Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,230 detections
Filters
Last updated
All Time
Detection languages
2,175
1,018
354
260
212
Contributors
1,013
818
688
574
212
Categories
20,456
11,839
5,876
5,155
4,865
4,230
Platforms
2,933
889
585
248
198
Products / Services
2,239
1,453
841
416
344
MITRE Techniques
1,164
1,087
870
798
439
CVEs
22
20
20
18
17
IDS Classtypes
927
408
222
146
104
IDS Protocols
1,914
105
70
47
6
This rule detects the exfiltration of a custom XOR-compressed archive over HTTP. It specifically looks for HTTP POST requests originating from the home network, containing file data, with a payload size greater than 10000 bytes, and a PCRE match for a sequence of at least 200 non-ASCII or control characters, which is indicative of XOR-compressed binary data.
This rule detects when a user downloads a large amount of Slack message history via the Slack API. It specifically looks for HTTP requests to 'slack.com' with the URI '/conversations.history' and triggers an alert if 20 such requests are observed from the same source IP within a 60-second window. This behavior could indicate an attempt to exfiltrate sensitive communication data.
This rule detects the exfiltration of browser bookmarks over HTTP POST requests. It specifically looks for HTTP POST requests where the client body contains the string "Bookmarks" (case-insensitive) and the data size is greater than 500 bytes. This pattern is indicative of an attacker or malware attempting to steal a user's browser bookmarks.
This rule detects HTTP requests to the Kubernetes API endpoint '/api/v1/pods' on port 8080. This activity is indicative of an attempt to discover Kubernetes pods and services, which could be part of reconnaissance by an attacker or an authorized user.
This rule detects attempts to submit a Dockerfile containing 'FROM' and 'RUN' instructions to the Docker API via an HTTP POST request to the '/build' endpoint. This activity could indicate an attacker attempting to build a malicious Docker image on a compromised Docker host.
Detects processes making network requests to the '/api/css.js' endpoint, which is indicative of the ErrTraffic malware.
This rule detects HTTP requests that contain both 'otp' and 'verify' in the URI, which is indicative of a phishing page designed to capture One-Time Passwords (OTP) or Multi-Factor Authentication (MFA) codes. The rule is specifically looking for patterns associated with reverse proxy phishing techniques.
This rule detects potential exfiltration of password manager database files over HTTP. It specifically looks for HTTP POST requests with a URI containing common password manager names (keepass, lastpass, 1password, bitwarden) and a data size greater than 1000 bytes. This combination suggests a large file, potentially a database, is being uploaded.
This rule detects attempts to harvest Slack messages for credential tokens by monitoring HTTP requests to slack.com with the URI '/conversations.history'. A threshold of 20 such requests within 60 seconds from the same source IP triggers the alert, indicating potential automated data exfiltration or reconnaissance.
This rule detects the submission of a Golden SAML attack token to a service. It specifically looks for HTTP POST requests where the URI contains 'saml', the client body contains 'Assertion', and the body size is greater than 2000 bytes. This combination of indicators suggests an attempt to authenticate using a forged SAML assertion.
This rule detects the use of a forged SAML token for identity federation bypass. It specifically looks for HTTP POST requests (flow:to_server,established; http.client_body;) containing the string "SAMLResponse" (content:"SAMLResponse"; nocase;) and a long base64-encoded string (pcre:"/[A-Za-z0-9+\/]{500,}={0,2}/";) within the client body. The presence of a large base64 string in conjunction with "SAMLResponse" suggests a potentially malicious SAML assertion being submitted.
This rule detects attempts to upload potentially malicious script or executable files to GitHub's API. It specifically looks for HTTP POST requests to 'api.github.com' with a URI containing '/contents/' and file data matching common executable or script file extensions such as '.exe', '.dll', '.ps1', '.vbs', '.bat', or '.hta'. This activity could indicate an attacker attempting to stage malicious code in a code repository.
This rule detects a high volume of HTTP/2 requests (more than 3000 per minute) originating from a single remote IP address, especially when these requests target a diverse set of URIs (more than 10 distinct URIs). This pattern can indicate a denial-of-service (DoS) attack, a web scanner, or other malicious automated activity attempting to overwhelm a service or enumerate resources.
Detects network connections to specific API endpoints used by the HarborWatch Agent for Command and Control (C2) communication. This rule helps identify active C2 beaconing and tasking, even if the underlying IP infrastructure changes, by monitoring for unique URI paths like '/api/agent/tasks/' and '/api/heartbeat'.
This rule detects potential session hijacking or replay attacks where a stolen MFA (Multi-Factor Authentication) session cookie is replayed from a new IP address. It specifically looks for HTTP traffic containing 'auth', 'session', or 'mfa' in the cookie header. A threshold of 5 occurrences within 5 seconds, tracked by destination IP, is used to trigger the alert, indicating suspicious activity.
This rule detects HTTP traffic to JetBrains Remote IDE tunnel domains (jetbrains.space or gateway.jetbrains.com). This activity is flagged as potential Command and Control (C2) communication, specifically leveraging remote access software for malicious purposes. A threshold of 10 connections within 60 seconds from a single source IP is set to reduce alerts on legitimate, less frequent usage.
This rule detects the use of the Slack API for potential bidirectional command and control (C2) communication. Specifically, it looks for HTTP traffic to 'slack.com' that includes the '/api/chat.postMessage' URI. A threshold of 10 occurrences within 60 seconds from the same source IP is set to reduce false positives, indicating a high frequency of message posting activity which could be indicative of automated C2.
Detects HTTP application-layer flood attacks for denial of service impact
Detects users clicking malicious links that result in malware payload downloads
This rule detects attempts to create new accounts on major cloud platforms (AWS, Azure, Google Cloud) by monitoring HTTP traffic for specific hostnames and the 'signup' keyword in the URI. It specifically looks for connections to 'aws.amazon.com', 'portal.azure.com', or 'console.cloud.google' with 'signup' in the URI, indicating a potential account creation activity.
This rule detects HTTP requests made to well-known AI service API endpoints (OpenAI, Anthropic, Google Generative Language) specifically targeting 'completions' functionality. It triggers an alert if a single source IP makes more than 30 such requests within a 60-second window, indicating potential automated or high-volume use of AI tools for content generation, which could be leveraged for attack content.
Page 142 of 202