Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,230 detections
Filters
Last updated
All Time
Detection languages
2,175
1,018
354
260
212
Contributors
1,013
818
688
574
212
Categories
20,456
11,839
5,876
5,155
4,865
4,230
Platforms
2,933
889
585
248
198
Products / Services
2,239
1,453
841
416
344
MITRE Techniques
1,164
1,087
870
798
439
CVEs
22
20
20
18
17
IDS Classtypes
927
408
222
146
104
IDS Protocols
1,914
105
70
47
6
This rule detects HTTP requests to known dedicated server rental providers (ovh.com, leaseweb.com, servermania.com) where the URI contains the word 'order'. This activity could indicate an adversary attempting to rent infrastructure for attack purposes, such as command and control servers, phishing sites, or other malicious operations.
This rule detects potential use of a compromised Virtual Private Server (VPS) as a proxy relay. It specifically looks for HTTP CONNECT requests, which are commonly used for tunneling traffic through a proxy. A threshold of 10 CONNECT requests within 60 seconds from a single source IP is set to identify suspicious activity, indicating a high volume of proxy usage.
This rule detects potential command and control (C2) communication originating from a compromised serverless function. It specifically looks for HTTP POST requests with a body size greater than 500 bytes, targeting domains associated with serverless platforms like Vercel (.vercel.app), Netlify (.netlify.app), and Cloudflare Pages (.pages.dev). A threshold of 10 such requests within 60 seconds from the same source IP triggers the alert, indicating a possible high-volume data exfiltration or C2 activity.
This rule detects a potential account takeover attempt via a credential stuffing attack. It specifically looks for HTTP POST requests to a URI containing 'login' (case-insensitive) from a single destination IP address, with a high frequency (50 requests within 60 seconds). This pattern suggests an automated attempt to try multiple credentials against a login endpoint.
This rule detects multiple login attempts to social media platforms (Twitter, X, Instagram, Facebook) from a single source IP address within a short timeframe. It specifically looks for HTTP POST requests to URIs containing 'login' on these domains. A threshold of 10 attempts within 30 seconds triggers the alert, indicating a potential brute-force or credential stuffing attack aimed at hijacking social media accounts.
This rule detects attempts to purchase code signing certificates by monitoring HTTP traffic for connections to known certificate authorities (Sectigo, Comodo, Digicert) and the presence of the term 'codesigning' in the URI. This could indicate an adversary attempting to acquire legitimate code signing certificates for malicious purposes, such as signing malware to evade detection.
This rule detects HTTP PUT requests to known remote file hosting services (transfer.sh, file.io, gofile.io, anonfiles). This activity is indicative of payload staging, where an attacker uploads malicious files or tools to a remote server for later use in an attack, often as part of the resource development phase of the attack lifecycle.
This rule detects attempts to upload executable files (specifically Windows MZ executables) to common cloud storage services like Amazon S3, Google Cloud Storage, and Azure Blob Storage. It looks for HTTP PUT requests containing the 'MZ' magic bytes at the beginning of the file data, indicating a Windows executable, with a file size greater than 100KB, directed towards known cloud storage domains.
This rule detects network traffic to known initial access broker (IAB) market domains. It specifically looks for HTTP requests where the host matches 'exploit.in', 'xss.is', 'raidforums', or 'breachforums' and the URI contains the word 'access'. This indicates potential activity related to purchasing or selling initial access to compromised systems.
This rule detects HTTP traffic where the client body contains the terms "rdp" and "buy" (case-insensitive). This combination suggests a potential attempt to purchase RDP access, possibly on an underground forum, which is a policy violation.
This rule detects suspicious access to domain registration services by monitoring HTTP traffic for requests to known domain registrars (namecheap.com, godaddy.com, porkbun.com) with a URI containing 'register'. A threshold of 5 such requests within 60 seconds from the same source IP triggers an alert, indicating potential resource development activity such as bulk domain registration.
This rule detects potential staff directory scraping by monitoring HTTP GET requests to URIs containing the word "staff". It triggers an alert if more than 20 such requests are observed from a single source IP within a 30-second window, indicating automated or rapid enumeration attempts.
This rule detects potential credential harvesting attempts by monitoring HTTP POST requests that contain both 'password' and 'email' in the client body. It specifically looks for these keywords in a case-insensitive manner within the HTTP client body and requires the body size to be greater than 50 bytes. This indicates a form submission likely containing sensitive user credentials.
Executive Team Page Enumeration
Suricata
This rule detects repeated HTTP requests to URIs containing the word "executive" (case-insensitive) from a single source IP address within a 30-second window. This behavior could indicate an attempt to enumerate executive team pages, potentially for reconnaissance purposes.
This rule detects potential executive leadership directory scraping attempts. It triggers an alert when a client makes 10 or more HTTP requests containing the word "leadership" (case-insensitive) in the URI within a 30-second window. This behavior could indicate an attacker attempting to gather information about key personnel for social engineering or other reconnaissance purposes.
This rule detects enumeration attempts of partner and vendor pages on a web server. It triggers when a client makes 20 or more HTTP requests containing the case-insensitive string "partner" in the URI within a 30-second window, indicating a potential reconnaissance activity to discover sensitive or specific sections of a website.
This rule detects HTTP requests to known BGP route lookup services (bgp.he.net, bgpview.io, ipwhois.io). This activity is often associated with reconnaissance, specifically IP block discovery, where an attacker or red team member is gathering information about an organization's network infrastructure.
Sitemap File Discovery Access
Suricata
This rule detects HTTP requests to URIs that contain both 'sitemap' and '.xml' (case-insensitive). This pattern is commonly associated with the discovery of sitemap files, which are used by search engines to crawl websites. Attackers or reconnaissance tools might access these files to map out a website's structure and discover hidden or unlinked pages, which can then be used for further attacks.
This rule detects potential Google Dorking activity targeting a specific site. It triggers when a client makes 10 or more HTTP requests within 60 seconds to 'google.com' where the URI contains 'site:'. This pattern is indicative of an attacker or reconnaissance tool using Google's search operators to find information about a target domain.
This rule detects HTTP requests to a web server that contain both 'firmware' and 'version' in the URI, case-insensitively. This pattern is often associated with attempts to access router firmware version information pages, which could be part of reconnaissance activities.
This rule detects attempts to enumerate hardware asset inventory information via web requests. It triggers when HTTP requests contain both 'asset' and 'inventory' in the URI, indicating a potential reconnaissance activity to gather information about an organization's hardware assets. A threshold of 10 such requests within 60 seconds from the same source IP is set to reduce false positives.
Page 161 of 202