Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
6,537 detections
Filters
Last updated
All Time
Detection languages
3,970
998
598
428
233
Contributors
1,363
1,250
1,066
954
384
Categories
2,933
2,196
2,017
1,857
1,411
Platforms
39,941
7,266
6,537
3,866
3,647
Products / Services
4,107
2,418
1,587
270
254
MITRE Techniques
1,450
1,310
1,022
934
696
CVEs
46
46
33
18
12
IDS Classtypes
1,753
458
404
325
220
IDS Protocols
2,202
773
381
300
93
This rule detects attempts to discover the current user via a web shell by looking for HTTP requests containing the string "whoami" in the URI. This is a common command executed on compromised web servers to gain information about the user context of the web server process.
This rule detects DNS queries to specific domains (connectivitycheck.gstatic.com or msftconnecttest.com) that are commonly used by operating systems and applications to check for internet connectivity. A high volume of such queries (threshold of 10 within 30 seconds from a single source) could indicate a network scan or unusual network activity.
This rule detects a high volume of Registry Hive bulk queries for system reconnaissance activities. Specifically, it looks for 30 or more 'RegEnumKey' operations over TCP port 445 (SMB) within a 30-second window, originating from a single source IP address and directed towards the protected network. This behavior can indicate an attacker attempting to enumerate registry keys to gather information about the system.
This rule detects attempts to enumerate application windows using specific API calls (EnumWindows and GetWindowText) over HTTP. This behavior is often associated with remote access tools or malware trying to gather information about the user's active applications.
This rule detects attempts to query the list of services on a remote Windows host via the Remote Registry service. It specifically looks for the string "HKLM\System\CurrentControlSet\Services" over TCP port 445 (SMB/CIFS), which is commonly used for Remote Registry access. A threshold of 10 occurrences within 30 seconds from the same source IP is set to reduce false positives.
This rule detects attempts to enumerate Docker containers via the Docker API by looking for HTTP requests containing the URI '/containers/json'. This activity could indicate an attacker performing reconnaissance on a compromised host to understand the running container environment.
This rule detects attempts to enumerate security products on a target system via Remote WMI over SMB (port 445). It specifically looks for the string "AntiVirusProduct" in TCP traffic directed to port 445, indicating a potential query for installed antivirus software. This activity is often associated with discovery tactics used by attackers to understand the security posture of a compromised system or network.
This rule detects attempts to discover password policy information by executing the 'net accounts' command via a web shell. The rule specifically looks for HTTP requests where the URI content contains 'net accounts' in a case-insensitive manner, indicating a potential web-based command execution to gather system information related to password policies.
This rule detects HTTP requests to the AWS EC2 service (ec2.amazonaws.com) that specifically attempt to enumerate Amazon Machine Images (AMIs) using the 'DescribeImages' API call. This activity could indicate an attacker performing reconnaissance to understand the available virtual machine images within an AWS environment.
This rule detects attempts to enumerate Linux system logs via remote SSH connections. Specifically, it looks for the string "cat /var/log/" within TCP traffic on port 22 (SSH). A threshold of 10 occurrences within 30 seconds from the same source IP is set to reduce false positives.
This rule detects attempts to query the list of system drivers on a remote Windows host via a WMI session over SMB (port 445). The detection is based on the presence of the string "Win32_SystemDriver" in the network traffic, indicating a WMI query for system driver information. This activity can be indicative of reconnaissance by an attacker.
This rule detects the delivery of a kernel driver enumeration tool via HTTP. Specifically, it looks for the string "EnumDeviceDrivers" (case-insensitive) within HTTP response data flowing to a client. This string is indicative of tools or malware attempting to enumerate loaded kernel drivers, which is a common reconnaissance technique used by attackers.
This rule detects HTTP requests that contain 'gcc' and '-o' in the URI, which could indicate an attempt to compile malware on a host using the GCC compiler. This activity is often associated with defense evasion techniques where an attacker compiles malicious code directly on a compromised system.
This rule detects attempts to install a kernel module (rootkit) on a Linux system via an SSH session. It specifically looks for the 'insmod' command followed by a '.ko' file extension within TCP traffic destined for port 22 (SSH). This combination suggests an attacker is trying to load a malicious kernel object.
This rule detects attempts to push a root certificate to a Windows system via the Remote Registry service (SMB port 445). It specifically looks for network traffic containing the strings "Root\Certificates" and "RegSetValue" (case-insensitive) within the same TCP flow to a server on port 445. This activity could indicate an attacker attempting to establish persistence or bypass security controls by installing a trusted root certificate.
This rule detects network traffic on TCP port 445 (SMB) containing the string "wintrust.dll" in a case-insensitive manner. This specific DLL is associated with Windows Trust Provider functionality. The detection is flagged as 'trojan-activity' and is linked to MITRE ATT&CK technique T1553.003 (Code Signing: Code Signing Policy Modification) and tactic Defense Evasion, suggesting an attempt to bypass code signing policies by replacing or manipulating the wintrust.dll.
This rule detects potential steganography where a payload is embedded within an image file, specifically a JPEG. It triggers when an HTTP response contains JPEG magic bytes (`FF D8 FF`) within the first 3 bytes, and the file size is unusually large (over 1MB), suggesting additional data might be hidden within the image. The rule also includes a threshold to prevent excessive alerts from legitimate large images.
This rule detects the delivery of a payload designed to bypass trust controls via HTTP. It specifically looks for HTTP responses (flow:to_client) containing the 'MZ' magic bytes (indicating an executable file) within the first 2 bytes of the file data, combined with URI paths that include keywords like 'bypass', 'unsigned', or 'notrust'. This combination suggests an attempt to deliver malicious or untrusted executables that aim to circumvent security mechanisms.
This rule detects the string "DisableAntiSpyware" in HTTP response bodies. This string is often associated with commands or responses related to disabling security defenses, specifically anti-spyware features, which is a common tactic used by malware or attackers for defense evasion. The rule is designed to alert when such a command or response is delivered to a client within an established HTTP flow.
This Suricata rule detects network traffic on TCP port 445 (SMB) that contains the strings "SpecialAccounts" and "UserList" (case-insensitive). This pattern is indicative of an attempt to hide a user account on a Windows system by modifying the registry's SpecialAccounts\UserList key. This technique is often used by adversaries for defense evasion.
This rule detects HTTP responses containing a Windows executable (identified by the 'MZ' header) where the URI path suggests it's masquerading as a legitimate Windows system binary like svchost.exe, winlogon.exe, lsass.exe, services.exe, or csrss.exe. This is a common technique used by malware to evade detection by appearing as a trusted process.
Page 243 of 312