Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,421 detections
Filters
Last updated
All Time
Detection languages
4,217
105
40
25
13
Contributors
1,327
1,003
725
627
332
Categories
2,253
2,239
1,434
1,144
973
Platforms
4,107
453
295
83
82
Products / Services
10,683
9,759
6,695
4,421
3,750
MITRE Techniques
886
774
552
505
456
CVEs
18
12
12
12
10
IDS Classtypes
1,868
466
446
362
230
IDS Protocols
2,366
846
388
301
93
This rule detects HTTP responses from a C2 beacon that contain the keywords "kill" and "process" (case-insensitive) within the URI. This pattern suggests a command being sent from the command and control server to the client to terminate a process, potentially an antivirus process, as part of defense evasion tactics.
This rule detects HTTP traffic where the URI contains both 'disable' and 'defender' (case-insensitive). This pattern suggests an attempt to disable security tools, specifically Windows Defender, via an HTTP command. The flow is set to 'to_client,established', indicating the response from a server to a client within an established connection.
This rule detects attempts to remotely clear event logs over Server Message Block (SMB) by looking for the strings "Eventlog" and "ClearEventLog" in TCP traffic destined for port 445. This activity is often associated with adversaries attempting to remove forensic evidence of their presence on a system.
This rule detects network traffic indicative of WMI remote execution, specifically looking for the string "IWbemServices" on TCP port 135. This activity is often associated with Living Off The Land Binaries and Scripts (LOLBAS) techniques, where legitimate system tools like WMI are abused for malicious purposes such as remote code execution or lateral movement. The rule is designed to alert on potential trojan activity.
This rule detects the download of a COM scriptlet (.sct file) over HTTP that contains XML and the keyword 'scriptlet'. This behavior is characteristic of the 'Squiblydoo' technique, which abuses legitimate Windows binaries like Regsvr32 to execute arbitrary code, often for defense evasion.
This rule detects HTTP traffic where the User-Agent header contains the string 'CertUtil' (case-insensitive). This pattern is often associated with adversaries using the Windows built-in utility CertUtil to download malicious payloads, a common technique for defense evasion.
This rule detects HTTP downloads where the file is disguised as an image (e.g., .jpg, .png) but its content starts with 'MZ', indicating it's a Windows executable. This is a common technique used by adversaries to bypass security measures that might block executable downloads but allow image files.
This rule detects when a file is written to a remote Windows Startup folder via Server Message Block (SMB). The rule specifically looks for SMB traffic containing the string "Startup" and "\AppData\Roaming\Microsoft\Windows\" (case-insensitive) in the flow to the server. This activity is often associated with persistence mechanisms where malware or an attacker attempts to execute code automatically upon system startup.
This rule detects attempts to download a payload that contains an MSBuild inline task. It specifically looks for HTTP traffic (flow:to_client,established) containing the case-insensitive strings "<UsingTask" and "TaskFactory" within the file data. This pattern is indicative of an attacker attempting to leverage MSBuild's inline task functionality to execute arbitrary code, often as part of a larger attack chain for code execution or persistence.
This rule detects a high volume of TCP connection attempts to port 135 (RPC) on the home network. A threshold of 20 connection attempts from a single source within 30 seconds triggers the alert. This pattern can indicate an attempt to exploit RPC services for remote execution, often seen in worm propagation or targeted attacks.
This rule detects DCOM remote execution attempts via the RPC Endpoint Mapper. It specifically looks for TCP traffic to port 135 (RPC Endpoint Mapper) with a specific content signature "|05 00 0b|" within the first 3 bytes of the payload, indicating a DCOM activation request.
This rule detects HTTP POST requests that contain the string "creds" in the URI and have a data size greater than 200 bytes. This pattern is indicative of potential browser credential exfiltration, where an attacker or malicious software attempts to send stolen credentials to a remote server.
Remote LSASS Memory Dump via SMB
Suricata
This rule detects attempts to remotely dump the LSASS process memory over SMB. It specifically looks for the string "lsass.exe" within TCP traffic destined for port 445 (SMB) on the home network. This activity is indicative of an attacker trying to extract credentials from a compromised system.
This rule detects the download of files with names indicative of 'Potato' privilege escalation tools. It specifically looks for HTTP URI patterns containing 'potato' preceded by terms like 'sweet', 'juicy', 'rogue', 'bad', or 'print', case-insensitively. The detection is triggered on HTTP traffic flowing from the server to the client.
This rule detects an attempt to escalate privileges on a system via SSH by looking for the string "sudo su" within an established TCP connection to port 22 (SSH). This indicates a user is trying to switch to the root user or another user with elevated privileges using the sudo command.
This rule detects attempts to drop a DLL file to a network share, specifically targeting the 'ADMIN$' share, which could indicate a DLL hijacking attempt. It monitors SMB traffic on port 445 for established connections and looks for content containing '.dll' and 'ADMIN$' (case-insensitive).
This rule detects RDP credential spraying attempts targeting multiple usernames on a single destination IP address. It triggers an alert if 30 or more RDP connection attempts are made to the same destination within a 60-second window, indicating a potential brute-force or credential-stuffing attack against RDP services.
This rule detects attempts to discover Group Policy information remotely over Server Message Block (SMB). It specifically looks for network traffic on port 445 (SMB) containing the strings "SYSVOL" and "GroupPolicy" (case-insensitive) in the same flow, indicating a potential query for Group Policy objects.
LDAP Password Policy Enumeration
Suricata
This rule detects attempts to enumerate LDAP password policy settings by looking for specific content within TCP traffic on port 389 (LDAP). Specifically, it triggers when it finds "(objectClass=domain)" and "pwdHistoryLength" in a case-insensitive manner within the network flow, indicating a query for password history length attribute of a domain object. This activity is often associated with reconnaissance or discovery phases of an attack.
This rule detects ICMP (Internet Control Message Protocol) packets that are characteristic of a traceroute operation, specifically those with a Time-To-Live (TTL) value less than 5. Traceroute is a network diagnostic tool used to display the route and measure transit delays of packets across an Internet Protocol (IP) network. Adversaries can use this technique for network topology discovery to map out the network infrastructure.
UDP Traceroute Network Discovery
Suricata
This rule detects UDP traceroute network discovery attempts. It triggers an alert when UDP packets with a Time-To-Live (TTL) value less than 5 are observed, with a threshold of 10 such events from the same source within 10 seconds. This behavior is indicative of network scanning to map network topology.
Page 177 of 211