Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,310 detections
Filters
Last updated
All Time
Detection languages
682
264
155
72
49
Contributors
237
195
187
166
110
Categories
345
308
229
217
143
Platforms
472
424
224
173
144
Products / Services
264
262
200
176
104
MITRE Techniques
18,116
15,638
12,587
8,397
6,227
1,310
CVEs
5
4
3
3
3
IDS Classtypes
103
67
24
23
12
IDS Protocols
167
51
16
14
7
This rule detects attempts to perform a DNS zone transfer. It specifically looks for UDP traffic on port 53 (DNS) destined for the home network, containing the byte sequence "|00 FC|" at an offset of 2 bytes with a depth of 2 bytes. This byte sequence corresponds to the 'AXFR' (Authoritative Zone Transfer) query type in a DNS request, which is often used by attackers for reconnaissance to enumerate DNS records for a domain.
This rule detects SSH banner grabbing attempts by monitoring TCP traffic to port 22 (SSH) on the home network. It specifically looks for the string "SSH-" within the first 4 bytes of the payload, indicating an attempt to identify the SSH server version. A threshold of 10 such events from the same source within 60 seconds will trigger an alert, classifying it as a network scan.
This rule detects DNS zone transfer attempts over TCP. It specifically looks for the byte sequence "|00 FC|" in TCP traffic destined for port 53, which is indicative of a DNS AXFR (zone transfer) request. This activity is often associated with reconnaissance by attackers to gather information about a network's DNS infrastructure.
This rule detects an unusually high number of network connection events originating from a single device to a remote IP address within a one-minute interval. This behavior can be indicative of various malicious activities, including network scanning, port scanning, or a denial-of-service (DoS) attempt. It could also signal a compromised host attempting to establish numerous connections for command and control, data exfiltration, or further reconnaissance.
This rule detects emails where the sender's address contains keywords like 'paypal', 'amazon', or 'apple' but does not originate from their official domains (e.g., '@paypal.com'). This pattern is indicative of lookalike domain phishing attempts, where attackers try to impersonate legitimate brands to trick recipients.
Detects POST requests to pages matching credential harvesting patterns
Detects AXFR DNS zone transfer requests for network reconnaissance
UNC3753 Infrastructure Connection
Cortex XDR
Detects DNS requests to domains matching known UNC3753 data leak sites or helpdesk impersonation patterns utilized during vishing campaigns. This rule specifically looks for the domain "business-data-leaks.com" and domains ending with "-itdesk.com", "-helpdesk.com", or "-it.com".
Detects the execution of the zenity dialog tool spawned by unusual parents (like IDEs or bash scripts) to create fake password prompts on Linux. The Linux variant of UNK_DeadDrop utilizes this to trick developers into providing their system passwords, enabling root access and GNOME Keyring extraction.
This rule detects potential vendor relationship page scraping activity. It triggers an alert when a client makes 20 or more HTTP requests containing the word "vendor" (case-insensitive) in the URI within a 30-second window. This behavior could indicate an attacker or automated script attempting to gather information about an organization's vendors, which is a reconnaissance technique.
Kerberos Realm Trust Discovery
Suricata
This rule detects Kerberos Realm Trust Discovery attempts by looking for specific byte patterns in TCP traffic destined for port 88 (Kerberos). The rule triggers if the byte sequence "6b 82" is found within the first 2 bytes of the payload. A threshold is applied to prevent excessive alerts, triggering if 10 such events occur from the same source within 30 seconds.
This rule detects potential GitHub organization repository enumeration by monitoring HTTP traffic to api.github.com with URIs containing '/orgs/'. A threshold of 20 requests within 60 seconds from a single source IP address is used to trigger an alert, indicating a possible network scan or reconnaissance activity targeting GitHub organizations.
This rule detects attempts to fingerprint a browser's configuration using JavaScript by looking for the presence of 'navigator.userAgent' and 'navigator.platform' within HTTP response data. This technique is often used during reconnaissance phases by attackers to gather information about a target's browser environment.
This rule detects HTTP requests to 'api.shodan.io', indicating a potential query to the Shodan Internet Scan Database. This activity could be part of reconnaissance efforts by an attacker or security researcher to gather information about internet-connected devices and services.
This rule detects HTTP requests to known Certificate Transparency (CT) log query services such as crt.sh, censys.io, and certspotter.com. These services are often used by attackers during the reconnaissance phase to gather information about an organization's SSL certificates and subdomains.
This rule detects HTTP requests to VirusTotal's domain lookup service (www.virustotal.com/domain/). This activity is often associated with passive DNS lookups, which can be part of reconnaissance efforts by attackers or security researchers to gather information about a target's infrastructure.
This rule detects HTTP requests made to the SecurityTrails API (api.securitytrails.com). SecurityTrails is a service that provides access to passive DNS databases and other domain-related intelligence. Such queries can indicate reconnaissance activity by an attacker or security researcher gathering information about a target domain.
This rule detects HTTP requests where the User-Agent header contains the string "feroxbuster" (case-insensitive). Feroxbuster is a command-line tool used for content discovery on web servers, often employed in penetration testing or reconnaissance phases to find hidden directories and files. Detecting its User-Agent can indicate an active directory brute-force or content discovery scan against the network.
Stealth XMAS Scan Port Probe
Suricata
This rule detects a Stealth XMAS Scan Port Probe. An XMAS scan is a type of port scan where the FIN, PSH, and URG flags are set in the TCP header. This type of scan attempts to determine if a port is open by exploiting the TCP RFC 793. If a port is closed, the target system should respond with an RST packet. If the port is open, no response is expected. The rule specifically looks for TCP packets with the FPU (FIN, PSH, URG) flags set, originating from any source IP and port, destined for any IP on the local network ($HOME_NET) on any port. A threshold is applied to trigger an alert if 10 such packets are observed from the same source within a 30-second window, indicating a scanning activity.
This rule detects potential business partner directory scraping by monitoring HTTP requests to the server. It triggers an alert if a client makes 15 or more requests containing 'partners' (case-insensitive) in the URI within a 30-second window. This behavior could indicate an attacker or automated tool attempting to enumerate or collect information about an organization's business partners.
This rule detects spearphishing emails sent over SMTP that contain an Office document attachment. It specifically looks for emails with a 'Content-Type: application/' header, a 'filename=' attribute, and the '.docx' extension in the content, indicating a Microsoft Word document.
Page 38 of 63