Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
6,537 detections
Filters
Last updated
All Time
Detection languages
3,970
998
598
428
233
Contributors
1,363
1,250
1,066
954
384
Categories
2,933
2,196
2,017
1,857
1,411
Platforms
39,936
7,266
6,537
3,866
3,647
Products / Services
4,107
2,418
1,587
270
254
MITRE Techniques
1,450
1,310
1,022
934
696
CVEs
46
46
33
18
12
IDS Classtypes
1,753
458
404
325
220
IDS Protocols
2,202
773
381
300
93
This rule detects attempts to access the AWS EC2 Instance Metadata Service (IMDS) by looking for HTTP requests containing the IP address '169.254.169.254' in the URI. This IP address is a well-known link-local address used by AWS instances to retrieve metadata. Such access attempts, especially when originating from an unexpected source or in an unusual context, can indicate a Server-Side Request Forgery (SSRF) vulnerability being exploited.
This rule detects attempts to disable the system firewall via HTTP traffic. It specifically looks for the 'netsh firewall disable' command within the HTTP flow, indicating a potential defense evasion tactic.
This rule detects attempts at Server-Side Template Injection (SSTI) by looking for specific patterns in HTTP URI requests. It triggers an alert if the URI contains sequences like `{{.*}}` or `${.*}`, which are commonly used in various template engines to inject and execute code.
This rule detects attempts to execute setuid binaries via a web shell by looking for the string "chmod+s" in HTTP URI requests. This indicates an attacker trying to set the SUID bit on a file, which is a common technique for privilege escalation on Linux/Unix systems.
This rule detects Wake-on-LAN (WoL) magic packets. WoL is a network standard that allows a computer to be turned on or woken up by a network message. While legitimate, adversaries can use WoL to activate compromised systems (implants) for command and control or other malicious activities, especially if the system was previously shut down to evade detection.
This rule detects Telnet login attempts using the default credential 'admin'. It specifically looks for the string 'admin' (case-insensitive) in Telnet traffic flowing to the server. A threshold of 5 attempts within 60 seconds from the same source IP triggers the alert, indicating a potential brute-force or credential stuffing attack against Telnet services.
This rule detects the download of a file that appears to be an Office document template designed for remote template injection. It specifically looks for HTTP responses containing the strings "[Content_Types].xml" and "attachedTemplate" (case-insensitive) within the file data, which are indicators of a malicious Office document attempting to load a remote template.
Remote AT Scheduled Job Creation
Suricata
This rule detects attempts to create scheduled jobs remotely using the 'atsvc' service, typically associated with the Windows Task Scheduler. It specifically looks for TCP traffic on port 445 (SMB) containing the string 'atsvc' in an established flow to the home network. This activity can be indicative of an adversary establishing persistence or executing code remotely.
This rule detects attempts to access browser profile files, specifically looking for 'AppData' and 'Bookmarks' content, on a network share via SMB. This could indicate an adversary attempting to discover sensitive user data.
MFA OTP Phishing Page Detected
Suricata
This rule detects potential MFA OTP phishing pages by inspecting HTTP URIs for the presence of both 'verify' and 'otp' keywords, case-insensitively. This combination in a URI is indicative of a page designed to trick users into submitting their One-Time Passwords (OTPs) for multi-factor authentication.
Havoc C2 Agent Beacon Detected
Suricata
This rule detects beaconing activity associated with the Havoc C2 agent. It specifically looks for HTTP POST requests to the '/login' URI, with a User-Agent header of 'Mozilla/5.0', and a data size between 101 and 499 bytes. A threshold of 10 such events within 60 seconds from the same source IP triggers the alert, indicating potential command and control communication.
This rule detects potential video stream exfiltration over HTTP POST. It specifically looks for HTTP POST requests with a large payload size (greater than 100,000 bytes) and the byte sequence '|52 49 46 46|' at the beginning of the file data, which corresponds to the 'RIFF' header commonly found in multimedia file formats like AVI and WAV. This combination suggests an attempt to upload or exfiltrate video or audio data.
This Suricata rule detects potential internal RDP session hijack attempts. It triggers an alert when there are three or more established TCP connections to port 3389 (RDP) on the home network, originating from within the home network, within a 30-second window, tracked by the destination IP address. This pattern could indicate an attacker attempting to take over an existing RDP session or rapidly establish multiple RDP connections internally.
This rule detects a bulk file copy pattern to a removable share over SMB (port 445). It triggers an alert if there are more than 200 SMB 'to_server' flows from a single source within a 60-second window, indicating a high volume of data transfer. This behavior is often associated with data exfiltration or large-scale data movement to external storage.
This rule detects potential data exfiltration to an AWS S3 bucket. It triggers on HTTP PUT requests to 's3.amazonaws.com' with a payload size greater than 10000 bytes. This could indicate an attacker uploading sensitive data from the internal network to an external S3 bucket they control.
WebDAV File Upload Exfiltration
Suricata
This rule detects potential WebDAV file upload exfiltration attempts by monitoring HTTP traffic for the 'PROPFIND' method. It uses a threshold of 10 occurrences within 60 seconds from the same source IP address to identify suspicious activity, indicating a possible attempt to enumerate or exfiltrate files via WebDAV.
This rule detects potential Secure File Transfer Protocol (SFTP) large file exfiltration attempts. It triggers an alert when a TCP connection on port 22 (SFTP) from the home network to any destination transfers a large amount of data (greater than 65000 bytes) to the server. A threshold of 20 such transfers within 60 seconds from the same source IP is set to reduce false positives. The rule specifically looks for the SFTP protocol magic bytes '|00 00 00|' within the first 4 bytes of the payload.
This rule detects large data exfiltration attempts over SMTP Submission (port 587). It triggers an alert if more than 50,000 bytes of data are sent from a single source IP address to a server via SMTP Submission, with a threshold of 5 such events within a 300-second window. This indicates a potential policy violation related to data exfiltration.
This rule detects large attachments being exfiltrated via SMTP. Specifically, it looks for SMTP traffic on port 25, flowing to the server, that contains the 'Content-Transfer-Encoding: base64' header and has a data size greater than 50,000 bytes. This combination suggests a large, base64-encoded file being sent as an email attachment, which could indicate data exfiltration.
This Suricata rule detects C2 port hopping behavior by identifying a single source IP initiating 10 or more TCP SYN packets to different non-standard ports within a 30-second window. This pattern is indicative of command and control (C2) communication attempting to evade detection by frequently changing ports.
This rule detects network reconnaissance activity by identifying HTTP user-agent strings commonly associated with vulnerability scanners like Nmap or Masscan. It specifically looks for the string 'Nmap' within the HTTP user-agent header in traffic flowing from the internal network to a server.
Page 250 of 312