Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
868 detections
Filters
Last updated
All Time
Detection languages
863
4
1
Contributors
411
156
140
93
29
Categories
401
373
235
168
150
Platforms
773
171
98
28
24
Products / Services
846
413
94
47
26
MITRE Techniques
136
123
110
98
83
CVEs
9
5
5
4
4
IDS Classtypes
362
189
90
64
55
IDS Protocols
2,431
868
408
324
97
This rule detects attempts to enumerate logged-in users on a remote system via SMB, specifically looking for the 'NetWkstaUserEnum' string in network traffic. This activity is often associated with discovery tactics used by attackers to gain information about a target environment.
This rule detects attempts to enumerate system services on a remote host via the Server Message Block (SMB) protocol. Specifically, it looks for network traffic on TCP port 445 (SMB) containing the strings "svcctl" and "EnumServicesStatus" (case-insensitive), which are indicative of a remote service control request to list services.
This rule detects attempts to query Windows Firewall status remotely over TCP port 445 (SMB). The detection is based on the presence of the case-insensitive string "FirewallProduct" in the network flow, indicating a potential query for firewall product information. This activity could be part of a reconnaissance phase by an attacker to understand the target's security posture.
This rule detects network traffic indicative of BloodHound's domain trust collection activity over SMB. Specifically, it looks for TCP traffic on port 445 (SMB) directed to the home network, containing the strings "(objectClass=trustedDomain)" and "SYSVOL" (case-insensitive). This combination suggests an attacker is querying Active Directory for trusted domain objects and potentially enumerating the SYSVOL share, which are common steps in BloodHound's reconnaissance phase to map out trust relationships within a domain.
This rule detects attempts to enumerate Group Policy Object (GPO) settings by identifying LDAP queries containing the string "(objectClass=groupPolicyContainer)" over TCP port 389 (LDAP). This activity is often associated with reconnaissance or discovery phases of an attack, where an adversary is trying to understand the domain's GPO structure.
This rule detects attempts to modify domain trust relationships via LDAP write operations. It specifically looks for TCP traffic on port 389 (LDAP) to the home network, containing the case-insensitive strings "trustType" and "trustDirection". This activity could indicate an attacker attempting to establish or alter trust relationships between domains for privilege escalation or lateral movement.
This rule detects the upload of a vSphere Installation Bundle (VIB) to an ESXi host. It specifically looks for HTTP PUT requests to the '/bundle' URI with a payload size greater than 100,000 bytes, which is indicative of a VIB file transfer. This activity could be part of a persistence mechanism where an attacker installs malicious software or backdoors on an ESXi host.
This rule detects attempts to enable the 'xp_cmdshell' stored procedure in Microsoft SQL Server. The rule specifically looks for network traffic on port 1433 (default SQL Server port) containing the keywords 'sp_configure', 'xp_cmdshell', and '1' (indicating enablement). Enabling xp_cmdshell allows SQL Server to execute operating system commands, which is a common technique used by attackers for remote execution and persistence.
This rule detects attempts to establish a raw socket connection that is not TCP, UDP, or ICMP. This behavior can be indicative of a socket filter backdoor, where an attacker uses raw sockets to bypass standard network stack processing and potentially sniff or inject arbitrary network traffic. The rule specifically looks for outgoing connections from the home network to any destination where the IP protocol is not 6 (TCP), 17 (UDP), or 1 (ICMP).
This rule detects attempts to modify the 'Image File Execution Options' (IFEO) registry key to set a debugger for an application. This technique is often used by adversaries for persistence, allowing them to execute their malicious code whenever the legitimate application starts. The rule specifically looks for network traffic (TCP, port 445, typically SMB) containing the strings 'Image File Execution Options' and 'Debugger' in a case-insensitive manner, indicating a potential attempt to manipulate this registry setting over the network.
This rule detects network traffic on TCP port 445 (SMB) containing the string "AppInit_DLLs" case-insensitively. This string is associated with the AppInit_DLLs mechanism in Windows, which can be abused for process injection and persistence by loading arbitrary DLLs into user-mode processes. The rule specifically looks for this string in traffic flowing to the server on an established connection.
This rule detects network traffic containing the string "LSSharedFileList" (case-insensitive) on TCP port 22 (SSH). This string is associated with macOS Login Items, which can be used for persistence by adversaries. The rule specifically looks for this content in traffic flowing from the client to the server.
This rule detects network traffic on TCP port 445 (SMB) containing the case-insensitive string "Print Processors". This pattern is indicative of an attempt to register a malicious Print Processor DLL for persistence, a technique used by adversaries to maintain access to a system. The rule specifically looks for traffic flowing to the home network, suggesting an inbound attempt to establish persistence.
This rule detects network traffic on port 445 (SMB) where the content of the traffic contains both "Monitors" and "spoolsv" (case-insensitive). This combination of keywords suggests an attempt to register a port monitor DLL via the Print Spooler service, which is a known technique for persistence and privilege escalation.
This rule detects attempts to disable PowerShell history logging via an SSH connection. It specifically looks for the strings "Set-PSReadlineOption" and "HistorySaveStyle" within TCP traffic destined for port 22 (SSH). This activity is indicative of an attacker trying to cover their tracks by preventing their PowerShell commands from being recorded.
This rule detects network traffic to port 445 (SMB) containing the case-insensitive string "Authentication Packages". This string is often associated with the registration of malicious authentication package DLLs via the Windows Registry, a technique used for persistence and credential access. The rule specifically looks for this content in established TCP connections flowing to the home network.
This rule detects network traffic (TCP on port 445, typically SMB) containing the strings 'CodeIntegrity' and 'Disabled' (case-insensitive). This pattern suggests an attempt to disable code signing policies, potentially via a registry modification, which is a common defense evasion technique used by malware.
This rule detects network traffic on port 445 (SMB) containing the strings "Network Providers" and "ProviderPath" (case-insensitive). This pattern is indicative of an attempt to register a malicious Network Provider DLL for credential capture, a technique used by adversaries to persist and steal credentials.
This rule detects network traffic containing the string "/etc/pam.d/" over TCP port 22 (SSH). This could indicate an attempt to modify Pluggable Authentication Modules (PAM) configuration files, potentially for authentication bypass or persistence on a Linux system. The detection is focused on traffic originating from the home network to the home network, suggesting internal activity or a compromised host communicating within the network.
This rule detects attempts to flush auditd rules by looking for the command 'auditctl -D' within TCP traffic on port 22 (SSH). This action is often performed by attackers to remove monitoring and evade detection after gaining access to a system.
This rule detects the use of TCP port 5938, which is commonly associated with the TeamViewer protocol. The rule is specifically looking for established connections to this port, indicating potential remote command and control (C2) activity. A threshold is set to trigger an alert if three such connections are observed from the same source within 60 seconds, aiming to reduce noise from legitimate, infrequent TeamViewer usage while still catching suspicious patterns.
Page 27 of 42