Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,309 detections
Filters
Last updated
All Time
Detection languages
2,251
27
22
7
2
Contributors
910
584
506
125
48
Categories
20,443
11,831
5,875
5,151
4,864
2,309
Platforms
2,196
209
169
62
61
Products / Services
2,253
2,159
165
32
31
MITRE Techniques
713
422
390
187
184
CVEs
17
12
12
12
10
IDS Classtypes
995
426
281
190
98
IDS Protocols
1,291
401
281
117
45
This rule detects an HTTP flood application-layer Distributed Denial of Service (DDoS) attack. It triggers when a single source IP address sends 200 or more HTTP GET requests to a server within a 10-second window. This behavior is indicative of an attempt to overwhelm the application or server with a high volume of legitimate-looking HTTP requests.
This rule detects a DNS Amplification Distributed Denial of Service (DDoS) attack. It triggers an alert when UDP traffic destined for port 53 (DNS) on the home network has a data size greater than 512 bytes and exceeds a threshold of 100 packets within 5 seconds, tracked by destination IP address. This pattern is indicative of a DNS amplification attack where small queries result in large responses, overwhelming the target.
This rule detects potential DNS response spoofing or DNS hijacking attempts. It specifically looks for UDP traffic on port 53 (DNS) where a high number of responses (5 within 10 seconds) are observed for a given destination IP address, which could indicate an attacker attempting to inject malicious DNS responses.
This rule detects TCP network connections originating from the internal network ($HOME_NET) to any external destination on port 1337. The detection is specifically for the initial SYN packet of a TCP handshake (flags:S) and is categorized as 'trojan-activity'. Port 1337 is commonly associated with Remote Access Trojans (RATs) for Command and Control (C2) communications, aligning with MITRE ATT&CK technique T1219.
This rule detects an application layer HTTP POST flood, which is a type of Denial of Service (DoS) attack. It triggers when a single destination receives 200 or more HTTP POST requests within a 10-second window. This high volume of POST requests is indicative of an attempt to exhaust server resources or bandwidth.
This rule detects a denial-of-service attack characterized by a high volume of HTTP GET requests targeting a server within a short timeframe. Specifically, it triggers if a single destination IP address receives 500 or more HTTP GET requests within a 10-second window, indicating a potential HTTP request flood aimed at exhausting service resources.
This rule detects a CHARGEN Reflection Amplification Attack. It specifically looks for UDP traffic on port 19 (the CHARGEN service port) directed towards the home network. A threshold of 50 packets within 5 seconds, tracked by destination, is used to identify potential amplification attempts, indicating a denial-of-service attack.
This rule detects an 'Email Subscription Bomb' attack, where an attacker automates sign-ups to various services using a victim's email address. The goal is to flood the victim's inbox with confirmation emails, potentially causing a denial of service or distracting them from other malicious activities. The rule specifically looks for SMTP traffic to port 25 containing the phrase 'confirm your subscription' (case-insensitive) and triggers an alert if this content is seen 50 times within 60 seconds from the same destination IP address.
This rule detects network traffic on TCP port 445 (SMB) containing the string "DisableRealtimeMonitoring" (case-insensitive). This string is often associated with attempts to disable real-time monitoring features of security products, typically by modifying registry keys. The detection is focused on traffic flowing from any source to the home network, specifically to the SMB port, and only on established connections. This activity is indicative of an attacker attempting to evade detection by crippling security software.
This rule detects a mass account lockout pattern over LDAP. It triggers an alert if 20 or more LDAP requests containing the string "lockoutTime" are observed from a single destination IP address within a 60-second window. This behavior is indicative of an attacker attempting to lock out multiple user accounts, potentially as a denial-of-service attack or to facilitate other attacks like password spraying by preventing legitimate users from logging in.
This rule detects a TFTP (Trivial File Transfer Protocol) firmware upload attempt where the data size is greater than 10000 bytes. This could indicate an attempt to corrupt or replace the firmware on a device, potentially leading to denial of service or unauthorized control. The rule specifically looks for UDP traffic on port 69 (TFTP) with a specific content pattern and a large data size.
This rule detects potential network sniffing by identifying an unusual mix of network protocols originating from a single source IP address. Specifically, it triggers an alert if a source IP sends 10 or more packets within 60 seconds that are neither TCP (protocol 6), UDP (protocol 17), nor ICMP (protocol 1). This behavior could indicate an attacker using tools to capture raw network traffic, as these tools often process protocols beyond the common ones.
This rule detects a 'ListPlanting Injection' attack via the SendMessage API payload within HTTP traffic. It specifically looks for the strings 'LVM_SORTITEMS' and 'SendMessage' (case-insensitive) in the file data of an HTTP response flowing to the client. This type of injection is often associated with shellcode or code injection techniques.
This rule detects a sequence of TCP SYN packets with a zero data size, originating from any source to any destination within the home network. The detection is triggered when 5 such packets are observed from the same source within a 3-second window. This pattern is indicative of a 'Magic Packet Implant Activation Sequence', which could be used by an attacker for persistence or command and control.
This rule detects HTTP web requests that contain the string "cmd.exe" in the URI, indicating an attempt to execute a command shell via a web request. This is often associated with web application attacks where an attacker tries to leverage a vulnerability to run system commands.
This rule detects large HTTP POST requests originating from the internal network ($HOME_NET) to any external destination. It specifically looks for HTTP POST methods and a data size greater than 10,000 bytes. A detection filter is applied to track by source IP, triggering an alert if 20 such large POST requests are observed within a 60-second window. This behavior is indicative of potential data exfiltration over command and control (C2) channels, as large amounts of data are being sent out of the network.
This rule detects the string "DisableAntiSpyware" in HTTP response bodies. This string is often associated with commands or responses related to disabling security defenses, specifically anti-spyware features, which is a common tactic used by malware or attackers for defense evasion. The rule is designed to alert when such a command or response is delivered to a client within an established HTTP flow.
This rule detects the creation of an XDG Autostart entry on a Linux host by looking for network traffic containing the string "/etc/xdg/autostart/" in a TCP flow to the server on port 22. This directory is commonly used for persistence by malware to automatically execute at system startup.
This rule detects attempts to block defender access by holding a file or resource lock. Specifically, it looks for TCP traffic on port 445 (SMB) containing the string "LockFile" in a case-insensitive manner. A threshold of 10 occurrences within 10 seconds from the same source IP is set to trigger an alert, indicating potential malicious activity aimed at hindering security software.
This rule detects HTTP responses from a server to a client that contain specific keywords ('remote', 'support', 'download') within the file data, indicating a potential fake IT support page attempting to deliver a remote access tool. The rule also checks for a minimum file size to reduce false positives.
This rule detects web pages served to clients that contain characteristics commonly associated with tech support scams. Specifically, it looks for HTTP responses containing the words "call", "1-800", and "virus" (case-insensitive) in the file data. This combination of keywords suggests an attempt to trick users into calling a fake support number due to a fabricated "virus" infection.
Page 108 of 110