Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,310 detections
Filters
Last updated
All Time
Detection languages
682
264
155
72
49
Contributors
237
195
187
166
110
Categories
345
308
229
217
143
Platforms
472
424
224
173
144
Products / Services
264
262
200
176
104
MITRE Techniques
18,116
15,638
12,585
8,395
6,225
1,310
CVEs
5
4
3
3
3
IDS Classtypes
103
67
24
23
12
IDS Protocols
167
51
16
14
7
Detects DNS queries for IP lookup services such as "api.ipify.org" originating from a non-browser process. This behavior can indicate reconnaissance activity by malware or an attacker attempting to determine the external IP address of a compromised system.
Detects exploitation attempts targeting CVE-2018-15473 in OpenSSH, specifically looking for a characteristic error message generated during the pre-authentication phase when an attacker attempts to enumerate valid usernames.
This rule detects when a DNS server receives a zone transfer request for a non-existent or non-authoritative zone, indicated by EventID 6004 from the Microsoft-Windows-DNS-Server-Service. This event signifies an attempt to perform a DNS zone transfer that was rejected by the DNS server. Such attempts can be part of reconnaissance activities by adversaries trying to map out a network's DNS infrastructure.
This rule detects the execution of 'git.exe' or 'git-remote-https.exe' when attempting to clone a remote repository. The detection is specifically triggered if the command line arguments contain keywords commonly associated with exploits, vulnerabilities, or proof-of-concept code, such as 'exploit', 'Vulns', 'vulnerability', 'RemoteCodeExecution', 'Invoke-', 'CVE-', 'poc-', 'ProofOfConcept', 'proxyshell', 'log4shell', 'eternalblue', 'eternal-blue', or 'MS17-'. This aims to identify reconnaissance activities where adversaries might be searching for or downloading publicly available exploit code.
Detects reconnaissance activities targeting privileged Active Directory users or groups by monitoring Windows Security Event ID 4661. The rule specifically looks for access attempts to objects identified as privileged users or groups based on their Security Identifier (SID) suffixes or names containing 'admin'. It filters out activity from machine accounts to reduce false positives.
Detects suspicious DNS error messages that indicate a fatal or suspicious error that could be caused by exploiting attempts. Specifically looks for messages related to dropping source port zero packets, denied AXFR requests, and fatal errors causing an exit.
lnx_susp_dev_tcp
Sigma
Detects suspicious command with /dev/tcp
This rule detects the execution of the `nslookup` command specifically querying for LDAP service records (`_ldap._tcp.dc._msdcs.`). This type of query is often used during the reconnaissance phase by attackers to discover Active Directory domain controllers and their associated services within a network. This activity can indicate an adversary attempting to map out the network infrastructure.
This rule detects the execution of 'adidnsdump' via 'python.exe'. Adidnsdump is a tool used for enumerating and exporting all DNS records in an Active Directory integrated DNS zone. This activity is typically performed for reconnaissance purposes within internal networks, allowing an attacker to gather information about the network's structure and resources by querying/modifying DNS records via LDAP.
Detects the execution of "wmic.exe" with the "process" flag, which adversaries might use to list processes running on the compromised host or list installed software hotfixes and patches. This rule specifically excludes commands that involve creating processes, focusing on reconnaissance activities.
Detects the execution of 'wmic.exe' with the 'qfe' flag to enumerate installed hotfix updates on a Windows system. This activity is commonly observed in penetration testing and attacker reconnaissance scripts to gather system information.
Detects processes spawned from web servers (PHP, Tomcat, IIS, etc.) that perform reconnaissance looking for the existence of popular scripting tools (perl, python, wget) on the system via the help commands. This activity is often associated with webshells attempting to understand the capabilities of the compromised server.
Detects DNS queries for IP lookup services such as "api.ipify.org" originating from a non browser process.
Detects events in which someone prints the contents of history files to the commandline or redirects it to a file for reconnaissance
Indicates that the user's valid credentials have been leaked.
Detects suspicious command with /dev/tcp
Detects execution of "git" in order to clone a remote repository that contain suspicious keywords which might be suspicious
Detects events with patterns found in commands used for reconnaissance on linux systems
Detects when a DNS zone transfer failed.
Detects usage of the "Import-Module" cmdlet to load the "Microsoft.ActiveDirectory.Management.dl" DLL. Which is often used by attackers to perform AD enumeration.
Detects usage of the "Import-Module" cmdlet to load the "Microsoft.ActiveDirectory.Management.dl" DLL. Which is often used by attackers to perform AD enumeration.
Page 62 of 63