Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,309 detections
Filters
Last updated
All Time
Detection languages
2,251
27
22
7
2
Contributors
910
584
506
125
48
Categories
20,443
11,831
5,875
5,151
4,864
2,309
Platforms
2,196
209
169
62
61
Products / Services
2,253
2,159
165
32
31
MITRE Techniques
713
422
390
187
184
CVEs
17
12
12
12
10
IDS Classtypes
995
426
281
190
98
IDS Protocols
1,291
401
281
117
45
This rule detects potential bandwidth hijacking activity associated with peer-to-peer botnet traffic. It triggers an alert when a high volume of TCP traffic (more than 200 packets within 60 seconds) with a packet size greater than 1000 bytes is observed originating from the home network to any destination. The 'flow:to_server,established' indicates that the rule is looking for established connections where the traffic is flowing from the internal network to an external server. The 'threshold' keyword ensures that only sustained high-volume traffic triggers the alert, reducing noise from legitimate, short bursts of activity. The 'classtype:policy-violation' suggests that this activity is considered a violation of network usage policies.
This rule detects NTP Reflection Amplification DDoS attacks by looking for specific content in UDP packets destined for the home network on port 123 (NTP). The rule triggers if 50 such packets are observed from the same destination within 5 seconds, indicating a high volume of NTP traffic potentially used for amplification.
This rule detects a potential HTTP POST flood Distributed Denial of Service (DDoS) attack. It triggers an alert when a single source IP address sends 100 or more HTTP POST requests to the server within a 10-second window. This behavior is indicative of an attempt to overwhelm the server with requests, consuming resources and potentially leading to service disruption.
This rule detects a potential DNS Reflection Amplification Distributed Denial of Service (DDoS) attack. It triggers an alert when UDP traffic targeting port 53 (DNS) on the home network has a data size greater than 512 bytes and occurs at a rate of 100 or more packets within a 5-second window from the same destination.
This rule detects a direct ICMP Flood Denial of Service (DoS) attack. It triggers when more than 500 ICMP echo request (type 8) packets are sent to a single destination within a 5-second interval. This high volume of ICMP traffic is characteristic of an attempt to overwhelm a target system or network with ping requests, leading to service disruption.
This rule detects network traffic on TCP port 445 (SMB) containing the strings "Winlogon" and "Userinit" (case-insensitive). This pattern is indicative of a potential modification to the Winlogon Helper DLL for persistence, as Winlogon and Userinit are key components in the Windows logon process. An attacker might modify a helper DLL to execute malicious code during system startup.
Direct TCP SYN Flood DoS Attack
Suricata
This rule detects a direct TCP SYN flood Denial of Service (DoS) attack. It triggers when a destination IP address receives 1000 or more TCP SYN packets within a 5-second window. The 'flags:S' indicates that only packets with the SYN flag set are counted. This type of attack aims to exhaust the target's resources by initiating many half-open connections.
This rule detects potential SMB Relay attacks attempting to capture NTLM hashes. It specifically looks for TCP traffic on port 445 (SMB) directed to the home network, where the flow is established and contains both "NTLMSSP" and "NTLMSSP_AUTH" content. A threshold of 3 occurrences within 30 seconds from the same source IP is set to reduce false positives.
This rule detects a direct User Datagram Protocol (UDP) flood Denial of Service (DoS) attack. It triggers an alert if more than 1000 UDP packets are observed targeting a single destination within a 5-second window. This high volume of UDP traffic is indicative of an attempt to overwhelm a target system or network resource, making it unavailable to legitimate users.
This rule detects a high volume of UDP traffic on port 4500 to the home network, which is commonly used for IPSec NAT Traversal. The rule is specifically looking for an 'evasion' scenario, implying that this traffic pattern might be indicative of an attempt to bypass security controls or blend in with legitimate IPSec traffic. The threshold of 10 connections from the same source within 30 seconds suggests an attempt to identify sustained or repeated activity rather than a single, isolated event.
This rule detects NAT traversal attempts using GRE (Generic Routing Encapsulation) protocol. It specifically looks for IP packets with protocol number 47 (GRE) and triggers an alert if 5 such packets are observed from the same source IP within a 30-second window. This could indicate an attempt to bypass network address translation or firewalls.
This rule detects HTTP POST requests to a web server where the URI contains both 'plugin' and 'install' (case-insensitive). This combination of keywords in a POST request URI could indicate an attempt to install a malicious plugin on a web application.
This rule detects cryptomining activity by identifying the Stratum protocol's 'mining.subscribe' message over TCP port 3333. The Stratum protocol is commonly used by cryptocurrency miners to communicate with mining pools. Detection of this specific message indicates an attempt to initiate or participate in cryptomining operations, potentially on a compromised system.
This rule detects a TCP connection flood, specifically looking for a high rate of TCP SYN packets (indicated by the 'flags:S' keyword) directed towards a single destination IP address within a short timeframe. A threshold of 500 SYN packets within 5 seconds to the same destination triggers the alert. This behavior is characteristic of a Denial of Service (DoS) attack, aiming to exhaust the target's resources by overwhelming it with connection requests.
This rule detects network traffic on TCP port 445 (SMB) containing the case-insensitive string "Print Processors". This pattern is indicative of an attempt to register a malicious Print Processor DLL for persistence, a technique used by adversaries to maintain access to a system. The rule specifically looks for traffic flowing to the home network, suggesting an inbound attempt to establish persistence.
This rule detects potential rogue DHCP servers on a wireless segment by looking for UDP traffic on port 67 (DHCP server port) with a specific DHCP message type (likely a DHCP offer or acknowledgement, indicated by '|02|' at offset 0). It uses a thresholding mechanism to trigger an alert if 3 such packets are observed from the same source within 10 seconds, which helps to reduce false positives from single, isolated packets.
This rule detects NTP amplification DDoS attacks by looking for UDP traffic on port 123 (NTP) with a specific content signature ('|17 00 03 2a|') and a high threshold of 50 packets within 5 seconds from the same destination. This pattern is indicative of an NTP monlist request, which can be abused for amplification attacks.
This rule detects an ICMP flood Denial of Service (DoS) attack. It triggers an alert when more than 200 ICMP echo request (type 8) packets are observed targeting a single destination within a 5-second window. This high volume of ICMP traffic is indicative of an attempt to overwhelm a target system or network, leading to service disruption.
This rule detects the presence of a TLS Callback Injection payload in HTTP traffic flowing from the server to the client. It specifically looks for the case-insensitive strings "TlsCallback" and "IMAGE_TLS_DIRECTORY" within the file data of the HTTP response. This technique is often used by malware to achieve code injection and execution.
Dual-Use Hacking Tool Download
Suricata
This rule detects the download of dual-use hacking tools by inspecting HTTP URI paths for keywords like 'nmap', 'metasploit', 'cobaltstrike', 'empire', 'covenant', and 'sliver'. It specifically looks for these keywords in a case-insensitive manner within the HTTP URI, indicating a potential attempt to download tools that can be used for both legitimate security testing and malicious activities.
This rule detects HTTP responses that contain specific keywords indicative of a fake CAPTCHA paste attack page. It looks for the terms "CAPTCHA", "paste", and "Win+R" (case-insensitive) within the HTTP response body. This combination suggests a social engineering attempt where users are tricked into pasting malicious content, often after being instructed to open the 'Run' dialog (Win+R).
Page 107 of 110