Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
868 detections
Filters
Last updated
All Time
Detection languages
863
4
1
Contributors
411
156
140
93
29
Categories
401
373
235
168
150
Platforms
773
171
98
28
24
Products / Services
846
413
94
47
26
MITRE Techniques
136
123
110
98
83
CVEs
9
5
5
4
4
IDS Classtypes
362
189
90
64
55
IDS Protocols
2,431
868
408
324
97
This rule detects the use of TLS protocol on port 443 with a specific content signature, indicating potential Command and Control (C2) activity. It triggers an alert if 20 such connections are observed from the same source within 60 seconds.
This rule detects attempts to overwrite the Master Boot Record (MBR) or disk structure using the 'dd' command via a remote SSH connection. Specifically, it looks for the string 'dd if=/dev/zero of=/dev/sda' within TCP traffic on port 22 (SSH). This command, if executed, would wipe the primary disk, leading to system destruction.
This rule detects Bluetooth Object Exchange (OBEX) Protocol data transfer activity on TCP port 3232. The rule is configured to alert when five such data transfers are observed from the same source IP within a 60-second window, indicating potential exfiltration or unauthorized data movement over Bluetooth.
This rule detects potential bandwidth hijacking activity associated with peer-to-peer botnet traffic. It triggers an alert when a high volume of TCP traffic (more than 200 packets within 60 seconds) with a packet size greater than 1000 bytes is observed originating from the home network to any destination. The 'flow:to_server,established' indicates that the rule is looking for established connections where the traffic is flowing from the internal network to an external server. The 'threshold' keyword ensures that only sustained high-volume traffic triggers the alert, reducing noise from legitimate, short bursts of activity. The 'classtype:policy-violation' suggests that this activity is considered a violation of network usage policies.
This rule detects the negotiation of an export-grade cipher suite during a TCP connection to port 443 (HTTPS). Specifically, it looks for the byte sequence '|00 1B|' at a depth of 2 bytes within the TCP payload, which corresponds to a specific cipher suite identifier often associated with weaker, export-grade cryptography. This could indicate an attempt to downgrade encryption for easier interception or exploitation.
This rule detects the use of the 'chattr +i' command over a network connection to port 22 (SSH). The 'chattr +i' command on Linux is used to make a file immutable, meaning it cannot be modified, deleted, or renamed, even by the root user. This behavior can be indicative of an attacker attempting to prevent forensic analysis or hinder system recovery by protecting their malicious files or modifying critical system files.
This rule detects attempts to copy the /etc/shadow file, which contains hashed user passwords, for offline password cracking. It specifically looks for the string "cat /etc/shadow" in TCP traffic destined for the home network on any port, indicating a potential exfiltration attempt or preparation for credential access. The rule is designed to alert on established connections where this specific command is observed.
This rule detects attempts to dump LSA secrets by accessing the 'SECURITY\Policy\Secrets' registry key remotely over SMB (port 445). This activity is indicative of credential access attempts, specifically targeting cached credentials or other sensitive information stored in the Local Security Authority (LSA). The rule looks for the specific string 'SECURITY\Policy\Secrets' within TCP traffic destined for port 445, suggesting an attempt to read this registry path.
This rule detects attempts to access the ESXi Hypervisor Command Line Interface (CLI) via HTTPS. It specifically looks for HTTP requests to the '/sdk' and 'vim25' URIs on port 443, which are indicative of vSphere API or CLI interactions with an ESXi host.
This rule detects the execution of the 'dd if=/dev/zero' command over an SSH connection. This command is commonly used to wipe disk content by overwriting it with zeros, which can be an indicator of malicious activity aimed at destroying data or hindering forensic analysis. The rule specifically looks for this string within TCP traffic directed to port 22 (SSH).
This rule detects the use of a SOCKS proxy as an external Command and Control (C2) relay. Specifically, it looks for TCP traffic on port 1080 (a common SOCKS proxy port) from the home network to any destination, and checks for the SOCKS version 5 handshake initiation sequence (05 01 00) at the beginning of the payload. This pattern indicates a client attempting to establish a SOCKSv5 connection, which can be used by malware for C2 communication to evade detection and bypass network restrictions.
This rule detects potential RDP session hijacking attempts originating from an internal host. It specifically looks for TCP traffic destined for port 3389 (RDP) on the home network, with a specific content signature "|03 00|" at the beginning of the payload. A threshold of 3 connections within 10 seconds from the same destination is set to reduce false positives.
This rule detects a VNC brute force login attempt. It triggers when there are 10 or more TCP connections to port 5900 (the default VNC port) from the same source IP address within a 30-second window, indicating a rapid succession of login attempts.
This rule detects attempts to query the remote system time via Server Message Block (SMB) by looking for the 'NetRemoteTOD' string in network traffic destined for port 445. This activity is often associated with discovery tactics, where an attacker tries to gather information about the target system.
This rule detects attempts to clear network connection history by deleting the wtmp log file via an SSH connection. The rule specifically looks for the command 'rm -rf /var/log/wtmp' being sent over TCP port 22 (SSH). This activity is often associated with defense evasion tactics used by attackers to remove forensic evidence.
This rule detects attempts to manipulate access tokens via a remote SMB session. Specifically, it looks for the string "ImpersonateLoggedOnUser" within TCP traffic destined for port 445 (SMB). This activity could indicate an attacker attempting to elevate privileges or move laterally by impersonating a logged-on user.
This rule detects potential memory injection attempts on Linux systems via an SSH session. It specifically looks for the strings "/proc/" and "/mem" within TCP traffic directed to an SSH server ($HOME_NET 22). This combination of strings suggests an attempt to access or manipulate process memory, which is a common technique used by attackers for privilege escalation or code injection.
This rule detects network traffic attempting to exploit a Service Registry ACL weakness remotely. Specifically, it looks for TCP traffic on port 445 (SMB) directed to the home network, containing the string "HKLM\System\CurrentControlSet\Services" (case-insensitive) in the payload. This string is indicative of an attempt to modify or interact with Windows services via the registry, potentially leveraging weak ACLs to establish persistence or execute malicious code.
This rule detects attempts to modify the Windows Registry remotely, specifically targeting the 'HKLM' hive and paths containing 'shell\open\command'. This pattern is often used by adversaries to establish persistence or achieve privilege escalation by modifying how applications or the system execute commands, for example, by hijacking file associations or application startup commands. The detection is based on network traffic over TCP port 445, which is commonly used for SMB/CIFS, indicating a remote registry operation.
This rule detects an outbound email bombing campaign by monitoring TCP connections to port 25 (SMTP). It triggers an alert if a single source IP address initiates 200 or more established connections to port 25 within a 60-second window. This high volume of outbound email connections from a single source is indicative of an attempt to overwhelm an email server or recipient with a large number of emails, often associated with denial-of-service attacks.
This rule detects an active remote session hijack attempt. It triggers when three or more TCP connections are established to the same destination within a 10-second window, originating from the internal network and destined for the internal network. This pattern could indicate an attempt to take over an existing network session.
Page 22 of 42