Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
868 detections
Filters
Last updated
All Time
Detection languages
863
4
1
Contributors
411
156
140
93
29
Categories
401
373
235
168
150
Platforms
773
171
98
28
24
Products / Services
846
413
94
47
26
MITRE Techniques
136
123
110
98
83
CVEs
9
5
5
4
4
IDS Classtypes
362
189
90
64
55
IDS Protocols
2,431
868
408
324
97
This rule detects network traffic containing the string ".bashrc" on TCP port 22 (SSH). This could indicate an attempt to modify a user's shell profile for persistence, as .bashrc is a common file used to configure the Bash shell environment and can be leveraged by attackers to execute malicious commands upon login.
This rule detects network traffic over SMB (port 445) containing the string "SCRNSAVE.EXE" in a case-insensitive manner. This is indicative of a potential persistence mechanism where the screensaver executable has been replaced with a malicious one, and its name is being transmitted over the network, possibly during file transfer or command and control activities. The rule specifically looks for traffic flowing to the server on an established connection.
This rule detects attempts to modify the SSH daemon configuration file (sshd_config) remotely over an established TCP connection to port 22. The detection is based on the presence of the string "sshd_config" within the network flow, indicating potential remote manipulation of SSH authentication settings.
This rule detects attempts to push firmware or bootkit images to a device via a remote SSH session. It specifically looks for the commands 'dd if=' and '/dev/' within TCP traffic directed to port 22 (SSH), indicating an attempt to write data directly to a device file, which is a common method for flashing firmware or installing bootkits.
This rule detects attempts to execute AppleScript commands remotely over SSH. It specifically looks for the string "osascript" (case-insensitive) within TCP traffic destined for port 22 (SSH) on the home network, indicating a potential remote execution of AppleScript.
This rule detects network traffic on TCP port 830, which is commonly used for NETCONF (Network Configuration Protocol) sessions. The rule specifically looks for the string "<rpc" within the traffic, indicating an RPC (Remote Procedure Call) request, which is a fundamental part of NETCONF communication. This suggests an attempt to establish a CLI (Command Line Interface) session with a network device using NETCONF.
This rule detects remote activation of COM objects via DCOM (Distributed Component Object Model) on TCP port 135. It specifically looks for the byte sequence '|05 00 0b|' and the string 'IDispatch' within the network flow, indicating an attempt to interact with COM objects remotely. This activity can be associated with lateral movement or execution techniques by attackers.
This rule detects suspicious inter-process communication (IPC) activity involving named pipes. Specifically, it looks for network traffic within the home network ($HOME_NET to $HOME_NET) that contains the string "\\.\pipe\\" (case-insensitive) and has a data payload size greater than 1000 bytes. This pattern is often associated with malware or advanced persistent threats (APTs) using named pipes for communication, especially when large amounts of data are transferred, indicating potential data exfiltration or command and control (C2) activity.
This rule detects attempts to access the Docker TLS API on port 2376. It triggers an alert if there are 5 or more TCP SYN packets (indicating connection attempts) from a single source to the Docker TLS API port within a 60-second window. This could indicate an attacker attempting to gain unauthorized access or control over Docker containers.
This rule detects SMB authentication attempts that might be indicative of a 'Pass-the-Hash' attack (ATT&CK T1550.002). It specifically looks for NTLMSSP (NT LAN Manager Security Support Provider) traffic on TCP port 445 (SMB) where the NTLM authentication message contains a specific sequence of null bytes, which can be characteristic of a hash being passed instead of a cleartext password.
This rule detects attempts to enumerate SMB network shares. It triggers when TCP traffic is directed to port 445 (SMB) on the home network, contains the SMB protocol signature, and specifically includes the string 'NetShareEnum' (case-insensitive). A threshold of 5 occurrences within 60 seconds from the same source IP is applied to reduce false positives.
This rule detects potential data exfiltration of USB drive contents over SSH using SCP. It triggers when TCP traffic on port 22 (SSH) from the home network to the home network contains the string "/dev/sd" (case-insensitive) and the data size is greater than 65000 bytes. This combination suggests that a file from a Linux-like USB device (often mounted as /dev/sdX) is being transferred out via SCP.
This rule detects scheduled data transfers occurring at off-hours, characterized by a large data size (greater than 65000 bytes) in TCP traffic flowing from the home network to any destination. It uses a thresholding mechanism to alert if 100 such transfers are observed within a 300-second window from the same source.
This rule detects network traffic duplication, specifically looking for the GRE (Generic Routing Encapsulation) protocol (IP protocol 47) being used in a way that suggests traffic mirroring via SPAN or TAP devices. The rule triggers if 10 or more GRE packets are observed from a single source IP within a 30-second window, flowing from a client to a server.
This rule detects cryptomining activity by identifying the Stratum protocol's 'mining.subscribe' message over TCP port 3333. The Stratum protocol is commonly used by cryptocurrency miners to communicate with mining pools. Detection of this specific message indicates an attempt to initiate or participate in cryptomining operations, potentially on a compromised system.
This rule detects a high volume of TCP traffic on port 445 (SMB) directed to the home network, specifically looking for the SMB protocol signature. The threshold of 500 connections within 30 seconds from a single source IP suggests an attempt at mass file deletion or disk wiping activity on network shares, often associated with ransomware or destructive malware.
This rule detects a TCP connection flood, specifically looking for a high rate of TCP SYN packets (indicated by the 'flags:S' keyword) directed towards a single destination IP address within a short timeframe. A threshold of 500 SYN packets within 5 seconds to the same destination triggers the alert. This behavior is characteristic of a Denial of Service (DoS) attack, aiming to exhaust the target's resources by overwhelming it with connection requests.
This rule detects potential data exfiltration over an alternate network medium by monitoring TCP traffic from the home network to any destination. It triggers an alert if the data size of an established connection exceeds 10000 bytes and if this occurs 20 times within a 60-second window from the same source IP address. This pattern suggests a large volume of data being transferred out of the network, which could indicate exfiltration.
This rule detects non-DNS traffic attempting to use port 53, which is typically reserved for DNS queries. This behavior is often indicative of command and control (C2) evasion techniques, where attackers tunnel their C2 communications over a commonly allowed port to bypass firewalls and network monitoring. The rule specifically looks for TCP traffic to port 53 that is not identified as DNS application-layer protocol, originating from the home network, and establishes a flow. A threshold of 5 such events within 30 seconds from the same source IP triggers the alert.
This rule detects the use of SSH multiplexing, specifically the 'ControlMaster' feature, which can be leveraged for session hijacking. It triggers when the string 'ControlMaster' is observed in TCP traffic on port 22 (SSH) within the home network, indicating an attempt to establish or utilize an SSH multiplexing control channel. A threshold of 3 occurrences within 30 seconds from the same source IP is set to reduce false positives.
This rule detects potential SSH session hijacking attempts that leverage agent forwarding abuse. It specifically looks for a byte sequence within the SSH traffic that could indicate such an attack. The rule targets TCP traffic on port 22 (SSH) flowing from the client to the server, ensuring the connection is established.
Page 26 of 42