Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,309 detections
Filters
Last updated
All Time
Detection languages
2,251
27
22
7
2
Contributors
910
584
506
125
48
Categories
20,443
11,831
5,875
5,151
4,864
2,309
Platforms
2,196
209
169
62
61
Products / Services
2,253
2,159
165
32
31
MITRE Techniques
713
422
390
187
184
CVEs
17
12
12
12
10
IDS Classtypes
995
426
281
190
98
IDS Protocols
1,291
401
281
117
45
Detects incoming HTTP traffic targeting Apache Struts servers, attempting to exploit CVE-2017-5638 by injecting malicious OGNL (Object-Graph Navigation Language) expressions within the 'Content-Type' header.
Detects repeated SSH connection attempts to a server over a short duration (10+ attempts in 60 seconds), which is characteristic of credential stuffing or brute-force password guessing attacks against the SSH service.
Detects HTTP POST requests characteristic of Emotet Epoch 4 and 5 C2 communication. The rule monitors for specific URI patterns, the presence of a 'Cookie' header, and a base64-encoded request body exceeding 80 characters, which are indicative of Emotet malware beaconing activity.
Detects TLS/SSL traffic patterns characteristic of Metasploit Meterpreter reverse HTTPS command-and-control communication, specifically targeting the use of default, self-signed certificates with a subject line containing a bare wildcard (CN=*) in the common name field, a common artifact of unconfigured Metasploit payloads.
Detects the initial handshake communication pattern associated with AsyncRAT, characterized by a specific base64-encoded configuration blob sent to external non-standard ports (6606, 7707, 8808) as identified by the Snort rule logic.
Detects common SQL injection patterns within the HTTP URI query string. The rule monitors established network traffic to web servers and uses regex matching to identify attempts to use SQL keywords like UNION SELECT, OR 1=1 boolean-based attacks, blind SQL injection techniques (sleep/benchmark), and attempts to access information_schema metadata tables.
Detects multiple TCP connection attempts to port 22 (SSH) from the same source within a 60-second window, which is indicative of a brute-force or password guessing attack against SSH services.
Detects common XSS attack patterns within HTTP URI requests, specifically monitoring for script tags or event handler attributes such as 'onerror' and 'onload' which are used to execute malicious JavaScript in a user's browser.
This rule monitors for FTP 'STOR' commands followed by large data transfers (exceeding 64KB) initiated from internal hosts to external destinations. This pattern is often indicative of data exfiltration using the File Transfer Protocol (FTP).
Detects outbound HTTPS traffic containing TLS certificates with common names associated with known command-and-control (C2) frameworks like Metasploit and Empire. These frameworks often use self-signed certificates with default or easily identifiable issuer names when establishing C2 communication.
This rule detects attempts to exploit the Log4Shell vulnerability (CVE-2021-44228) by monitoring HTTP headers (User-Agent, X-Forwarded-For, Referer) for JNDI lookup strings. The JNDI lookup mechanism in vulnerable Log4j libraries allows an attacker to execute arbitrary code by pointing the lookup to a malicious LDAP, RMI, or DNS server.
This rule detects ICMP Echo Request (type 8) packets with an unusually large payload (greater than 64 bytes). Such anomalies often indicate that an adversary is using ICMP as a covert channel for command-and-control (C2) communications or data exfiltration, by embedding arbitrary data within the ICMP payload fields.
Detects network traffic associated with PsExec lateral movement activity, specifically looking for the creation of the PSEXESVC named pipe over SMB/ADMIN$ shares, which is commonly used by PsExec to remotely execute services and commands on target systems.
Detects ICMP Type 8 (Echo Request) packets with a payload size exceeding 1000 bytes. This is a common indicator of ICMP tunneling, where attackers encapsulate data within ICMP packets to bypass network security controls for command and control or data exfiltration.
Detects outbound HTTPS traffic on high ports where the TLS SNI header consists of a 8-20 character random alphanumeric string. This pattern is indicative of default configurations for Metasploit Meterpreter Reverse HTTPS payloads attempting to establish a Command and Control connection.
Detects HTTP requests containing directory traversal patterns (e.g., ../, %2e%2e/) combined with attempts to access sensitive system files like /etc/passwd, shadow files, or Windows system configuration files (boot.ini, win.ini).
This rule detects attempts to inject malicious JavaScript code via HTTP URI requests. It uses PCRE pattern matching to identify common XSS indicators such as <script> tags, JavaScript event handlers (onerror, onload), and attempts to access document.cookie, which are indicative of stored or reflected Cross-Site Scripting (XSS) attack patterns.
This rule detects large HTTP POST requests (greater than 10MB) originating from the internal network to external destinations, which may indicate bulk data exfiltration.
Detects network traffic associated with PsExec lateral movement activity, specifically looking for the creation of the PSEXESVC named pipe over SMB/ADMIN$ shares, which is commonly used by PsExec to remotely execute services and commands on target systems.
Detects ICMP Type 8 (Echo Request) packets with a payload size exceeding 1000 bytes. This is a common indicator of ICMP tunneling, where attackers encapsulate data within ICMP packets to bypass network security controls for command and control or data exfiltration.
Detects multiple failed SSH authentication attempts originating from a single source IP within a short timeframe, which is indicative of a brute-force or credential-stuffing attack against SSH services.
Page 97 of 110