Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
868 detections
Filters
Last updated
All Time
Detection languages
863
4
1
Contributors
411
156
140
93
29
Categories
401
373
235
168
150
Platforms
773
171
98
28
24
Products / Services
846
413
94
47
26
MITRE Techniques
136
123
110
98
83
CVEs
9
5
5
4
4
IDS Classtypes
362
189
90
64
55
IDS Protocols
2,431
868
408
324
97
This rule detects attempts to copy the running configuration from a network device via SSH. It specifically looks for the string "show running-config" within TCP traffic destined for port 22 (SSH) on the home network. This activity is often associated with reconnaissance or data exfiltration by attackers or malicious insiders.
This rule detects the creation of a tar archive using the 'tar -czf' command, specifically when the archive is being created in the '/tmp/' directory over an SSH connection. This activity is indicative of data staging, where an attacker might be preparing data for exfiltration or further malicious use.
This rule detects attempts to establish a VNC (Virtual Network Computing) remote desktop session to a host on the protected network. It specifically looks for TCP traffic destined for port 5900 (the default VNC port) and the presence of the 'RFB 00' string within the initial bytes of the connection, which is characteristic of the VNC RFB (Remote Framebuffer) protocol handshake.
Docker Image Enumeration via API
Suricata
This rule detects attempts to enumerate Docker images via the Docker API. Specifically, it looks for HTTP requests to the '/images/json' endpoint on TCP port 2375, which is commonly used for unauthenticated Docker API access. This activity can indicate an adversary performing reconnaissance on a system to understand its Docker environment.
This rule detects attempts to remotely enumerate Windows Event Logs over SMB. It specifically looks for TCP traffic on port 445 (SMB) where the content includes both "eventlog" and "EvtQuery" (case-insensitive), indicating a query for event log information.
This rule detects internal HTTP file transfers using the PUT method, specifically looking for executable files (identified by the 'MZ' header) being transferred. This behavior is indicative of a possible tool drop within a network, aligning with the MITRE ATT&CK technique T1570 (Lateral Movement - Internal HTTP File Transfer). The rule focuses on traffic within the home network, suggesting an internal adversary or compromised host attempting to move malicious tools.
This rule detects potential internal SSH lateral movement attempts. It triggers an alert when there are 5 or more TCP SYN packets (indicating connection attempts) to port 22 (SSH) within a 60-second window, originating from a host within the home network and targeting another host within the home network. This threshold-based detection aims to identify rapid, repeated SSH connection attempts that could signify an attacker trying to move between internal systems.
This rule detects attempts to perform raw disk access via SSH, specifically looking for the 'dd if=/dev/sd' command within SSH traffic. This activity could indicate an attacker trying to bypass volume-based security controls or exfiltrate data directly from disk partitions.
This rule detects attempts to stop the Microsoft Defender Antivirus service (MsMpEng) remotely via the Server Message Block (SMB) protocol on port 445. The detection is triggered by the presence of "StopService" and "MsMpEng" (case-insensitive) within the TCP payload, indicating a potential defense evasion tactic.
This rule detects the creation of a new user account on a Windows system via SMB (port 445) where the account name contains 'svc_' and the 'NetUserAdd' function is used. This could indicate an attacker creating a service account with a name that mimics legitimate system accounts to evade detection.
This rule detects the creation of hidden files or directories (those prefixed with a dot) over an SSH connection. Specifically, it looks for the 'mkdir .' string within TCP traffic on port 22, indicating an attempt to create a hidden directory. This technique is often used by attackers for defense evasion to conceal malicious files or activities.
This rule detects attempts to add an exclusion path to Windows Defender via remote registry access. Specifically, it looks for TCP traffic on port 445 (SMB/CIFS) containing the strings "Exclusions\Paths" and "WindowsDefender" (case-insensitive). This activity could indicate an attacker trying to disable or bypass antivirus protection.
This rule detects attempts to downgrade network device firmware via SSH by looking for the string "boot system flash" in TCP traffic directed to port 22 (SSH). This command is commonly used on Cisco IOS devices to specify the system image to boot from, and its presence in an SSH session could indicate an attempt to revert to an older, potentially vulnerable firmware version or to a malicious image.
This rule detects attempts to patch a Cisco IOS router image remotely via SSH. It specifically looks for the string "copy tftp flash" within TCP traffic destined for port 22 (SSH) on the home network, indicating a potential attempt to modify the router's operating system image from a TFTP server.
This rule detects a replication request to a Domain Controller (DC) containing the string "DsGetNCChanges" over TCP port 389 (LDAP). This specific string is associated with Active Directory replication. The rule is designed to identify potential rogue Domain Controllers attempting to replicate with legitimate DCs, which could indicate an attacker trying to establish a malicious DC for credential harvesting or other attacks. A threshold of 3 occurrences within 60 seconds from the same source IP is set to reduce false positives.
This rule detects attempts to access the Security Account Manager (SAM) database remotely over Server Message Block (SMB). It specifically looks for TCP traffic on port 445 (SMB) directed to the home network, containing the string "\SAM" (case-insensitive) and "NtOpenFile" (case-insensitive). This combination suggests an attempt to open the SAM database file, which could indicate credential access attempts.
This rule detects network traffic containing the string "chmod 777" followed by "/tmp/" (case-insensitive) within a TCP flow to a server on port 22. This pattern suggests an attempt to change file permissions to world-writable (777) in the /tmp directory, which is a common tactic used by malware to hide or execute malicious files.
This rule detects attempts to perform process injection using the 'ptrace' system call, specifically looking for 'ptrace' and 'PTRACE_ATTACH' within TCP traffic destined for SSH (port 22). This activity is indicative of an attacker trying to attach to a running process, often for debugging, modifying its memory, or injecting malicious code, potentially after gaining remote access via SSH.
This rule detects the use of a Silver Ticket for SMB service authentication. A Silver Ticket is a forged Kerberos service ticket that allows an attacker to authenticate to a specific service (like SMB) on a specific server without needing to interact with the Domain Controller. The rule looks for TCP traffic on port 445 (SMB) containing both 'NTLMSSP' and 'KRB5' content, indicating a Kerberos authentication attempt that might be a Silver Ticket. A threshold is applied to prevent excessive alerts.
This rule detects attempts to perform SID History Injection via DCSync Replication. Specifically, it looks for TCP traffic on port 445 (SMB) directed to the home network, containing the string "DsAddSidHistory" case-insensitively. This activity is indicative of an attacker attempting to add a Security Identifier (SID) from another account to a target account's SIDHistory attribute, often as part of a privilege escalation technique like DCSync attacks, to gain unauthorized access or maintain persistence within an Active Directory environment.
This rule detects when the 'sIDHistory' attribute is added to a domain account. This is a common technique used in privilege escalation, particularly in Active Directory environments, where an attacker adds the SID of a highly privileged account (like a Domain Admin) to a compromised account's sIDHistory. This grants the compromised account the privileges of the added SID without changing its primary SID.
Page 25 of 42