Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
6,537 detections
Filters
Last updated
All Time
Detection languages
3,970
998
598
428
233
Contributors
1,363
1,250
1,066
954
384
Categories
2,933
2,196
2,017
1,857
1,411
Platforms
39,936
7,266
6,537
3,866
3,647
Products / Services
4,107
2,418
1,587
270
254
MITRE Techniques
1,450
1,310
1,022
934
696
CVEs
46
46
33
18
12
IDS Classtypes
1,753
458
404
325
220
IDS Protocols
2,202
773
381
300
93
Detects potential command execution via webshell in SAP NetViewer through JSP files with 'cmd' or similar parameters. This rule is designed to identify exploitation of vulnerabilities like CVE-2025-31324, which allows remote code execution via a webshell by looking for specific URI patterns and query parameters indicative of command execution attempts, including common Linux commands and base64 encoded commands.
The analytic identifies DNS queries to domains associated with the 3CX supply chain attack. This activity is significant because it can indicate a potential compromise stemming from the 3CX supply chain attack, which is known for distributing malicious software through trusted updates. If confirmed malicious, this activity could allow attackers to establish a foothold in the network, exfiltrate sensitive data, or further propagate malware, leading to extensive damage and data breaches.
Detects update checks performed by Advanced IP Scanner and Advanced Port Scanner utilities. These utilities are often used for network reconnaissance and can be considered Potentially Unwanted Applications (PUA) in some environments. The rule specifically looks for requests to '/checkupdate.php' with a set of specific query parameters, indicating an update check from these tools.
Detects POST requests to the F5 BIG-IP iControl Rest API "bash" endpoint, which allows the execution of commands on the BIG-IP. This activity can indicate an attacker exploiting a public-facing application to gain initial access and execute arbitrary commands.
This analytic identifies outbound LDAP traffic to external IP addresses. It leverages network traffic data to detect connections on ports 389 (LDAP) or 636 (LDAPS) that are not directed to private IP ranges (RFC1918). This activity is significant because outbound LDAP traffic can indicate potential data exfiltration or unauthorized access attempts. If confirmed malicious, attackers could exploit this to access sensitive directory information, leading to data breaches or further network compromise. The rule specifically excludes traffic between internal source and destination IPs.
This rule detects outbound network connections to IP addresses that have been observed for the first time within the last 24 hours. It specifically excludes connections to private IP address ranges (RFC1918). The detection relies on correlating current network connection events with historical 'first seen' data for IP addresses from an entity graph.
This rule detects attempts to execute files from external WebDAV shares. It specifically looks for HTTP GET requests where the User-Agent header starts with 'Microsoft-WebDAV-MiniRedir/' and the requested URI ends with common executable or script file extensions. This behavior is often observed in initial access campaigns where adversaries leverage WebDAV to deliver and execute malicious payloads.
This rule detects attempts to access domains that have been registered within the last 30 days. It correlates network HTTP or generic network connection events with WHOIS data to identify recently created domains. The rule leverages WHOIS enrichment to determine the creation time of the accessed domain and flags any access to domains created within the specified 30-day window.
The following analytic identifies network traffic where the higher layer protocol does not match the expected port, such as non-HTTP traffic on TCP port 80. It leverages data from network traffic inspection technologies like Bro or Palo Alto Networks firewalls. This activity is significant because it may indicate attempts to bypass firewall restrictions or conceal malicious communications. If confirmed malicious, this behavior could allow attackers to evade detection, maintain persistence, or exfiltrate data through commonly allowed ports, posing a significant threat to network security.
This rule detects connections to an RDP listener where the source IP address is not a private or link-local IP address. This indicates that the RDP service is publicly accessible from the internet, which is generally not recommended due to security risks.
This rule detects outbound network connections to IP addresses that exhibit low prevalence within the monitored environment. Specifically, it flags connections to IPs that have a rolling maximum prevalence of 1 to 3 occurrences over a 10-day period. This behavior can be indicative of command and control (C2) communication, data exfiltration, or other suspicious activities where adversaries might use newly registered or rarely seen infrastructure.
This rule detects outbound network connections to known Tor exit nodes. It leverages a Google Cloud Threat Intelligence (GCTI) feed that provides a list of current Tor exit node IP addresses. The rule specifically looks for allowed network connections where the target IP address is identified as a Tor exit node by the GCTI feed. This can indicate an attempt to anonymize network traffic, which is often associated with malicious activity.
The following analytic identifies the use of cleartext protocols that risk leaking sensitive information. It detects network traffic on legacy protocols such as Telnet (port 23), POP3 (port 110), IMAP (port 143), and non-anonymous FTP (port 21). The detection leverages the Network_Traffic data model to identify TCP traffic on these ports. Monitoring this activity is crucial as it can expose credentials and other sensitive data to interception. If confirmed malicious, attackers could capture authentication details, leading to unauthorized access and potential data breaches.
This rule detects when a file is downloaded via HTTP and subsequently created on a system, where the file's SHA256 hash and the URL it was downloaded from are identified as malicious through VirusTotal relationships. It correlates HTTP network events with file creation events, ensuring the download precedes the file creation, and then enriches this information with VirusTotal data to confirm the malicious nature of the file and its source URL.
This rule detects HTTP web access to domains that exhibit low prevalence within the monitored environment. It specifically filters out internal RFC 1918 IP addresses and ensures that only valid Fully Qualified Domain Names (FQDNs) are considered. The prevalence is determined by a rolling maximum count of unique days a domain has been observed, with alerts triggering for domains seen 3 or fewer times. The risk score is incremented based on how low the prevalence is, with the lowest prevalence (1 day) resulting in the highest risk score.
This rule detects when a file is downloaded from an IP address and subsequently created on a system, where both the file hash and the IP address are identified by VirusTotal Relationships as being associated with each other, specifically through a 'DOWNLOADED_FROM' relationship. This indicates that the downloaded file is known to have been served from that particular IP address, potentially flagging malicious file distribution.
Detects exploitation attempts targeting Arcadyan routers, specifically looking for path traversal (CVE-2021-20090) and configuration file injection (CVE-2021-20091) vulnerabilities. The rule identifies requests containing '..%2f' (URL-encoded path traversal) and, for the configuration file injection, also 'apply_abstract.cgi', combined with requests to unauthenticated paths.
Detects potential exploitation of CVE-2021-26084, a Confluence RCE using OGNL injection. The rule looks for specific POST requests to Confluence endpoints, either '/pages/createpage-entervariables.action' with a 'SpaceKey=x' parameter or '/doenterpagevariables.action' with a 'u0027' string in the POST body's 'queryString' parameter. It specifically targets requests from 'anonymous' users that result in a 200 HTTP status code.
Find web Traffic going to port 53
This rule detects when a network connection is made to a domain that has expired. It leverages WHOIS data to identify domains whose expiration time is before the event timestamp. The rule specifically looks for HTTP network events and joins them with WHOIS information to identify access to recently expired domains. This could indicate access to potentially malicious infrastructure, as expired domains can be re-registered by threat actors for nefarious purposes.
This rule detects when a file, identified by its SHA256 hash, initiates a network connection to an IP address that is identified as a Tor exit node. The rule leverages VirusTotal relationships to link the file hash to the contacted IP address and Google Cloud Threat Intelligence (GCTI) Feed to identify Tor exit nodes. The risk score is increased if the Tor IP's geolocation is in certain countries (Cuba, Iran, North Korea, Russia, Syria).
Page 299 of 312