Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,146 detections
Filters
Last updated
All Time
Detection languages
679
377
340
230
173
Contributors
630
378
354
143
119
Categories
835
831
746
387
348
Platforms
1,580
584
492
263
118
Products / Services
10,680
9,761
6,694
4,418
3,744
2,146
MITRE Techniques
655
561
377
331
286
CVEs
32
20
8
7
6
IDS Classtypes
65
32
23
19
14
IDS Protocols
47
38
30
30
12
This rule detects a suspicious sequence of events: a process launching with a low prevalence executable (meaning it's rarely seen in the environment) followed by that same process initiating an HTTP connection to a low prevalence domain (a domain rarely accessed in the environment) within a 10-minute window. This combination can indicate the execution of novel or custom malware attempting to establish command and control or exfiltrate data to an unusual destination.
This rule detects DNS queries for domains that contain a specific string (e.g., a company name) and are not registered with an approved domain registrar. It leverages WHOIS data to identify potentially malicious typosquatting domains that have been recently registered or observed. The rule specifically looks for DNS queries where the domain name matches a defined pattern (e.g., 'threatpunter') and the WHOIS information indicates a registrar other than the approved one ('MarkMonitor Inc.'). Additionally, it checks if the domain was first seen in the environment within the last 30 days, indicating a new or suspicious registration.
This rule identifies outbound network connections where the destination IP address is geo-located to a specific country, which is configured as 'France' in this instance. It can be adapted to monitor traffic to any country of interest. The rule itself does not specify malicious behavior but flags network communication to a particular geographic region. This could be indicative of potential data exfiltration, command and control (C2) communication, or unauthorized access attempts if the country is considered high-risk or unusual for the organization's normal operations.
Detects exploitation activity of CVE-2023-46747, an unauthenticated remote code execution vulnerability in F5 BIG-IP. The rule looks for specific POST requests to '/mgmt/tm/util/bash' containing keywords related to form submission and user creation within the F5 BIG-IP Traffic Management User Interface (TMUI).
Detects potential exploitation attempts of CVE-2023-4966, a Citrix ADC and NetScaler Gateway sensitive information disclosure vulnerability. The rule specifically looks for GET requests to '/oauth/idp/.well-known/openid-configuration' that result in a 200 HTTP status code, indicating a successful attempt to access this specific endpoint which is part of the vulnerability exploitation chain.
Detects exploitation activity targeting CVE-2023-46747, an unauthenticated remote code execution vulnerability in F5 BIG-IP. The rule specifically looks for POST requests to '/mgmt/tm/util/bash' containing hex-encoded or plain text strings related to '/tmui/Control/form' and 'form_page=%2ftmui%2fsystem%2fuser%2fcreate.jsp', which are indicators of the exploit attempting to create a new user.
Detects potential exploitation attempt of CVE-2023-4966, a Citrix ADC and NetScaler Gateway sensitive information disclosure vulnerability, via proxy logs. This vulnerability allows for the disclosure of sensitive information, such as session tokens.
Detects exploitation attempts of CVE-2023-4966, a Citrix ADC and NetScaler Gateway sensitive information disclosure vulnerability. The rule specifically looks for GET requests to '/oauth/idp/.well-known/openid-configuration' with an unusually long 'cs-host' header string, which is characteristic of the exploit.
Detects exploitation attempts of CVE-2023-4966, a Citrix ADC and NetScaler Gateway sensitive information disclosure vulnerability. The detection logic specifically looks for GET requests to '/oauth/idp/.well-known/openid-configuration' with an unusually long host header string (150 characters or more) in proxy logs. This pattern is indicative of the 'Citrix Bleed' exploit.
Detects GET requests to '/SetupWizard.aspx/[anythinghere]' that indicate exploitation of the ScreenConnect vulnerability CVE-2024-1709, which is an authentication bypass vulnerability.
Detects exploitation attempts of CVE-2023-22518 in Confluence Data Center and Confluence Server. This vulnerability allows an attacker to exploit specific endpoints to potentially create administrator accounts and execute arbitrary commands. The rule identifies POST requests to known vulnerable URIs associated with setup and restore actions, or server information, which are indicative of an exploitation attempt.
Detects exploitation attempts of CVE-2023-46214, a remote code execution (RCE) vulnerability in Splunk Enterprise. The rule specifically looks for patterns associated with known public proof-of-concept (POC) code that leverages insecure XML parsing. It identifies POST requests to specific Splunk API endpoints (`/splunkd/__upload/indexing/preview` or `/api/search/jobs/results`) with particular URI query parameters (`NO_BINARY_CHECK=1`, `input.path=shell.xsl`, `/opt/splunk/var/run/splunk/dispatch/`, `/shell.xsl`) that indicate an attempt to upload and execute a malicious XSL stylesheet.
Domain Prevalence
YARA-L
Detects DNS events querying domains that have a low rolling max prevalence.
Suspicious ASN
YARA-L
Identify network traffic based on a specific ASN
Detects suspicious user agent strings commonly used by exploit and penetration testing frameworks such as Metasploit, Cobalt Strike, Empire, and Havoc. These user agents often mimic legitimate browsers or applications but contain specific patterns that indicate their use by these tools. The rule is designed to identify command and control (C2) communication or initial access attempts originating from these frameworks by analyzing proxy logs.
Identify network traffic based on target country
Provides example usage of WHOIS data, detecting a DNS query for a domain that contains a specific string and is not registered with the defined domain registrar.
Detects potential Command and Control (C2) communication activity associated with the Peach Sandstorm APT group. The rule specifically looks for HTTP GET requests to '/api/Core/Command/Init' or '/api/Core/Command/Restart' endpoints, which are indicators of this group's C2 infrastructure.
Detects POST requests to the F5 BIG-IP iControl Rest API "bash" endpoint, which allows the execution of commands on the BIG-IP. This activity can indicate an attacker exploiting a public-facing application to gain initial access and execute arbitrary commands on the F5 BIG-IP device.
Detects exploitation attempts of CVE-2023-43261, an information disclosure vulnerability in Milesight UR5X, UR32L, UR32, UR35, UR41 routers before v35.3.0.7. Attackers can access sensitive router components, specifically the 'httpd.log' file, through proxy logs. This rule looks for GET requests to the '/lang/log/httpd.log' path with a successful HTTP status code (200).
Detects exploitation attempts of CVE-2023-43261, an information disclosure vulnerability in Milesight UR5X, UR32L, UR32, UR35, UR41 routers before v35.3.0.7. This vulnerability allows attackers to access sensitive router components by requesting the '/lang/log/httpd.log' file, which can contain passwords and other critical information.
Page 99 of 103