Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,217 detections
Filters
Last updated
All Time
Detection languages
714
206
154
38
26
Contributors
191
190
181
159
113
Categories
420
398
389
334
167
Platforms
838
349
199
85
56
Products / Services
10,680
9,761
6,694
4,418
3,744
1,217
MITRE Techniques
424
365
352
279
258
CVEs
16
12
11
10
8
IDS Classtypes
18
2
2
1
1
IDS Protocols
25
This rule detects a high volume of web requests (20 or more within 5 minutes from a single IP address) containing keywords commonly associated with denial-of-service (DoS) attacks, performance testing, or reconnaissance activities against web applications. Keywords include 'sleep', 'benchmark', and 'loadtest' in the URI query string.
This rule detects an unusually high number of web search queries (identified by 'search' or 'query' in the URI) originating from a single IP address within a one-hour window. A threshold of 100 or more queries triggers the alert. This behavior could indicate automated activity such as web scraping, reconnaissance, or a denial-of-service attempt against the search functionality.
This rule detects attempts to write or modify cron persistence entries via HTTP. Specifically, it looks for HTTP client body content containing the string "/etc/cron" (case-insensitive). This indicates a potential attacker trying to establish persistence on a Linux system by scheduling malicious tasks.
Identifies web server processes dropping PHP files. This is a strong indicator of web shell persistence following a successful PHP object injection or remote code execution attack in WordPress environments.
This rule detects the upload of a malicious executable file (identified by the 'MZ' header) to a SharePoint server via the REST API endpoint for folder manipulation. Specifically, it looks for HTTP POST requests to URIs containing '/_api/web/getfolderbyserverrelativeurl' with file data that starts with 'MZ'. This indicates an attempt to upload an executable file, potentially for lateral movement or further compromise within a SharePoint environment.
This rule detects potential bulk downloads from SharePoint document libraries. It triggers when a client makes 30 or more HTTP requests to a SharePoint API endpoint related to web lists ('/_api/web/lists') within a 60-second window. This behavior can indicate an attempt to exfiltrate a large amount of data from SharePoint.
This rule detects attempts to query the list of installed AntiVirus (AV) and Endpoint Detection and Response (EDR) products via a web shell. It specifically looks for HTTP requests containing 'wmic' and 'AntiVirus' in the URI, indicating an attempt to use Windows Management Instrumentation Command-line (WMIC) to enumerate security software.
This rule detects a high volume (50 or more) of HTTP errors (status codes 400 and above) originating from a single client IP address within a 5-minute time window. This behavior can be indicative of various malicious activities such as brute-force attacks, web application vulnerability scanning, or denial-of-service attempts against a web server.
This rule detects attempts to upload malicious web server modules, plugins, or components. It specifically looks for HTTP PUT requests to URIs containing '/modules/', '/plugins/', or '/components/' and checks the file data for the 'MZ' header, indicating an executable file (likely a Windows executable or DLL). This combination suggests an attacker is trying to upload a malicious executable to a web server's module/plugin directory for persistence or further compromise.
Detects attempts to bypass the UniFi OS authentication gateway by exploiting a path traversal vulnerability. The rule looks for requests to the '/api/auth/validate-sso/' endpoint containing URL-encoded path traversal sequences like '..%2f' or '..%2e'. This indicates an attacker is trying to access internal resources or bypass authentication mechanisms.
Detects the anomalous download or extraction of the Bun JavaScript runtime. The Miasma worm downloads Bun during npm/node-gyp installation phases to execute its payloads outside of standard Node.js monitoring, evading detection.
IIS Native Module Upload Attempt
Suricata
This rule detects attempts to upload a DLL file to an 'modules' directory on an IIS web server using an HTTP PUT request. This activity is indicative of an adversary attempting to establish persistence by installing a malicious IIS native module.
This rule detects network connections where the User-Agent or RequestClientApplication header contains "NSIS_InetLoad". This string is often associated with Nullsoft Scriptable Install System (NSIS) installers, which can be used by legitimate software but also by malware to download additional components or communicate with command and control servers. The rule specifically looks for at least 3 such connections from the same source to the same destination within the aggregated timeframe, while excluding connections to Microsoft domains to reduce false positives.
This rule detects potential file inclusion attempts by monitoring IIS web server logs for URI queries containing keywords like 'file=', 'path=', or 'input='. It then aggregates these attempts by client IP address over one-hour intervals and alerts if 10 or more such attempts are observed from a single IP within that timeframe, indicating a possible attack.
This rule detects attempts to access sensitive configuration or backup files on an IIS web server. It looks for requests where the URI stem contains keywords like '.env', 'config', or 'backup', which are commonly associated with files that may contain sensitive information.
This rule detects potential brute force or enumeration attempts against an IIS web server by identifying a high volume of access denied (HTTP 401 or 403) responses from a single IP address within a one-hour window. A count of 20 or more such responses from the same IP is considered suspicious.
This rule detects potential XML External Entity (XXE) injection attempts by looking for specific XML-related keywords ('<?xml' or 'DOCTYPE') within the URI query string of IIS web server logs. It triggers an alert if three or more such attempts are observed from the same IP address within a one-hour window, indicating a possible automated scanning or attack.
Detects an unusually high volume (100 or more within an hour) of API calls (POST, DELETE, PUT methods to URIs containing 'api') originating from a single IP address. This activity could indicate various malicious behaviors such as brute-force attacks, credential stuffing, web application attacks, or a denial-of-service attempt against the API endpoint.
This rule detects a high volume of POST requests to login, authentication, or password-related URI stems within a 5-minute window from unique IP addresses. This behavior is indicative of brute-force attacks or credential stuffing attempts against web applications.
This rule identifies a high volume of HTTP 5xx errors (server-side errors) within a 5-minute interval from IIS logs. A count of 10 or more errors within this timeframe could indicate a web server under attack, a denial-of-service condition, or a critical application failure.
This rule detects potential path traversal attempts against an IIS web server by looking for sequences like '../' or '..\\' in the URI query string. It triggers an alert if five or more such attempts are observed from a single IP address within an hour, indicating a possible malicious scanning or exploitation attempt.
Page 33 of 58