requests to AWS Lambda invocation endpoints, specifically targeting URLs matching the pattern '/lambda.[a-z0-9-]+.amazonaws.com' with the URI '/invocations'. A threshold of 20 such requests within 60 seconds from a single source IP triggers the alert, indicating potential code execution activity via AWS Lambda.
This rule detects when a file containing both ".plist" in its HTTP URI and "LaunchDaemon" in its content is delivered via HTTP. This combination suggests the download of a macOS LaunchDaemon property list file, which could be used for persistence or privilege escalation on macOS systems.
This rule detects the string "launchctl load" within TCP traffic on port 22 (SSH). This indicates an attempt to load a launchd service on a macOS or Linux system via a remote SSH connection. This activity could be legitimate system administration but also could be indicative of an attacker establishing persistence or executing malicious services.
This rule detects potential DCOM lateral execution attempts. It specifically looks for TCP traffic to port 135 (typically used by DCOM/RPC) on the home network, containing the byte sequence '|05 00 0b|' within the first 3 bytes of the payload. A threshold of 5 occurrences from the same source within 30 seconds is set to reduce false positives.
This rule detects the download of a potential trojanized installer file over HTTP. It looks for HTTP responses to clients that contain 'setup', 'install', or 'installer' in the URI, have a file size greater than 500KB, and contain the 'MZ' header, indicating a Windows executable. This combination suggests a user is downloading an executable that could be malicious.
This rule detects the download of archive files (ZIP, RAR, 7Z, TAR.GZ) over HTTP that contain an executable file signature ('MZ' header). This combination suggests a potential user execution scenario where a malicious executable might be delivered within an archive.
This rule detects when an executable file (.exe) is copied to a share associated with a removable drive (indicated by 'USBSTOR') over the SMB protocol. This could indicate an attempt to transfer malicious executables to or from a removable device.
This rule detects LDAP bind requests originating from an external source to a domain controller (port 389) within the home network. It specifically looks for the 'bindRequest' content in TCP traffic and triggers an alert if 10 such requests are observed from the same source within a 30-second window. This could indicate an attempt to enumerate or authenticate against directory services from outside the internal network, potentially as part of initial access or reconnaissance.
This rule detects TFTP (Trivial File Transfer Protocol) traffic on UDP port 69, specifically looking for a content pattern that indicates a firmware push. The pattern '|00 02|' at the beginning of the UDP payload suggests a TFTP write request (opcode 2), which is commonly used for uploading files, including firmware, to network devices. The rule is designed to alert on such activity directed towards the local network ($HOME_NET).
Page 235 of 312