Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,230 detections
Filters
Last updated
All Time
Detection languages
2,175
1,018
354
260
212
Contributors
1,013
818
688
574
212
Categories
20,456
11,839
5,876
5,155
4,865
4,230
Platforms
2,933
889
585
248
198
Products / Services
2,239
1,453
841
416
344
MITRE Techniques
1,164
1,087
870
798
439
CVEs
22
20
20
18
17
IDS Classtypes
927
408
222
146
104
IDS Protocols
1,914
105
70
47
6
This rule detects attempts to access sensitive credential-related files (e.g., configuration files, credential files, .env files, or files containing 'secret') via HTTP requests. This pattern is often associated with web shell activity where an attacker tries to exfiltrate sensitive information from a compromised web server.
This rule detects potential MFA bypass attempts using Evilginx by looking for HTTP POST requests to the server that contain both 'session' and 'token' in the URI, with a body size greater than 100 bytes. This pattern is indicative of session token capture, a technique used by Evilginx to bypass multi-factor authentication.
This rule detects suspicious activity related to Microsoft Teams chat messages being scraped for credentials. Specifically, it looks for HTTP requests to 'graph.microsoft.com' with URIs containing '/chats/' and '/messages'. A threshold of 20 such requests within 60 seconds from a single source IP triggers the alert, indicating potential automated data exfiltration or credential harvesting from Teams chats.
This rule detects attempts to abuse Active Directory Certificate Services (AD CS) by requesting certificates through the /certsrv/ interface. Specifically, it looks for HTTP requests containing both '/certsrv/' and 'request' in the URI, indicating a certificate enrollment request. The thresholding mechanism (5 requests from the same source within 60 seconds) aims to reduce false positives and highlight potentially automated or repeated attempts to exploit AD CS.
This rule detects a potential MFA SMS code request flooding attack. It triggers when a single source IP address makes 10 or more HTTP requests containing the string "send_code" in the URI within a 60-second window. This behavior is indicative of an attacker repeatedly attempting to request MFA codes, likely in an attempt to overwhelm the user or the system, or to facilitate a SIM-swapping attack.
This rule detects potential unauthorized access attempts using forged web credentials. It specifically looks for HTTP requests containing a cookie with a long, base64-like encoded string (100 or more characters) which could indicate a forged session token or credential. A threshold of 10 such occurrences within 5 seconds from the same destination IP address triggers the alert, suggesting a brute-force or automated credential stuffing attempt.
Detects compromised WordPress sites being used to relay C2 traffic
This rule detects potential information disclosure attempts by monitoring W3C IIS logs for repeated queries containing keywords like 'version', 'build', or 'debug'. A high frequency (5 or more attempts within an hour) from a single IP address suggests an adversary is trying to enumerate software versions or debug information, which can be used for further reconnaissance or exploit development.
This rule detects a high volume of web requests (20 or more within 5 minutes from a single IP address) containing keywords commonly associated with denial-of-service (DoS) attacks, performance testing, or reconnaissance activities against web applications. Keywords include 'sleep', 'benchmark', and 'loadtest' in the URI query string.
Detects compromised WordPress sites being used to relay C2 traffic
This rule detects an unusual number of HTTP OPTIONS or TRACE method requests from a single IP address within a one-hour window. While these methods have legitimate uses, their frequent or excessive use can indicate reconnaissance, vulnerability scanning, or attempts to bypass security controls. The rule triggers if 5 or more such requests are observed from the same IP within an hour.
Detects IP addresses generating a high volume of web requests to an IIS server where the referrer is external to the host. This can indicate web scraping, reconnaissance, or denial-of-service attempts.
This rule detects a high volume (50 or more) of HTTP errors (status codes 400 and above) originating from a single client IP address within a 5-minute time window. This behavior can be indicative of various malicious activities such as brute-force attacks, web application vulnerability scanning, or denial-of-service attempts against a web server.
This rule detects potential reconnaissance activity by identifying IP addresses that generate a high volume of HTTP requests with user agents indicating bots, crawlers, or scanners. It counts requests per IP address within one-hour bins and flags those with 50 or more such requests.
This rule detects a high volume of web requests (20 or more within 5 minutes from a single IP address) containing keywords commonly associated with denial-of-service (DoS) attacks, performance testing, or reconnaissance activities against web applications. Keywords include 'sleep', 'benchmark', and 'loadtest' in the URI query string.
This rule detects an unusually high number of web search queries (identified by 'search' or 'query' in the URI) originating from a single IP address within a one-hour window. A threshold of 100 or more queries triggers the alert. This behavior could indicate automated activity such as web scraping, reconnaissance, or a denial-of-service attempt against the search functionality.
This rule detects HTTP POST requests to a web server where the URI contains both 'plugin' and 'install' (case-insensitive). This combination of keywords in a POST request URI could indicate an attempt to install a malicious plugin on a web application.
This rule detects attempts to modify Identity Provider authentication settings within Microsoft Graph. Specifically, it looks for HTTP PATCH requests to the 'authentication' endpoint on 'graph.microsoft.com'. This activity could indicate an attacker attempting to alter authentication mechanisms, potentially for persistence or to facilitate further access.
Detects requests for a specific favicon image (`/img/ib99-hq.ico`) that is consistently used across all deployments of a threat actor's Next.js gambling kit. This kit is associated with the "Borrowed Trust" campaign. The rule identifies these requests in both endpoint network telemetry and perimeter proxy/firewall logs, indicating potential reconnaissance or active exploitation attempts targeting systems hosting this gambling kit.
This rule detects attempts to write or modify cron persistence entries via HTTP. Specifically, it looks for HTTP client body content containing the string "/etc/cron" (case-insensitive). This indicates a potential attacker trying to establish persistence on a Linux system by scheduling malicious tasks.
This rule detects HTTP POST requests to the Google Cloud Platform (GCP) Compute Engine API (compute.googleapis.com). It specifically looks for a high volume of these requests (20 within 10 seconds from the same source IP), which could indicate automated activity or potential command execution attempts within GCP. The rule is designed to identify suspicious interactions with the GCP API that might be related to execution tactics.
Page 144 of 202