Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,230 detections
Filters
Last updated
All Time
Detection languages
2,175
1,018
354
260
212
Contributors
1,013
818
688
574
212
Categories
20,456
11,839
5,876
5,155
4,865
4,230
Platforms
2,933
889
585
248
198
Products / Services
2,239
1,453
841
416
344
MITRE Techniques
1,164
1,087
870
798
439
CVEs
22
20
20
18
17
IDS Classtypes
927
408
222
146
104
IDS Protocols
1,914
105
70
47
6
This rule detects potential sensitive data exfiltration to a web service. It triggers when an HTTP POST request is made from the home network to any destination, and the request body size is greater than 10,000 bytes. A threshold is applied, alerting if 10 such events occur from the same source IP within 60 seconds. This pattern suggests a large amount of data being uploaded, which could indicate exfiltration.
This rule detects HTTP POST requests from the home network to any external server where the request body size is greater than 10000 bytes. It uses a threshold to alert if 5 such events occur from the same source IP within an hour, indicating a potential cron-timed data upload or exfiltration attempt.
This rule detects attempts to deface a web server's homepage by replacing its content. It specifically looks for HTTP PUT requests targeting a URI containing "index" (case-insensitive), indicating an attempt to modify an index file. The rule also checks the size of the data being sent in the PUT request, looking for a size between 500 and 5000 bytes, which could indicate the insertion of defacement content.
This rule detects attempts to deface web server content by using an HTTP PUT request to modify files with extensions such as .html, .htm, .php, .asp, or .aspx. It specifically looks for HTTP PUT methods targeting these file types on an internal web server.
This rule detects attempts to set or modify an S3 bucket lifecycle policy for auto-deletion. It specifically looks for HTTP PUT requests to 's3.amazonaws.com' with a URI containing '?lifecycle'. This activity could indicate an attacker attempting to delete data after exfiltration or to destroy evidence.
This rule detects potential phishing attempts delivered via WhatsApp Business by monitoring HTTP traffic for connections to 'api.whatsapp.com' with 'message' in the URI. It specifically looks for a high volume (10 times in 60 seconds) of such connections from a single source, which could indicate an automated or widespread delivery of malicious links.
This rule detects potential command and control (C2) activity where an internal HTTP proxy port (8080) is used as a relay. Specifically, it looks for HTTP CONNECT requests, which are commonly used for tunneling through proxies, directed to port 8080 within the home network. A threshold of 10 such requests within 60 seconds from a single source IP triggers the alert, indicating suspicious proxy usage for C2 communication.
This rule detects C2 traffic that attempts to impersonate legitimate Microsoft Update services. It specifically looks for HTTP traffic where the host header contains 'windowsupdate.com' or 'update.microsoft.com' (case-insensitive) and the User-Agent header contains 'Windows-Update-Agent'. A threshold of 10 occurrences within 60 seconds from the same source IP triggers the alert, indicating potential command and control activity trying to blend in with normal Windows update traffic.
This rule detects a high volume of HTTP requests to GitHub's archive endpoint for repository cloning, specifically looking for 10 or more requests within 60 seconds from a single source IP. This behavior could indicate an attempt to collect data from multiple GitHub repositories, potentially for reconnaissance or data exfiltration purposes. The rule targets HTTP traffic where the host is 'github.com' and the URI contains '/archive/'.
This rule detects the upload of a potential screen recording file to a remote server over HTTP. It specifically looks for HTTP POST requests where the URI contains the string "video" (case-insensitive) and the file data contains the byte sequence "|00 00 00|" within the first 4 bytes, indicating a common video file header. Additionally, the file size must be greater than 500KB, which helps to filter out small, non-video files.
This rule detects the exfiltration of a webcam video stream over HTTP POST. It specifically looks for HTTP POST requests containing file data, where the data starts with the hexadecimal sequence '52 49 46 46' (which corresponds to 'RIFF', a common header for multimedia file formats like AVI and WAV) and has a size greater than 100,000 bytes. This combination suggests a large multimedia file, potentially a video, being uploaded.
This rule detects the creation of an email auto-forwarding rule within Microsoft Exchange via the Exchange Web Services (EWS) interface. It specifically looks for HTTP requests to the '/EWS/Exchange.asmx' endpoint containing the string 'ForwardToRecipients' in the client body, indicating an attempt to configure email forwarding.
This rule detects a high volume of HTTP requests to graph.microsoft.com with the URI containing '/messages', indicating a potential bulk download of emails from Office 365 via the Graph API. The threshold is set to 30 requests within 60 seconds from a single source IP.
This rule detects HTTP requests that contain both '7z' and '-p' in the URI, which could indicate the use of 7zip or WinRAR to archive data with a password, potentially for exfiltration. The rule specifically looks for these strings in the URI of an HTTP request flowing from the internal network to an external server.
This rule detects a high volume of HTTP GET requests to storage.googleapis.com, indicating a potential bulk download of objects from Google Cloud Storage. The threshold is set to 50 requests within 60 seconds from a single source IP address.
This rule detects potential bulk export of customer data from CRM applications like Salesforce, HubSpot, or Dynamics. It triggers when HTTP requests to these services contain 'export' in the URI, indicating a data export operation. A threshold of 5 such requests within 60 seconds from the same source IP is set to identify bulk activity.
This rule detects attempts to list active network connections using the 'netstat' command via a web shell. It specifically looks for HTTP requests where the URI contains the case-insensitive string 'netstat'. This activity is indicative of an attacker trying to gain reconnaissance on the compromised system's network connections.
This rule detects attempts to enumerate Wi-Fi network profiles by looking for the command 'netsh wlan show' within HTTP URI requests. This activity is often associated with web shell usage, where an attacker has gained remote access to a web server and is using it to gather information about the underlying system's network configuration.
This rule detects attempts by a client on the home network to check internet connectivity by querying external IP lookup services over HTTP. It specifically looks for requests to domains like api.ipify.org, ifconfig.me, checkip.amazonaws.com, and icanhazip.com. A threshold is set to trigger an alert if five such requests are observed from the same source within 30 seconds, indicating a potential network scan or reconnaissance activity.
This rule detects attempts to enumerate services on a system using the 'sc query' command, typically executed via a web shell. The detection is based on the presence of 'sc query' within the HTTP URI, indicating a command injection attempt through a web application.
This rule detects attempts to query the system time using the 'net time' command via a web shell. It specifically looks for the string 'net time' within the HTTP URI of traffic flowing to the server. This activity is indicative of an attacker using a web shell to gather information about the compromised system, specifically its time synchronization status or current time.
Page 151 of 202