Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,310 detections
Filters
Last updated
All Time
Detection languages
682
264
155
72
49
Contributors
237
195
187
166
110
Categories
345
308
229
217
143
Platforms
472
424
224
173
144
Products / Services
264
262
200
176
104
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
1,310
CVEs
5
4
3
3
3
IDS Classtypes
103
67
24
23
12
IDS Protocols
167
51
16
14
7
Detects the creation of processes where the command line contains keywords such as 'cve' or 'vulnerability'. This could indicate attempts to exploit known vulnerabilities, perform vulnerability research, or execute tools related to vulnerability assessment.
Detects the creation of processes where the command line contains keywords such as 'cve' or 'vulnerability'. This could indicate attempts to exploit known vulnerabilities, perform vulnerability research, or execute tools related to vulnerability assessment.
Detects sustained high-rate web access used to determine business operating hours
This rule detects potential spearphishing attempts targeting high-value individuals (CEO, CFO, IT Admin) within an organization. It looks for emails sent to these individuals with subjects commonly associated with financial phishing or social engineering lures, such as "Invoice," "Wire Transfer," "Payment," "Urgent," or "Purchase Order." The rule also checks if these emails contain attachments, which is a common vector for delivering malware or credential harvesting documents in phishing campaigns. It summarizes the attempts by sender, recipient, and day, counting the number of attempts and listing the attachments.
This rule detects an unusually high number of network connections made by common package managers (npm, nuget, pip) to their respective repositories. A high volume of connections within a short period (1 hour) could indicate automated activity, potential supply chain compromise, or an adversary attempting to download numerous packages for reconnaissance, staging, or malicious purposes.
This rule detects potential credential harvesting attempts by identifying emails that contain keywords commonly associated with phishing (e.g., 'password', 'update', 'verify' in the subject) and URLs that suggest login or account pages (e.g., 'form', 'login', 'account'). It aggregates these events from the same sender over a one-hour period and flags senders with three or more such emails.
This rule detects an unusually high number of network connections made by common package managers (npm, nuget, pip) to their respective repositories. A high volume of connections within a short period (1 hour) could indicate automated activity, potential supply chain compromise, or an adversary attempting to download numerous packages for reconnaissance, staging, or malicious purposes.
This rule detects HTTP requests made to 'whois.domaintools.com', indicating a WHOIS domain lookup activity via a web service. It triggers an alert if five such requests are observed from the same source within 60 seconds. This activity is often associated with reconnaissance.
This rule detects potential subdomain enumeration activity by identifying a high volume of DNS queries (100 queries within 30 seconds) originating from a single source IP address to port 53 (DNS) on the home network. This behavior is indicative of an attacker attempting to discover subdomains of a target domain.
This rule detects attempts to use search engine filetype dorking techniques to discover sensitive files. It specifically looks for HTTP requests containing the string "filetype:" in the URI, which is a common operator used in search engines to filter results by file extension. This activity is often associated with reconnaissance efforts by attackers to find publicly exposed documents, spreadsheets, or other files that might contain sensitive information.
This rule detects attempts to fingerprint the version of a Drupal Content Management System (CMS) by requesting the 'CHANGELOG.txt' file. This file often contains version information and is a common target for attackers performing reconnaissance to identify potential vulnerabilities.
Stealth FIN Scan Port Probe
Suricata
This rule detects a stealth FIN scan port probe. A FIN scan is a type of port scan that sends TCP segments with only the FIN flag set. If the target port is closed, it should respond with an RST segment. If the port is open, it should ignore the FIN segment. This rule triggers if 10 such FIN packets are observed from a single source within a 30-second window, indicating a potential port scan attempt.
This rule detects potential Remote Access Trojan (RAT) callbacks occurring after a remote support session. It specifically looks for HTTP GET requests where the URI contains keywords like 'setup', 'install', 'support', or 'remote' (case-insensitive) and the User-Agent header contains 'MSIE'. This combination suggests a possible RAT communicating with its command and control server, masquerading as legitimate remote support or installation traffic.
This rule detects potential credential phishing attempts by identifying HTTP responses (flow:to_client,established) that contain common keywords associated with login pages, specifically 'password', 'username', and 'action='. The rule looks for these keywords within the file data of the HTTP response, indicating a web page being served to the client that mimics a login form.
This rule detects HTTP requests made to 'search.censys.io', indicating a query to the Censys Internet Asset Database. This activity is often associated with reconnaissance efforts, where an attacker or security researcher gathers information about internet-facing assets.
This rule detects WMI DCOM port reconnaissance activity targeting the Endpoint Mapper service on port 135. It triggers an alert when a source IP initiates 10 or more TCP SYN packets to port 135 on the HOME_NET within a 30-second window, indicating a potential network scan.
This rule detects web directory brute-force attempts by identifying HTTP requests where the User-Agent header contains the string "DirBuster". DirBuster is a well-known tool used for brute-forcing directories and file names on web servers.
This rule detects web directory brute-force attempts by identifying the 'gobuster' string in the HTTP User-Agent header. Gobuster is a common tool used for directory and file enumeration on web servers, often as part of reconnaissance or vulnerability scanning activities. The rule specifically targets HTTP traffic flowing to the server.
Detects JavaScript used to fingerprint browser and client configurations
DNS Full Zone Transfer Request
Suricata
This rule detects a DNS Full Zone Transfer Request. A zone transfer is a type of DNS transaction used to replicate DNS database files (zone files) from a primary DNS server to a secondary DNS server. While legitimate for DNS server synchronization, unauthorized zone transfers can be used by attackers to gather extensive information about a network's infrastructure, including hostnames, IP addresses, and other sensitive data, which can then be used for further reconnaissance and targeting. The rule specifically looks for UDP traffic to port 53 (DNS) and the content '|00 FC|' at offset 2, which corresponds to the AXFR (Authoritative Zone Transfer) query type.
This rule detects potential email directory enumeration attempts by monitoring HTTP requests. It triggers when a client sends 10 or more HTTP requests within 30 seconds to the server, where each request URI contains both an '@' symbol and '.com'. This pattern is indicative of an attacker trying to guess valid email addresses on a domain.
Page 36 of 63