Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
6,537 detections
Filters
Last updated
All Time
Detection languages
3,970
998
598
428
233
Contributors
1,363
1,250
1,066
954
384
Categories
2,933
2,196
2,017
1,857
1,411
Platforms
39,954
7,270
6,537
3,867
3,651
Products / Services
4,107
2,418
1,587
270
254
MITRE Techniques
1,450
1,310
1,022
934
696
CVEs
46
46
33
18
12
IDS Classtypes
1,753
458
404
325
220
IDS Protocols
2,202
773
381
300
93
This rule detects an attempt to escalate privileges on a system via SSH by looking for the string "sudo su" within an established TCP connection to port 22 (SSH). This indicates a user is trying to switch to the root user or another user with elevated privileges using the sudo command.
This rule detects attempts to drop a DLL file to a network share, specifically targeting the 'ADMIN$' share, which could indicate a DLL hijacking attempt. It monitors SMB traffic on port 445 for established connections and looks for content containing '.dll' and 'ADMIN$' (case-insensitive).
This rule detects RDP credential spraying attempts targeting multiple usernames on a single destination IP address. It triggers an alert if 30 or more RDP connection attempts are made to the same destination within a 60-second window, indicating a potential brute-force or credential-stuffing attack against RDP services.
This rule detects attempts to discover Group Policy information remotely over Server Message Block (SMB). It specifically looks for network traffic on port 445 (SMB) containing the strings "SYSVOL" and "GroupPolicy" (case-insensitive) in the same flow, indicating a potential query for Group Policy objects.
LDAP Password Policy Enumeration
Suricata
This rule detects attempts to enumerate LDAP password policy settings by looking for specific content within TCP traffic on port 389 (LDAP). Specifically, it triggers when it finds "(objectClass=domain)" and "pwdHistoryLength" in a case-insensitive manner within the network flow, indicating a query for password history length attribute of a domain object. This activity is often associated with reconnaissance or discovery phases of an attack.
This rule detects ICMP (Internet Control Message Protocol) packets that are characteristic of a traceroute operation, specifically those with a Time-To-Live (TTL) value less than 5. Traceroute is a network diagnostic tool used to display the route and measure transit delays of packets across an Internet Protocol (IP) network. Adversaries can use this technique for network topology discovery to map out the network infrastructure.
UDP Traceroute Network Discovery
Suricata
This rule detects UDP traceroute network discovery attempts. It triggers an alert when UDP packets with a Time-To-Live (TTL) value less than 5 are observed, with a threshold of 10 such events from the same source within 10 seconds. This behavior is indicative of network scanning to map network topology.
This rule detects attempts to access directory listings on a web server via HTTP. It specifically looks for HTTP responses containing the string "Index of /" in the file data, which is a common indicator of an exposed directory listing. This exposure can allow attackers to discover sensitive files and directories on the server.
This rule detects HTTP requests attempting to access the AWS EC2 Instance Metadata service, specifically targeting the 'latest/meta-data' endpoint. This service, typically found at the IP address 169.254.169.254, provides information about the running EC2 instance, including credentials and other sensitive data. Unauthorized access to this endpoint can indicate an attacker attempting to gain further access or information within an AWS environment.
This rule detects the transmission of cleartext credentials over Telnet by looking for the string "Password:" in traffic flowing to the server on port 23. Telnet is an insecure protocol that sends data, including login credentials, in plain text, making it vulnerable to eavesdropping.
This rule detects the transmission of cleartext credentials over FTP by looking for the "PASS " string in network traffic flowing to an FTP server on port 21. This indicates that a password is being sent without encryption, which is a security risk.
SMB Authentication Brute Force
Suricata
This rule detects SMB authentication brute force attempts by looking for multiple NTLMSSP_AUTH messages over port 445 (SMB) from the same source IP within a 30-second window. A threshold of 10 attempts triggers the alert, indicating a potential brute force attack against SMB authentication.
This Suricata rule detects potential data exfiltration of password store information over HTTP. It specifically looks for HTTP POST requests where the client body contains both the words "password" and "username" (case-insensitive) and the body size is greater than 1000 bytes. This pattern suggests an attempt to send sensitive credential data from a compromised system to a remote server.
This rule detects the download of a Meterpreter reverse shell stage by looking for a specific byte sequence ('|fc e8 8f 00 00 00|') in TCP traffic flowing to the server on an established connection. This byte sequence is characteristic of the initial stage of a Meterpreter payload, which is often used for command and control.
Cobalt Strike DNS Beacon Pattern
Suricata
This rule detects a specific pattern associated with Cobalt Strike DNS beacons. It looks for HTTP requests where the URI contains '/updates' and the User-Agent header is 'Mozilla/4.0'. This combination of indicators is often used by Cobalt Strike for command and control communication.
This rule detects large HTTP POST requests containing GZIP compressed data (identified by the magic bytes '|1F 8B|') with a size greater than 100,000 bytes. This behavior is indicative of possible data staging or exfiltration, where an attacker might compress and upload sensitive data from a compromised system.
Confluence Wiki Bulk Export
Suricata
This rule detects HTTP requests to the '/spaces/exportspace.action' URI, which is associated with bulk export functionality in Confluence Wiki. This activity could indicate an attempt to exfiltrate data from a Confluence instance.
This rule detects a high volume of document downloads from SharePoint, specifically looking for repeated access to the `/_layouts/download.aspx` URI. A threshold of 30 downloads within 60 seconds from a single source IP address triggers the alert. This behavior could indicate an attempt to exfiltrate a large amount of data from SharePoint.
This rule detects attempts to drop executable files (.exe) into shared network folders (specifically those containing '\share\') over SMB (Server Message Block) protocol. This activity is indicative of an attacker attempting to move tools or malware laterally within a network.
This rule detects attempts to enumerate Docker containers via the Docker API. Specifically, it looks for HTTP requests to the '/containers/json' endpoint on TCP port 2375, which is commonly used for unauthenticated Docker API access. This activity is indicative of an adversary trying to discover running containers on a compromised host.
This rule detects a pattern indicative of ransomware encrypting files over SMB. It specifically looks for TCP traffic on port 445 (SMB) within the home network, containing the byte sequence '|FF|SMB'. A threshold of 500 such events from a single source IP within 30 seconds triggers the alert, classifying it as trojan activity.
Page 240 of 312