Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
6,537 detections
Filters
Last updated
All Time
Detection languages
3,970
998
598
428
233
Contributors
1,363
1,250
1,066
954
384
Categories
2,933
2,196
2,017
1,857
1,411
Platforms
39,954
7,270
6,537
3,867
3,651
Products / Services
4,107
2,418
1,587
270
254
MITRE Techniques
1,450
1,310
1,022
934
696
CVEs
46
46
33
18
12
IDS Classtypes
1,753
458
404
325
220
IDS Protocols
2,202
773
381
300
93
This rule detects DNS queries for top-level domains (TLDs) commonly associated with bulletproof hosting services. Specifically, it looks for queries ending in .ru, .cn, .tk, .ml, .ga, .cf, or .gq. A threshold of 20 queries within 60 seconds from the same source IP will trigger an alert.
SNMP Bulk Walk Enumeration
Suricata
This rule detects SNMP Bulk Walk Enumeration attempts. It triggers when UDP traffic on port 161 (SNMP) contains the case-insensitive string "private" and exceeds a threshold of 10 occurrences from the same source IP within 30 seconds. This activity is indicative of an adversary performing reconnaissance to gather information about network devices.
This rule detects attempts to enumerate SNMP community strings by looking for UDP traffic on port 161 containing the string "public" (case-insensitive). It uses a threshold of 10 occurrences within 30 seconds from the same source IP to identify potential scanning activity.
This rule detects DNS ANY record queries, which can be used for reconnaissance purposes. An ANY record query (QTYPE=255 or 0xFF) requests all available record types for a given domain. While legitimate uses exist, it is often abused by attackers to gather extensive information about a target's DNS infrastructure, making it a common indicator of reconnaissance activity.
This rule detects a DNS reverse lookup sweep, which is characterized by a high volume of DNS queries for reverse IP addresses (in-addr.arpa) within a short period. Specifically, it triggers an alert if 20 such queries are observed from a single source IP within 30 seconds. This activity is often indicative of reconnaissance efforts by an attacker to map out internal network infrastructure.
This rule detects the use of the SQLMap automated SQL injection tool by identifying the string "sqlmap" in the HTTP User-Agent header of network traffic. It specifically looks for traffic flowing to the server on established connections.
Wfuzz Directory Scanner Detected
Suricata
This rule detects the use of Wfuzz, a web fuzzer, by identifying the 'Wfuzz' string in the HTTP User-Agent header. This activity is typically associated with reconnaissance, as attackers use such tools to discover directories, files, and other web application structures.
Nikto Web Scanner Detected
Suricata
This rule detects the use of the Nikto web scanner by identifying the 'Nikto' string in the HTTP User-Agent header. Nikto is a common open-source web server scanner that performs comprehensive tests against web servers for multiple items, including dangerous files/CGIs, outdated server software, and other problems. Detection of Nikto typically indicates reconnaissance activity against a web application or server.
This rule detects attempts to fingerprint web applications by identifying the 'WhatWeb' string in the HTTP User-Agent header. WhatWeb is a web application scanner that identifies technologies used by websites, which can be an indicator of reconnaissance activity.
This rule detects HTTP responses from a C2 beacon that contain the keywords "kill" and "process" (case-insensitive) within the URI. This pattern suggests a command being sent from the command and control server to the client to terminate a process, potentially an antivirus process, as part of defense evasion tactics.
This rule detects HTTP traffic where the URI contains both 'disable' and 'defender' (case-insensitive). This pattern suggests an attempt to disable security tools, specifically Windows Defender, via an HTTP command. The flow is set to 'to_client,established', indicating the response from a server to a client within an established connection.
This rule detects attempts to remotely clear event logs over Server Message Block (SMB) by looking for the strings "Eventlog" and "ClearEventLog" in TCP traffic destined for port 445. This activity is often associated with adversaries attempting to remove forensic evidence of their presence on a system.
This rule detects network traffic indicative of WMI remote execution, specifically looking for the string "IWbemServices" on TCP port 135. This activity is often associated with Living Off The Land Binaries and Scripts (LOLBAS) techniques, where legitimate system tools like WMI are abused for malicious purposes such as remote code execution or lateral movement. The rule is designed to alert on potential trojan activity.
This rule detects the download of a COM scriptlet (.sct file) over HTTP that contains XML and the keyword 'scriptlet'. This behavior is characteristic of the 'Squiblydoo' technique, which abuses legitimate Windows binaries like Regsvr32 to execute arbitrary code, often for defense evasion.
This rule detects HTTP downloads where the file is disguised as an image (e.g., .jpg, .png) but its content starts with 'MZ', indicating it's a Windows executable. This is a common technique used by adversaries to bypass security measures that might block executable downloads but allow image files.
This rule detects attempts to download a payload that contains an MSBuild inline task. It specifically looks for HTTP traffic (flow:to_client,established) containing the case-insensitive strings "<UsingTask" and "TaskFactory" within the file data. This pattern is indicative of an attacker attempting to leverage MSBuild's inline task functionality to execute arbitrary code, often as part of a larger attack chain for code execution or persistence.
This rule detects a high volume of TCP connection attempts to port 135 (RPC) on the home network. A threshold of 20 connection attempts from a single source within 30 seconds triggers the alert. This pattern can indicate an attempt to exploit RPC services for remote execution, often seen in worm propagation or targeted attacks.
This rule detects DCOM remote execution attempts via the RPC Endpoint Mapper. It specifically looks for TCP traffic to port 135 (RPC Endpoint Mapper) with a specific content signature "|05 00 0b|" within the first 3 bytes of the payload, indicating a DCOM activation request.
This rule detects HTTP POST requests that contain the string "creds" in the URI and have a data size greater than 200 bytes. This pattern is indicative of potential browser credential exfiltration, where an attacker or malicious software attempts to send stolen credentials to a remote server.
Remote LSASS Memory Dump via SMB
Suricata
This rule detects attempts to remotely dump the LSASS process memory over SMB. It specifically looks for the string "lsass.exe" within TCP traffic destined for port 445 (SMB) on the home network. This activity is indicative of an attacker trying to extract credentials from a compromised system.
This rule detects the download of files with names indicative of 'Potato' privilege escalation tools. It specifically looks for HTTP URI patterns containing 'potato' preceded by terms like 'sweet', 'juicy', 'rogue', 'bad', or 'print', case-insensitively. The detection is triggered on HTTP traffic flowing from the server to the client.
Page 239 of 312