Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,309 detections
Filters
Last updated
All Time
Detection languages
2,251
27
22
7
2
Contributors
910
584
506
125
48
Categories
20,456
11,839
5,876
5,155
4,865
2,309
Platforms
2,196
209
169
62
61
Products / Services
2,253
2,159
165
32
31
MITRE Techniques
713
422
390
187
184
CVEs
17
12
12
12
10
IDS Classtypes
995
426
281
190
98
IDS Protocols
1,291
401
281
117
45
Detects high-volume activity (BLOCK or COUNT actions) from the AWS Shield Advanced managed DDoS protection rule set within a 1-minute time window. The rule alerts on potential Layer 7 DDoS attacks by monitoring for significant spikes in event volume or the number of unique source IP addresses targeting a specific AWS WAF Web ACL.
Detects attempts to exploit the GitLab commits API via path traversal or direct file path manipulation to access sensitive configuration files or system secrets, such as gitlab-secrets.json, database.yml, or system files like /etc/passwd.
Detects the specific TCP handshake pattern characteristic of the Fast Reverse Proxy (FRP) client (frpc) initiating a connection to a command-and-control server. The rule inspects established traffic for specific metadata strings ('privilege_key', 'run_id', 'pool_count') within the initial handshake payload.
Detects anomalous sequential SMB scanning patterns across a /24 subnet and subsequent SMB share enumeration attempts (NetShareEnum) from a single host, consistent with reconnaissance activities associated with the DragonForce threat actor group.
Detects network traffic containing a specific 4-byte sequence ('13 12 11 09') identified as the initial handshake packet for the SparroWocky malware's reverse port-mapping server component.
Detects HTTP connections between internal hosts and suspected C2 infrastructure associated with the Operation SilkParasite campaign. The rule specifically monitors for connections to known malicious IPs and identifies the retrieval of a cloned RTX Corporation homepage content, which acts as a decoy for the SpiceRAT malware.
Detects network traffic to the domain 'trace-flow.ru', which is associated with the 'Max Messenger' malware's concealed telemetry and C2 channel. The rules monitor for TLS connections to this domain, including instances where the certificate subject contains 'VK LLC' and 'Moscow'.
Detects network communication to identified SpiceRAT Command and Control (C2) infrastructure over TCP port 443. This includes monitoring for standard TCP connections and TLS sessions to known malicious IP addresses.
This rule monitors for DNS queries and TLS certificate attributes associated with the SilkParasite threat actor. The rule specifically targets domains that impersonate Central Asian government entities and monitors for suspicious TLS certificate issuers and subjects, indicating potential C2 infrastructure or phishing activity.
Detects network communication associated with the SilkParasite campaign. This includes detection of TLS traffic using self-signed LokiDev certificates (CN=localhost, O=LokiDev), direct connections to known malicious C2 IP addresses, and DNS queries for the domain normativ.dushanbeidc.org, which is linked to the LokiDev infrastructure.
Detects network communication associated with the SilkParasite campaign, specifically identifying TLS traffic using fraudulent certificates impersonating the Uzbekistan railway authority (azure.uzrailwaystax.com) and connections to identified malicious infrastructure using specific JA4X TLS fingerprinting.
Detects outbound RDP-over-TLS connections using non-standard high-numbered ports (64350, 64330, 65535, 65111, 61256), characteristic of SilkParasite command and control infrastructure. The rules trigger on known C2 IP addresses and general suspicious RDP behavior on these specific ports.
Detects high-frequency TCP connection attempts to port 37777, commonly associated with Dahua surveillance devices. The rule uses a threshold of 200 connection attempts within 60 seconds from a single source, which is characteristic of mass-scanning or brute-force activity.
Detects network communication to known SpiceRAT Command and Control (C2) IP addresses and DNS queries for known SpiceRAT-related domains. The rule identifies potential compromise by flagging outbound traffic or DNS resolutions associated with SpiceRAT infrastructure.
Detects high-frequency login attempts directed at the Dahua Easy4IP SDK port 37777, consistent with automated brute-force toolkits like async_brute.py. The rule monitors for a specific packet sequence indicating authentication attempts within a short timeframe.
Detects network traffic attempting to impersonate the Uzbekistan railway authority via suspicious TLS certificates. The rules identify specific SNI domains, certificate subjects, and issuers associated with the 'SilkParasite' campaign, which uses Chinese state-affiliated certificate authorities to facilitate C2 communications.
Detects RDP-over-TLS/NLA traffic occurring over non-standard high ports, which is often indicative of C2 communication or lateral movement associated with the SilkParasite infrastructure cluster.
Detects outbound network traffic from internal hosts to known IP addresses associated with the SpiceRAT malware command and control infrastructure.
Detects high-frequency TCP SYN scanning activity targeting port 37777, commonly associated with the discovery of vulnerable Dahua DVR and NVR devices.
Detects network traffic attempting to exploit CVE-2021-33044 in Dahua NetKeyboard devices. The rule identifies specifically crafted 'global.login' requests designed to bypass authentication mechanisms.
Detects high-concurrency brute-force attempts against Dahua Easy4IP-enabled devices targeting port 37777, identified by specific binary patterns (opcode 0xA0) in the packet payload. This indicates an automated attempt to compromise device authentication.
Page 45 of 110