Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
6,537 detections
Filters
Last updated
All Time
Detection languages
3,970
998
598
428
233
Contributors
1,363
1,250
1,066
954
384
Categories
2,933
2,196
2,017
1,857
1,411
Platforms
39,941
7,266
6,537
3,866
3,647
Products / Services
4,107
2,418
1,587
270
254
MITRE Techniques
1,450
1,310
1,022
934
696
CVEs
46
46
33
18
12
IDS Classtypes
1,753
458
404
325
220
IDS Protocols
2,202
773
381
300
93
This rule detects the exfiltration of AWS temporary credential tokens over HTTP. It specifically looks for HTTP client body content containing both "ASIA" (which is a common prefix for AWS temporary access keys) and "aws_session_token" (the parameter name for the session token). The detection is case-insensitive and targets established HTTP connections where data is flowing from the client to the server.
This rule detects the exfiltration of a GitHub Personal Access Token (PAT) over HTTP. It specifically looks for the string "ghp_" in the client body of HTTP traffic, which is a common prefix for GitHub PATs. The rule is designed to identify instances where a PAT might be sent from an internal network to an external server, indicating potential credential compromise or data exfiltration.
This rule detects ARP cache poisoning attempts by identifying multiple ARP responses (opcode 2) for the same IP address within a short time frame (15 responses in 5 seconds from the same source). This behavior is indicative of an attacker attempting to redirect network traffic by sending forged ARP replies.
Detects network traffic over TCP port 886, which is specifically used by Atlas RAT for command and control check-ins, plugin downloads, and encrypted data exfiltration in TA4922 campaigns.
Detects network requests associated with FallSpy, an Android spyware utilized by the Russia-nexus threat group GREYVIBE. FallSpy is deployed via fake persona lures and spoofed applications to harvest critical intelligence. While the original YARA rule targets file-based artifacts (e.g., class names like DataCollectorWork), this Sigma rule adapts the logic to focus on the highly reliable exfiltration URL parameters observable in proxy and web gateway logs.
Stealth TCP SYN Scan Detected
Suricata
Detects low-and-slow TCP SYN scanning activity where an attacker reduces scan rate to avoid basic threshold detection. This is common in stealth reconnaissance using Nmap or custom scanners.
This rule detects potential HTTP/2 Rapid Reset or similar denial-of-service (DoS) attacks by identifying an unusually high number of streams and total requests within a single HTTP/2 network connection over a one-minute interval. Such behavior is indicative of an attacker attempting to exhaust server resources by rapidly opening and closing streams.
Detects the initial access attempt for the Oracle E-Business Suite vulnerability CVE-2025-61882. This involves a crafted POST request to the UiServlet component containing a malicious XML payload.
This rule detects potential EWM (Event-Window-Message) injection attempts via the SetWindowLong API by looking for the presence of both "SetWindowLongPtr" and "GetWindowLongPtr" strings in HTTP client-bound file data. This technique is often used for privilege escalation or code injection.
Detects the specific User-Agent string 'NSIS_InetLoad (Mozilla)' associated with the SessionGate multi-stage loader during its command and control (C2) check-ins. SessionGate is delivered via impersonated open-source tooling websites and gated TDS redirection chains.
This rule detects an unusually high number of network connection events originating from a single device to a remote IP address within a one-minute interval. This behavior can be indicative of various malicious activities, including network scanning, port scanning, or a denial-of-service (DoS) attempt. It could also signal a compromised host attempting to establish numerous connections for command and control, data exfiltration, or further reconnaissance.
Detects HTTP requests with known scanner or automation user-agents commonly used by reconnaissance tools like Nikto, sqlmap, or curl-based scripts. This rule specifically looks for 'sqlmap', 'nikto', 'curl', and 'python-requests' within the HTTP User-Agent header.
SSH Brute Force Attempt Detected
Suricata
Detects repeated failed SSH authentication attempts which may indicate brute force activity against SSH services. The rule specifically looks for 8 SSH connection attempts to port 22 within a 60-second window from the same source IP.
This rule detects attempts to create a new local user account on a system via a remote Server Message Block (SMB) connection. It specifically looks for the string "NetUserAdd" (case-insensitive) within TCP traffic destined for port 445, which is commonly used by SMB. This activity is indicative of an attacker attempting to establish persistence or gain further access by creating new accounts.
This rule detects attempts to modify local or domain group memberships by monitoring TCP traffic on port 389 (LDAP). It specifically looks for the keywords "member" and "add" within the traffic, indicating an attempt to add a member to a group. A threshold of 5 occurrences within 60 seconds from the same source IP is set to reduce false positives.
This rule detects when a credential (password) is added to an Azure Service Principal. This activity is identified by monitoring HTTP traffic for requests to 'graph.microsoft.com' containing 'addPassword' in the URI. This could indicate an attacker establishing persistence by adding new credentials to an existing service principal.
This rule detects the creation of an XDG Autostart entry on a Linux host by looking for network traffic containing the string "/etc/xdg/autostart/" in a TCP flow to the server on port 22. This directory is commonly used for persistence by malware to automatically execute at system startup.
This rule detects network traffic on TCP port 445 (SMB) containing the string "Security Packages" in a case-insensitive manner. This pattern is often associated with the registration or use of Security Support Provider DLLs, which can be a persistence mechanism (T1547.005) used by adversaries to maintain access to a system.
This rule detects network traffic on port 445 (SMB) containing the string "TimeProviders" (case-insensitive). This pattern is indicative of a Time Provider DLL being registered for persistence, a technique used by attackers to maintain access to a system. The rule specifically looks for this activity in established TCP connections flowing to the home network.
This rule detects network traffic containing the string "/etc/udev/rules.d/" over TCP port 22 (SSH). This string is indicative of an attempt to modify udev rules, which can be used for Linux persistence by executing malicious scripts or commands when specific hardware events occur. The detection is focused on traffic flowing from the home network to a server on the home network, suggesting an internal system attempting to modify udev rules on another internal system via SSH.
This rule detects the download of installer packages (MSI, PKG, DEB, RPM) over HTTP that contain the string 'CustomAction'. This combination is often used by malicious installers to establish persistence on a system by creating custom actions that execute at specific events.
Page 245 of 312