Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,937 detections
Filters
Last updated
All Time
Detection languages
1,930
3
2
1
1
Contributors
592
477
360
250
124
Categories
995
927
834
546
538
Platforms
1,753
214
81
54
41
Products / Services
1,868
1,144
65
51
17
MITRE Techniques
564
412
305
201
175
CVEs
4
4
4
2
2
IDS Classtypes
1,937
503
461
381
236
IDS Protocols
1,098
362
201
171
37
This rule detects the submission of a Golden SAML attack token to a service. It specifically looks for HTTP POST requests where the URI contains 'saml', the client body contains 'Assertion', and the body size is greater than 2000 bytes. This combination of indicators suggests an attempt to authenticate using a forged SAML assertion.
This rule detects the use of a forged SAML token for identity federation bypass. It specifically looks for HTTP POST requests (flow:to_server,established; http.client_body;) containing the string "SAMLResponse" (content:"SAMLResponse"; nocase;) and a long base64-encoded string (pcre:"/[A-Za-z0-9+\/]{500,}={0,2}/";) within the client body. The presence of a large base64 string in conjunction with "SAMLResponse" suggests a potentially malicious SAML assertion being submitted.
This rule detects potential SMB Relay attacks attempting to capture NTLM hashes. It specifically looks for TCP traffic on port 445 (SMB) directed to the home network, where the flow is established and contains both "NTLMSSP" and "NTLMSSP_AUTH" content. A threshold of 3 occurrences within 30 seconds from the same source IP is set to reduce false positives.
This rule detects attempts to upload potentially malicious script or executable files to GitHub's API. It specifically looks for HTTP POST requests to 'api.github.com' with a URI containing '/contents/' and file data matching common executable or script file extensions such as '.exe', '.dll', '.ps1', '.vbs', '.bat', or '.hta'. This activity could indicate an attacker attempting to stage malicious code in a code repository.
This rule detects attempts to create a setuid binary on a remote host via an SSH connection. It specifically looks for the string "chmod u+s" within TCP traffic destined for port 22 (SSH), indicating a command to set the setuid bit on a file. This activity is often associated with privilege escalation attempts where an attacker tries to create a backdoor or maintain persistence with elevated privileges.
This rule detects network traffic that contains specific strings indicative of a Systemd service unit being created for persistence. Specifically, it looks for the string "/etc/systemd/system" and ".service" within TCP traffic directed to the home network on port 22 (SSH). This combination suggests an attempt to establish persistence on a Linux system by creating a new Systemd service.
This rule detects the deployment of a macOS Launch Agent Property List (plist) file via HTTP. It specifically looks for HTTP responses (flow:to_client) containing both ".plist" in the URI and "LaunchAgent" within the file data, indicating a potential persistence mechanism being established on a macOS system.
This rule detects remote modification attempts of the 'Run' key within the Windows Registry, which is commonly used for persistence by malware and legitimate applications to automatically start programs when a user logs in. The detection specifically looks for network traffic on port 445 (SMB) containing the string 'CurrentVersion\Run', indicating an attempt to interact with this registry path remotely.
This rule detects the presence of the string "io.popen(" within HTTP response data. This string is indicative of a Lua script attempting to execute shell commands, which is a common technique used by malware to achieve arbitrary code execution on a compromised system. The rule specifically looks for this pattern in data flowing from the server to the client (flow:to_client), suggesting a malicious script being delivered to a user's browser or an application.
This rule detects the download of AutoHotKey (AHK) or AutoIt (AU3) script files over HTTP. These script files are often used for automation but can also be leveraged by attackers for malicious purposes, such as executing arbitrary code, keylogging, or other forms of automation in an attack chain. The rule specifically looks for HTTP responses where the URI contains file extensions '.ahk' or '.au3'.
This rule detects suspicious file drops over SMB (port 445) that contain both ".lnk" (likely a shortcut file) and "System32" in their content. This combination is often indicative of malware attempting to spread via removable media, using shortcut files to execute malicious payloads, potentially mimicking legitimate system directories.
This rule detects the use of TLS protocol on port 443 with a specific content signature, indicating potential Command and Control (C2) activity. It triggers an alert if 20 such connections are observed from the same source within 60 seconds.
This rule detects HTTP traffic to JetBrains Remote IDE tunnel domains (jetbrains.space or gateway.jetbrains.com). This activity is flagged as potential Command and Control (C2) communication, specifically leveraging remote access software for malicious purposes. A threshold of 10 connections within 60 seconds from a single source IP is set to reduce alerts on legitimate, less frequent usage.
This rule detects the use of the Slack API for potential bidirectional command and control (C2) communication. Specifically, it looks for HTTP traffic to 'slack.com' that includes the '/api/chat.postMessage' URI. A threshold of 10 occurrences within 60 seconds from the same source IP is set to reduce false positives, indicating a high frequency of message posting activity which could be indicative of automated C2.
This rule detects attempts to overwrite router firmware via an SSH session. It specifically looks for the string "flash write" within TCP traffic directed to port 22 (SSH) on the home network. This activity is indicative of an attacker attempting to modify the router's operating system, potentially for persistence, backdooring, or other malicious purposes.
This rule detects the use of MQTT (Message Queuing Telemetry Transport) over TLS on port 8883, specifically identifying it as a potential encrypted Command and Control (C2) channel. It triggers an alert if there are at least 5 established TCP connections to port 8883 from a single source within a 60-second window, indicating persistent communication often associated with C2 activities.
This rule detects non-HTTPS/non-HTTP traffic attempting to tunnel over TCP port 443. It specifically looks for established TCP connections to port 443 where the application layer protocol is neither TLS nor HTTP, indicating potential covert communication or tunneling activity often associated with malware or command and control.
This rule detects DNS responses with a very low Time-To-Live (TTL) value, which is a characteristic often associated with fast flux techniques used by malware to rapidly change IP addresses. Specifically, it looks for UDP traffic on port 53 (DNS) where the DNS response contains a specific content pattern indicating a low TTL.
This rule detects Fast Flux DNS activity, specifically rapid IP rotation on a single domain. It triggers when a destination IP address associated with a DNS query changes at least 20 times within a 10-second window. This behavior is characteristic of fast fluxing, a technique used by malware to hide command and control servers behind a constantly changing set of IP addresses.
This rule detects attempts to exfiltrate wireless network lists (SSIDs) over HTTP POST requests. It specifically looks for HTTP POST requests with a body size greater than 200 bytes that contain the string "SSID" (case-insensitive). This activity is indicative of a trojan attempting to steal network information.
This rule detects the exfiltration of peripheral device information over HTTP POST requests. It specifically looks for HTTP POST requests with a body size greater than 200 bytes that contain the string "DeviceID" (case-insensitive). This pattern is indicative of malware or malicious scripts attempting to send device identifiers or other system information to a remote server.
Page 65 of 93