Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
381 detections
Filters
Last updated
All Time
Detection languages
380
1
Contributors
160
79
64
38
20
Categories
220
190
146
124
101
Platforms
325
56
56
48
11
Products / Services
362
188
33
20
19
MITRE Techniques
140
73
56
53
51
CVEs
12
9
9
5
5
IDS Classtypes
1,937
503
461
381
236
IDS Protocols
189
154
25
4
4
This rule detects when the 'sIDHistory' attribute is added to a domain account. This is a common technique used in privilege escalation, particularly in Active Directory environments, where an attacker adds the SID of a highly privileged account (like a Domain Admin) to a compromised account's sIDHistory. This grants the compromised account the privileges of the added SID without changing its primary SID.
This rule detects attempts to modify Identity Provider authentication settings within Microsoft Graph. Specifically, it looks for HTTP PATCH requests to the 'authentication' endpoint on 'graph.microsoft.com'. This activity could indicate an attacker attempting to alter authentication mechanisms, potentially for persistence or to facilitate further access.
This rule detects network traffic on TCP port 830, which is commonly used for NETCONF (Network Configuration Protocol) sessions. The rule specifically looks for the string "<rpc" within the traffic, indicating an RPC (Remote Procedure Call) request, which is a fundamental part of NETCONF communication. This suggests an attempt to establish a CLI (Command Line Interface) session with a network device using NETCONF.
This rule detects remote activation of COM objects via DCOM (Distributed Component Object Model) on TCP port 135. It specifically looks for the byte sequence '|05 00 0b|' and the string 'IDispatch' within the network flow, indicating an attempt to interact with COM objects remotely. This activity can be associated with lateral movement or execution techniques by attackers.
This rule detects attempts to spawn a shell inside a container via the Docker API. Specifically, it looks for HTTP traffic directed to port 2375 (commonly used for the Docker API) containing the string "/bin/sh" in the client body, indicating a command to execute a shell.
This rule detects attempts to access the Docker TLS API on port 2376. It triggers an alert if there are 5 or more TCP SYN packets (indicating connection attempts) from a single source to the Docker TLS API port within a 60-second window. This could indicate an attacker attempting to gain unauthorized access or control over Docker containers.
This rule detects SMB authentication attempts that might be indicative of a 'Pass-the-Hash' attack (ATT&CK T1550.002). It specifically looks for NTLMSSP (NT LAN Manager Security Support Provider) traffic on TCP port 445 (SMB) where the NTLM authentication message contains a specific sequence of null bytes, which can be characteristic of a hash being passed instead of a cleartext password.
This rule detects the use of SSH multiplexing, specifically the 'ControlMaster' feature, which can be leveraged for session hijacking. It triggers when the string 'ControlMaster' is observed in TCP traffic on port 22 (SSH) within the home network, indicating an attempt to establish or utilize an SSH multiplexing control channel. A threshold of 3 occurrences within 30 seconds from the same source IP is set to reduce false positives.
This rule detects potential SSH session hijacking attempts that leverage agent forwarding abuse. It specifically looks for a byte sequence within the SSH traffic that could indicate such an attack. The rule targets TCP traffic on port 22 (SSH) flowing from the client to the server, ensuring the connection is established.
This rule detects network traffic where an HTTP request is made to 'ssm.amazonaws.com' with the URI containing 'StartSession'. This combination indicates the initiation of an AWS Systems Manager (SSM) Session Manager session, which can be used for legitimate remote administration but also for lateral movement by attackers.
This rule detects HTTP POST requests to graph.microsoft.com with the URI containing 'roleAssignmentScheduleRequests'. This pattern is indicative of an Azure PIM (Privileged Identity Management) Just-in-Time role activation request, which is a mechanism for users to temporarily elevate their privileges within Azure AD. While a legitimate administrative action, it can also be used by attackers for privilege escalation.
This rule detects attempts to modify domain trust relationships via LDAP write operations. It specifically looks for TCP traffic on port 389 (LDAP) to the home network, containing the case-insensitive strings "trustType" and "trustDirection". This activity could indicate an attacker attempting to establish or alter trust relationships between domains for privilege escalation or lateral movement.
This rule detects the creation of a new cloud account (user) in Amazon Web Services (AWS) via the Identity and Access Management (IAM) API. It specifically looks for HTTP traffic to 'iam.amazonaws.com' with 'CreateUser' in the URI, indicating an attempt to create a new IAM user.
This rule detects attempts to register a new OAuth application within Azure Active Directory by monitoring HTTP POST requests to the Microsoft Graph API endpoint '/applications' on 'graph.microsoft.com'. This activity can be indicative of an attacker establishing persistence or gaining unauthorized access to cloud resources by creating a malicious application.
This rule detects attempts to copy the NTDS.dit Active Directory database file over SMB (Server Message Block) to a server. The rule specifically looks for the string "ntds.dit" within TCP traffic destined for port 445 (SMB). This activity is highly suspicious as the NTDS.dit file contains critical Active Directory information, including hashed user credentials, and its exfiltration is a common technique used by attackers for credential dumping.
This rule detects the creation of a systemd timer via a remote SSH session. It specifically looks for TCP traffic on port 22 (SSH) containing the commands 'systemctl enable' and '.timer' (case-insensitive), indicating an attempt to enable a systemd timer unit.
This rule detects the deployment of a new privileged container via the Docker API. It specifically looks for HTTP requests to the '/containers/create' endpoint with 'Privileged' in the client body, indicating an attempt to create a container with elevated privileges. This activity can be indicative of an attacker attempting to gain higher access or persistence within a compromised system by deploying a malicious container.
This rule detects when a 'docker exec' command is run against a running container. It specifically looks for HTTP POST requests to the '/exec' endpoint, which is used by the Docker API to create and start an exec instance inside a container. This activity could indicate an attacker gaining interactive access to a compromised container.
This rule detects potential macOS XPC Service abuse via remote SSH. Specifically, it looks for TCP traffic on port 22 (SSH) within the home network that contains the strings "launchctl" and "submit" (case-insensitive). This combination suggests an attempt to use the launchctl command to submit a job, potentially exploiting XPC services, over an SSH connection.
This rule detects an attempt to access the ESXi direct SSH shell by looking for the 'vim-cmd' string in TCP traffic directed to port 22 (SSH) on the home network. This indicates an administrative command being executed directly on an ESXi host via SSH.
This rule detects attempts to enable the ESXi Host Shell via the vCenter Web API. It specifically looks for HTTP requests to the '/api/vcenter/host' URI containing the word 'shell' in the client body, indicating a potential administrative action to enable shell access on an ESXi host.
Page 12 of 19