Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
6,537 detections
Filters
Last updated
All Time
Detection languages
3,970
998
598
428
233
Contributors
1,363
1,250
1,066
954
384
Categories
2,933
2,196
2,017
1,857
1,411
Platforms
39,954
7,270
6,537
3,867
3,651
Products / Services
4,107
2,418
1,587
270
254
MITRE Techniques
1,450
1,310
1,022
934
696
CVEs
46
46
33
18
12
IDS Classtypes
1,753
458
404
325
220
IDS Protocols
2,202
773
381
300
93
This rule detects a brute force attempt against a cloud management console. It triggers when a source IP address makes 10 or more HTTP POST requests to a URI containing 'signin' within a 30-second window. This pattern is indicative of an automated attempt to guess credentials for a login page.
This rule detects attempts to purchase code signing certificates by monitoring HTTP traffic for connections to known certificate authorities (Sectigo, Comodo, Digicert) and the presence of the term 'codesigning' in the URI. This could indicate an adversary attempting to acquire legitimate code signing certificates for malicious purposes, such as signing malware to evade detection.
This rule detects the use of a code signing certificate that is suspected to be stolen. It specifically looks for HTTP traffic where the TLS certificate subject contains an organization name matching a common corporate naming convention (e.g., 'O=Company Inc', 'O=Company LLC', 'O=Company Ltd', 'O=Company Corp') and the issuer is 'DigiCert'. This combination suggests a potentially legitimate certificate being used in an unauthorized context, possibly for signing malicious software.
This rule detects HTTP PUT requests to known remote file hosting services (transfer.sh, file.io, gofile.io, anonfiles). This activity is indicative of payload staging, where an attacker uploads malicious files or tools to a remote server for later use in an attack, often as part of the resource development phase of the attack lifecycle.
This rule detects attempts to upload executable files (specifically Windows MZ executables) to common cloud storage services like Amazon S3, Google Cloud Storage, and Azure Blob Storage. It looks for HTTP PUT requests containing the 'MZ' magic bytes at the beginning of the file data, indicating a Windows executable, with a file size greater than 100KB, directed towards known cloud storage domains.
This rule detects potential watering hole attacks by identifying HTTP responses (flow to client) that contain a combination of HTML script tags, 'document.write', and 'eval(' within the file data. This pattern is indicative of malicious JavaScript injection designed to execute code on the client side.
This rule detects network traffic to known initial access broker (IAB) market domains. It specifically looks for HTTP requests where the host matches 'exploit.in', 'xss.is', 'raidforums', or 'breachforums' and the URI contains the word 'access'. This indicates potential activity related to purchasing or selling initial access to compromised systems.
This rule detects HTTP traffic where the client body contains the terms "rdp" and "buy" (case-insensitive). This combination suggests a potential attempt to purchase RDP access, possibly on an underground forum, which is a policy violation.
This rule detects suspicious access to domain registration services by monitoring HTTP traffic for requests to known domain registrars (namecheap.com, godaddy.com, porkbun.com) with a URI containing 'register'. A threshold of 5 such requests within 60 seconds from the same source IP triggers an alert, indicating potential resource development activity such as bulk domain registration.
This rule detects unauthorized DNS server responses originating from external hosts. Specifically, it looks for UDP traffic on port 53 (DNS) with a specific content signature '|84 00|' at an offset of 2 bytes and a depth of 2 bytes, which corresponds to a DNS response header indicating a standard query response. The rule uses a threshold to alert if 10 such responses are observed from the same source within 30 seconds, suggesting a potential unauthorized or malicious DNS activity.
This rule detects WHOIS queries directed to internal services within the network. It specifically looks for TCP traffic on port 43 (the standard WHOIS port) flowing from any source to the internal network. A threshold of 5 queries within 60 seconds from the same source is set to reduce noise, indicating a potential network scan or reconnaissance activity.
This rule detects potential staff directory scraping by monitoring HTTP GET requests to URIs containing the word "staff". It triggers an alert if more than 20 such requests are observed from a single source IP within a 30-second window, indicating automated or rapid enumeration attempts.
This rule detects potential credential harvesting attempts by monitoring HTTP POST requests that contain both 'password' and 'email' in the client body. It specifically looks for these keywords in a case-insensitive manner within the HTTP client body and requires the body size to be greater than 50 bytes. This indicates a form submission likely containing sensitive user credentials.
Executive Team Page Enumeration
Suricata
This rule detects repeated HTTP requests to URIs containing the word "executive" (case-insensitive) from a single source IP address within a 30-second window. This behavior could indicate an attempt to enumerate executive team pages, potentially for reconnaissance purposes.
This rule detects potential executive leadership directory scraping attempts. It triggers an alert when a client makes 10 or more HTTP requests containing the word "leadership" (case-insensitive) in the URI within a 30-second window. This behavior could indicate an attacker attempting to gather information about key personnel for social engineering or other reconnaissance purposes.
This rule detects enumeration attempts of partner and vendor pages on a web server. It triggers when a client makes 20 or more HTTP requests containing the case-insensitive string "partner" in the URI within a 30-second window, indicating a potential reconnaissance activity to discover sensitive or specific sections of a website.
This rule detects a potential network scan targeting firewall management interfaces. It specifically looks for TCP SYN packets (flags:S) directed to port 8443 on the home network, which is a common port for firewall management. The rule triggers if 5 such connection attempts are observed from the same source within a 60-second window, indicating a threshold-based scan.
This rule detects HTTP requests to known BGP route lookup services (bgp.he.net, bgpview.io, ipwhois.io). This activity is often associated with reconnaissance, specifically IP block discovery, where an attacker or red team member is gathering information about an organization's network infrastructure.
This rule detects network host discovery attempts via UDP sweeps. It triggers an alert when a single source IP sends 30 or more UDP packets within a 10-second window to various destinations on the home network. This behavior is indicative of an attacker attempting to map out active hosts on a network.
Sitemap File Discovery Access
Suricata
This rule detects HTTP requests to URIs that contain both 'sitemap' and '.xml' (case-insensitive). This pattern is commonly associated with the discovery of sitemap files, which are used by search engines to crawl websites. Attackers or reconnaissance tools might access these files to map out a website's structure and discover hidden or unlinked pages, which can then be used for further attacks.
This rule detects potential Google Dorking activity targeting a specific site. It triggers when a client makes 10 or more HTTP requests within 60 seconds to 'google.com' where the URI contains 'site:'. This pattern is indicative of an attacker or reconnaissance tool using Google's search operators to find information about a target domain.
Page 237 of 312