Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
6,535 detections
Filters
Last updated
All Time
Detection languages
3,970
998
596
428
233
Contributors
1,363
1,250
1,066
954
384
Categories
2,931
2,196
2,017
1,857
1,411
Platforms
39,936
7,266
6,535
3,866
3,647
Products / Services
4,107
2,418
1,585
270
254
MITRE Techniques
1,450
1,310
1,022
934
696
CVEs
46
46
33
18
12
IDS Classtypes
1,753
458
404
325
220
IDS Protocols
2,202
773
381
300
93
This rule identifies DNS queries made to domains associated with known cryptocurrency mining pools. It specifically looks for DNS queries where the 'query' field ends with any of the listed mining pool domains. The rule excludes queries with answers '127.0.0.1' or '0.0.0.0' and those marked as rejected, to reduce false positives. The primary goal is to detect potential resource hijacking through cryptomining on compromised systems.
This rule detects exploitation attempts against the Log4j RCE vulnerability, also known as Log4Shell (CVE-2021-44228). It looks for various JNDI (Java Naming and Directory Interface) lookup patterns, including LDAP, RMI, LDAPS, DNS, NIS, NDS, CORBA, and IIOP, as well as obfuscated forms of these patterns, which are commonly used to trigger the vulnerability. The rule specifically filters out known vulnerability scanning traffic from Nessus to reduce false positives.
This rule detects potential SQL injection attempts by looking for common SQL injection strings and keywords within the URI of GET requests in web server access logs. It specifically targets patterns often used to extract database information, bypass authentication, or execute arbitrary SQL commands.
Detects exploitation attempts against the Log4j RCE vulnerability (CVE-2021-44228), commonly known as Log4Shell. The rule specifically looks for various JNDI injection patterns within web server log fields such as User-Agent, URI query, and Referer headers, which are common vectors for this vulnerability.
Detects suspicious DNS queries that contain a base64 encoded string, indicated by the '==.' pattern. This pattern is often used in DNS exfiltration techniques where data is encoded in base64 and sent via DNS queries to bypass network defenses.
This rule detects suspicious DNS queries specifically targeting 'api.telegram.org'. This domain is used by Telegram Bot API, which can be leveraged by various types of malware (e.g., RATs, ransomware) for command and control (C2) or data exfiltration. Monitoring these queries helps identify systems potentially communicating with malicious Telegram bots.
Detects HTTP requests to URIs ending with the ".class" extension. This can indicate attempts to download Java classes, potentially as part of exploitation attacks such as Log4shell against Log4j vulnerabilities. This rule is useful for threat hunting to identify such activities.
This rule detects attempts to disable logging on Cisco devices by looking for specific commands such as 'no logging' or 'no aaa new-model'. Adversaries may disable logging to evade detection and hinder forensic analysis.
This rule detects attempts to shut down a Cisco device or change its boot mode by looking for specific keywords in Cisco AAA logs. The keywords 'shutdown', 'config-register 0x2100', and 'config-register 0x2142' indicate actions that can lead to a denial of service or a change in the device's operational state.
Detects exploitation attempts against Fortinet SSL VPNs using the CVE-2018-13379 vulnerability. This vulnerability allows an unauthenticated attacker to read arbitrary files on the system via a specially crafted URI.
Detects potential Command and Control (C2) communication associated with the Small Sieve malware. This rule specifically looks for HTTP GET requests to 'api.telegram.org' with a specific chat_id and 'text=com/' in the URI, which are indicators of Small Sieve's use of the Telegram Bot API for C2.
This rule detects commands executed on Cisco network devices related to the export of private keys or the import/management of PKI certificates. Specifically, it looks for the commands 'crypto pki export', 'crypto pki import', and 'crypto pki trustpoint'. These actions can indicate an attempt to exfiltrate sensitive cryptographic material (private keys) or to establish new trusted certificates, which could be used for defense evasion or to facilitate man-in-the-middle attacks.
This rule detects HTTP POST requests that exhibit characteristics commonly associated with the Empire post-exploitation framework. Specifically, it looks for a combination of a distinct user-agent string ('Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko') and specific URI paths ('/admin/get.php', '/news.php', '/login/process.php'). This pattern is indicative of an Empire agent communicating with its command and control server.
This rule detects Cobalt Strike Malleable C2 profile patterns by analyzing HTTP proxy logs. It looks for specific User-Agent strings, HTTP methods (GET/POST), URIs, and hostnames that are characteristic of known Cobalt Strike profiles, including those mimicking Amazon, generic browsers, OCSP, and OneDrive traffic. The rule aims to identify command and control communications attempting to blend in with legitimate web traffic.
Detects suspicious User-Agent strings that appear to be Base64 encoded. This pattern has been observed in some malware, such as YamaBot, to obfuscate the true User-Agent. The rule specifically looks for Base64 encoded prefixes of common browser User-Agents like 'Chrome', 'AppleWebKit', 'Dalvik', and 'Mozilla', with an offset to account for potential padding variations.
Detects exploitation attempts of CVE-2021-41773, a path traversal vulnerability in Apache HTTP Server 2.4.49. This flaw allows an attacker to map URLs to files outside the expected document root, potentially leading to information disclosure (e.g., source code of CGI scripts) or arbitrary file access if not properly protected. This vulnerability has been actively exploited in the wild and specifically affects Apache HTTP Server version 2.4.49.
Detects potential command and control (C2) beaconing activity to domains identified as being used in the 'Operation Triangulation' campaign, which targeted iOS devices with 0-day exploits. This rule specifically looks for connections to a list of known malicious domains via proxy logs.
Detects Border Gateway Protocol (BGP) authentication failures, which can indicate attempts to brute force BGP peer authentication. Such attacks aim to manipulate routing information, potentially leading to traffic redirection or denial of service.
Detects exploitation attempts against Citrix Netscaler, Application Delivery Controller (ADS), and Citrix Gateway by identifying specific URI query patterns associated with CVE-2020-8193 and CVE-2020-8195.
Detects exploitation attempts targeting CVE-2021-27905, an arbitrary file read and SSRF vulnerability affecting Apache Solr versions up to and including 8.8.1. The rule looks for specific patterns in HTTP request URIs that are indicative of this vulnerability being exploited, such as requests containing '/solr/', '/debug/dump?', 'param=ContentStream', or 'command=fetchindex' with 'masterUrl='.
Detects a potential exploitation attempt of CVE-2023-25157, a SQL injection vulnerability in GeoServer. The rule looks for specific GET requests to '/geoserver/ows' containing 'CQL_FILTER=' along with known vulnerable functions or SQL injection keywords in the query string.
Page 308 of 312