Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,151 detections
Filters
Last updated
All Time
Detection languages
2,297
1,070
640
289
288
Contributors
918
814
769
696
224
Categories
20,445
11,833
5,875
5,151
4,864
Platforms
2,854
2,017
813
521
213
Products / Services
1,334
1,144
831
576
366
MITRE Techniques
1,820
1,307
787
746
577
CVEs
9
7
7
6
6
IDS Classtypes
538
151
101
57
48
IDS Protocols
375
373
132
64
42
Detects a potential 'UnPAC the Hash' Kerberos attack, a technique used by Akira ransomware. The attack involves requesting an Active Directory certificate and then using it for a User-to-User (U2U) Kerberos authentication with PKINIT to extract NTLM hashes.
Detects an office suite application (Word, Excel, PowerPoint, Outlook) communicating to target systems over uncommon ports. This rule specifically looks for network connections initiated by these applications, excluding common ports used for DNS, HTTP, HTTPS, SMB, LDAP, and specific Outlook-related ports (IMAP, POP3, SMTP).
This rule detects URLs that contain common redirection or link parameters (u=, url=, redirect=, r=, link=, target=, dest=) where the value of the parameter is a long, alphanumeric string that appears to be an encoded domain. This pattern can indicate attempts to obfuscate the true destination of a link, often seen in phishing campaigns or malicious redirection attempts. The rule specifically looks for encoded parameters containing common top-level domains like .com, .net, or .org.
Detects HTTP responses containing JavaScript associated with ClickFix phishing kits. These kits manipulate the DOM to mimic browser verification pages and trick users into copying and executing malicious commands.
This rule detects attempts to browse or access a predefined list of potentially malicious software packages. It monitors proxy logs for occurrences of these package names within the 'file.name' field. Further investigation of network traffic volume (bytes in/out) is recommended to ascertain if a download of the malicious package has taken place.
Detects a variety of HTTP exploitation attempts associated with the RondoDox botnet campaign. This campaign uses a 'shotgun' approach, targeting numerous vulnerabilities in internet-facing devices like routers, DVRs, and web servers.
Windows DCE-RPC functions which indicate an execution techniques on the remote system. All credit for the Zeek mapping of the suspicious endpoint/operation field goes to MITRE
This rule detects potential Domain Generation Algorithm (DGA) activity by analyzing network connection logs. It identifies suspicious domains based on their structure (length, character set) and then filters them using a trigram analysis. Domains with non-repeating trigrams and rare trigrams (not found in a baseline of Alexa Top 1M domains) are flagged as DGA candidates. The rule then joins these candidates back to the original network logs to identify actual connections to these suspicious domains.
Detects command execution characteristic of the AntSword web shell's virtual terminal feature. This is identified by a web server process spawning a child process with a specific command-line structure, often involving `cmd.exe` and echoing unique start and end tags (`stag`/`etag`).
This rule detects multiple failed SSL login attempts from a single source IP to a destination IP within a 24-hour period. A threshold of 10 failed attempts is used to identify potential brute-force attacks or credential stuffing against SSL-enabled services.
Detects the execution of NetCat (nc) on macOS systems. NetCat is a versatile networking utility that can be used for various purposes, including port scanning, banner grabbing, file transfers, and creating backdoors. This rule specifically looks for process creation events where the process name is 'nc' and excludes known legitimate uses by 'Jamf Connect' and 'TruU Authenticator', as well as a specific health check script.
This rule identifies if a given IP address falls within the known IP ranges used by Apple's iCloud Private Relay service. It retrieves a list of IPv4 and IPv6 ranges from a public GitHub repository and then checks if a specified IP address is contained within any of these ranges. This can be used to identify traffic potentially obfuscated by iCloud Private Relay.
Windows DCE-RPC functions which indicate a persistence techniques on the remote system. All credit for the Zeek mapping of the suspicious endpoint/operation field goes to MITRE.
Detects SMB server connections to shares without signing or encryption enabled.
This could indicate potential lateral movement activity using unsecured SMB shares.
This could indicate potential lateral movement activity using unsecured SMB shares.
MAL Bat Dropper
YARA
Detects a specific multi-stage batch file dropper identified by its hash. This malware uses PowerShell, VBScript, and multiple layers of obfuscation (Base64, XOR, Gzip) to deliver its payload.
Detects a process execution chain characteristic of the ClickFix technique, where explorer.exe spawns a headless conhost.exe, which in turn leads to the execution of curl.exe to download a payload.
This rule detects the presence of Olymp Loader malware by identifying known malicious file hashes (SHA256) and network communication with associated distribution domains. It looks for these indicators across various data sources, normalizing fields for consistent output. The rule aims to identify systems infected with or communicating with Olymp Loader infrastructure.
Detects known sensitive file extensions via Zeek
Detects an office application (Word, Excel, PowerPoint) that initiate a network connection to a non-private IP addresses.
This rule aims to detect traffic similar to one seen exploited in CVE-2021-42292.
This rule will require an initial baseline and tuning that is specific to your organization.
This rule aims to detect traffic similar to one seen exploited in CVE-2021-42292.
This rule will require an initial baseline and tuning that is specific to your organization.
Detects Acreed infostealer's cryptocurrency clipper activity. This rule identifies when a host first communicates with a known Acreed C2 domain (`trustdomainnet.live`) to fetch malicious wallet addresses, and then communicates with a QR code generation API (`api.zile42o.dev`) used to replace legitimate QR codes with malicious ones.
Detects potential BRICKSTORM C2 activity. This rule identifies processes initiating a WebSocket connection over HTTPS, which is a technique used by BRICKSTORM for its command and control channel. The rule filters for processes that lack file metadata, a common characteristic of Go-based malware like BRICKSTORM.
Page 208 of 246