Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
15,636 detections
Filters
Last updated
All Time
Detection languages
6,581
4,571
999
788
723
Contributors
3,615
2,087
2,043
1,738
1,271
Categories
9,459
6,773
3,297
2,511
1,598
Platforms
13,080
2,270
1,179
493
256
Products / Services
3,812
3,376
1,976
1,254
704
MITRE Techniques
18,116
15,636
12,583
8,393
6,223
CVEs
22
21
20
19
19
IDS Classtypes
175
58
53
25
11
IDS Protocols
256
53
17
8
4
Detects attempts to delete Volume Shadow Copies using 'vssadmin' or 'wmic' commands, which is a common tactic used by ransomware to prevent system recovery.
This rule detects suspicious execution of common scripting interpreters (powershell.exe, cmd.exe, cscript.exe, wscript.exe, python.exe) from temporary directories (Temp, AppData, %TEMP%). A high count (5 or more) of such events within an hour for a given computer and account is considered suspicious, indicating potential malicious activity like malware execution or persistence.
This rule detects the installation of new Windows services (EventID 7045) where the service's executable path (ServiceFileName) contains common scripting interpreters like 'cmd', 'powershell', or 'wscript'. This pattern can indicate an adversary attempting to establish persistence or execute malicious code via a newly created service that leverages scripting capabilities.
This rule detects the creation or modification of scheduled tasks (EventID 4698 or 4699) where the command line for the task contains references to scripting languages like PowerShell, cmd, or VBScript. It then groups these events by computer and user, flagging if two or more such tasks are created by the same user on the same computer, which could indicate malicious activity.
Detects suspicious process execution patterns involving PowerShell with encoded commands or CMD with command execution flags. The rule looks for multiple occurrences of these patterns from the same computer and account within a one-hour window, which could indicate malicious activity such as script execution or obfuscated command execution.
Detects the use of curl to download files from Telegram to local temp folder, which may indicate initial malware staging.
This rule detects installers masquerading as legitimate security or analysis utilities (e.g., Ghidra, dnSpy, Wireshark) that subsequently launch common loader programs (e.g., PowerShell, rundll32, cmd.exe). Such activity often indicates an attempt to bypass user suspicion and deliver malware. It is crucial to verify publisher signatures and the origin of downloaded software. Further investigation should involve questioning the user about recent software installations or clicked links, and engaging the security team if the situation remains unclear.
This rule detects command-line executions that attempt to disable Windows Defender or the Windows Firewall. It specifically looks for process creation events (EventID 4688) where the command line contains keywords like 'disable' along with 'defender' or 'firewall', executed via PowerShell or cmd. This activity is indicative of an adversary attempting to impair defenses.
Detects PowerShell commands attempting to add Windows Defender exclusion paths for directories associated with the 10FXRAT malware. This rule specifically looks for the use of 'Add-MpPreference' with '-ExclusionPath' in the command line, combined with the presence of 'AppNetSvc' or 'WinDiagTrack', which are known directories used by 10FXRAT for staging and persistence.
This rule detects attempts to deploy a Kubernetes CronJob via the Kubernetes API. It specifically looks for HTTP requests targeting the '/apis/batch' and 'cronjobs' URI paths, indicating an interaction with the batch API group for CronJob resources. This could be an indicator of an attacker attempting to establish persistence or execute malicious code within the Kubernetes cluster by scheduling tasks.
Azure REST API Command Execution
Suricata
This rule detects HTTP POST requests to the Azure management API (management.azure.com). A high volume of such requests (20 within 10 seconds from the same source) could indicate automated activity, potentially related to command execution or resource manipulation within an Azure environment.
This rule detects attempts to retrieve the running configuration of a network device via an SSH session. It specifically looks for the case-insensitive string "show running-config" in TCP traffic destined for port 22 (SSH) on the home network, indicating a potential administrative action or reconnaissance activity.
This rule detects attempts to perform lateral movement using the MMC20 COM object via DCOM. It specifically looks for TCP traffic destined for port 135 (typically used by DCOM) containing the string "MMC20.Application" in a case-insensitive manner. This indicates an attempt to instantiate the MMC20.Application COM object, which can be abused for remote code execution and lateral movement.
This rule detects the download of ISO, IMG, VHD, or VHDX files over HTTP that are larger than 500KB. These file types are often used as containers for malware delivery, allowing attackers to bypass traditional file-based security controls by embedding malicious executables or scripts within disk images.
This rule detects potential HID (Human Interface Device) keystroke injection attacks via USB emulation. It specifically looks for HTTP client body content containing both the terms 'keyboard' and 'inject' (case-insensitive). This pattern suggests an attempt to simulate keyboard input, often associated with devices like 'BadUSB' or 'Rubber Ducky' that emulate a keyboard to deliver malicious keystrokes.
This rule detects HTTP traffic directed to 'management.azure.com' with a URI containing 'runCommand'. This pattern indicates an attempt to execute a command on an Azure Virtual Machine using the Azure Run Command feature. This activity is often associated with administrative actions or potential malicious execution on cloud resources.
This rule detects when an AWS Systems Manager (SSM) Run Command is executed on an EC2 instance. It specifically looks for HTTP traffic to 'ssm.amazonaws.com' with the URI containing 'SendCommand'. This indicates an attempt to remotely execute commands on an EC2 instance via AWS SSM.
This rule detects HTTP POST requests to Azure Function or Azure Website domains. It specifically looks for hostnames ending in '.azurewebsites.net' or containing '.azurefunctions.' in a case-insensitive manner. A threshold of 20 such requests from the same source within 60 seconds triggers the alert, indicating potential automated activity or remote execution attempts against Azure-hosted applications.
This rule detects the remote installation of a new systemd service unit. It specifically looks for TCP traffic on port 22 (SSH) within the home network that contains the strings "/etc/systemd/system/" and ".service" (case-insensitive). This combination suggests that a new systemd service file is being transferred or created remotely, which could indicate an attacker establishing persistence or escalating privileges.
This rule detects attempts to access named pipes via Server Message Block (SMB) on port 445. It specifically looks for the SMB signature and the 'IPC$' string within the traffic, indicating an attempt to establish an Inter-Process Communication (IPC) connection. A threshold is set to trigger an alert if 10 such events occur from the same source within 30 seconds, which could indicate enumeration or exploitation attempts.
This rule detects attempts to download executable files disguised as common media file types (MP4, MP3, AVI, MOV) over HTTP. It specifically looks for the 'MZ' header, which indicates a Windows executable, within the first two bytes of the file data, combined with a URI ending in a media file extension. This technique is often used by attackers to bypass security controls and trick users into executing malicious payloads.
Page 475 of 745