Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
6,537 detections
Filters
Last updated
All Time
Detection languages
3,970
998
598
428
233
Contributors
1,363
1,250
1,066
954
384
Categories
2,933
2,196
2,017
1,857
1,411
Platforms
39,936
7,266
6,537
3,866
3,647
Products / Services
4,107
2,418
1,587
270
254
MITRE Techniques
1,450
1,310
1,022
934
696
CVEs
46
46
33
18
12
IDS Classtypes
1,753
458
404
325
220
IDS Protocols
2,202
773
381
300
93
This rule detects repeated HTTP requests to a web server where the URI contains the case-insensitive string "headquarters". It triggers an alert if a single source IP makes 10 such requests within a 30-second window. This behavior is indicative of an automated attempt to scrape information related to a company's headquarters address, potentially for reconnaissance purposes.
This rule detects attempts to look up physical office locations via web requests. It specifically triggers on HTTP GET requests where the URI contains both 'office' and 'location' (case-insensitive). A threshold of 10 such requests from the same source within 30 seconds is set to reduce false positives.
This rule detects HTTP responses from a server to a client that contain specific keywords ('remote', 'support', 'download') within the file data, indicating a potential fake IT support page attempting to deliver a remote access tool. The rule also checks for a minimum file size to reduce false positives.
This rule detects outbound TCP connections to port 9050, which is commonly used by Tor proxies. The rule specifically looks for the initial SYN packet (flags:S) of a TCP connection from the home network to any destination on port 9050. This activity is flagged as a policy violation, indicating the use of a Tor proxy for accessing closed source resources.
This rule detects attempts to access known online platforms used for purchasing stolen data, such as 'leakbase', 'breachforums', and 'raidforums'. It specifically looks for these keywords in the HTTP host header during client-to-server HTTP traffic.
This rule detects access to known exploit kit purchase or dark web marketplace sites by inspecting HTTP host headers for specific domain patterns. The rule triggers an alert if a client on the home network attempts to connect to any of the listed domains, which are associated with exploit kit sales or underground forums.
This rule detects HTTP responses that appear to be a phishing kit landing page. It looks for specific keywords in the HTTP response body, such as 'img', 'logo', 'password', and 'Submit', indicating a page designed to collect credentials. Additionally, it checks if the HTTP host is an IP address, which is often used in phishing campaigns to bypass domain-based reputation checks or to host pages directly on compromised servers.
This rule detects potential phishing emails sent over SMTP that request sensitive information. It looks for specific keywords in the email subject and content, such as "verify", "account", and "click here", indicating an attempt to trick the recipient into revealing credentials or other sensitive data.
This rule detects HTTP POST requests where the client body contains the keywords 'company', 'role', and 'email' (case-insensitive). This combination of keywords in a POST request body is indicative of a phishing reconnaissance attempt, where an attacker is trying to collect organizational data through a form submission.
This rule detects bulk phishing campaign delivery by monitoring SMTP traffic for a high volume of emails containing the 'Subject:' header. Specifically, it triggers an alert if 20 or more emails with a 'Subject:' header are sent to the internal network (HOME_NET) on port 25 within a 60-second window from the same source.
This rule detects HTTP responses that contain content indicative of a survey lure page used for information gathering. It specifically looks for the presence of keywords such as 'survey', 'name', 'email', and 'company' within the HTTP response body, suggesting an attempt to collect personal or organizational information.
This rule detects potential credential phishing pages served to a user over HTTP. It looks for HTTP responses containing both "Enter your password" and "Sign in" (case-insensitive) in the file data, and where the HTTP host is an IP address rather than a domain name. This combination of indicators suggests a generic phishing attempt designed to trick users into providing their credentials.
This rule detects HTTP requests to domains associated with corporate intelligence subscription services such as Dun & Bradstreet (dun.com, dnb.com) and Hoovers (hoovers.com). It triggers an alert if a single source IP makes 10 or more such requests within a 60-second window, indicating potential reconnaissance activity.
This rule detects HTTP requests to known data broker websites such as Spokeo, Intelius, and BeenVerified. It triggers an alert if 10 or more such requests are observed from a single source IP within a 60-second window. This activity could indicate reconnaissance efforts to gather information about individuals.
This rule detects bulk enumeration of a company's overview page by monitoring HTTP requests. It triggers an alert if a source IP makes 20 or more requests containing 'company' in the URI within a 30-second window, indicating a potential network scan or reconnaissance activity.
This rule detects web pages served to clients that contain characteristics commonly associated with tech support scams. Specifically, it looks for HTTP responses containing the words "call", "1-800", and "virus" (case-insensitive) in the file data. This combination of keywords suggests an attempt to trick users into calling a fake support number due to a fabricated "virus" infection.
MSHTA HTA Application Download
Suricata
This rule detects the download of an HTML Application (HTA) file that contains the string "<HTA:APPLICATION". HTA files can be used to execute malicious code, often bypassing browser security restrictions. The rule specifically looks for HTTP traffic where the URI contains ".hta" and the file data contains the HTA application tag, indicating a potential attempt to deliver or execute a malicious HTA.
This rule detects the delivery of shellcode via HTTP that contains a NOP sled pattern. The rule specifically looks for a sequence of eight or more '90' (hexadecimal) bytes in the HTTP response body, which is a common indicator of a NOP sled used to prepare for shellcode execution. The detection is focused on traffic flowing from the server to the client over an established HTTP connection.
This rule detects the download of a potential bootkit payload designed to overwrite the Master Boot Record (MBR). It specifically looks for HTTP traffic where the file data contains the byte sequence '|55 AA|' (which corresponds to the MBR signature) within the first 512 bytes and has a total size greater than 500 bytes. This pattern is indicative of malicious software attempting to modify the MBR for persistence or system control.
This rule detects potential JavaScript obfuscation within HTTP responses by looking for the presence of both 'eval(' and 'unescape(' within the first 500 bytes of file data in a client-bound HTTP flow. This combination of functions is often used in malicious JavaScript to hide its true intent and evade detection.
This rule detects attempts to modify the 'Run' key in the Windows Registry remotely over SMB (port 445). The 'Run' key is a common persistence mechanism used by attackers to ensure their malicious code executes every time a user logs in. The rule specifically looks for network traffic on port 445 containing the string 'SOFTWARE\Microsoft\Windows\CurrentVersion\Run', indicating a potential remote registry modification related to startup programs.
Page 249 of 312