Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,581 detections
Filters
Last updated
All Time
Detection languages
729
235
193
112
98
Contributors
323
311
275
169
73
Categories
20,427
11,813
5,871
5,145
4,864
1,581
Platforms
1,042
289
181
159
111
Products / Services
497
264
238
141
128
MITRE Techniques
852
757
502
416
312
CVEs
5
3
3
3
2
IDS Classtypes
211
4
3
3
2
IDS Protocols
219
7
3
1
1
This rule detects when an executable file is embedded within an Office document that is being downloaded over HTTP. It specifically looks for the presence of both the Office document content type indicator "[Content_Types].xml" and the "MZ" magic bytes, which signify a Windows executable, within the same file data stream. This combination is a strong indicator of a malicious Office document attempting to deliver malware.
This rule detects the download of a compressed executable payload over HTTP. It specifically looks for HTTP traffic flowing to the client that contains both the GZIP magic number (1F 8B) and the Windows executable magic number (MZ) within the file data. This combination suggests a compressed executable file being delivered, which is a common technique used by malware to evade detection.
This rule detects when an executable file is masquerading as an image file during an HTTP download. It specifically looks for HTTP responses with a 'Content-Type: image/' header, but where the file data begins with 'MZ', which is the magic number for Windows Portable Executable (PE) files. This indicates a potential attempt to bypass security controls by disguising malicious executables as benign image files.
This rule detects the delivery of an executable file over HTTP where the filename in the URI contains a space character immediately before the file extension '.exe'. This technique is often used by attackers to obfuscate the true file type or to bypass basic file type checks, making the file appear as a non-executable or a different file type to a casual observer or some automated systems. The rule specifically looks for the pattern '.exe ' (dot, exe, space) in the HTTP URI, case-insensitive.
This rule detects the delivery of a Microsoft Installer (MSI) package via HTTP that exhibits characteristics of a malicious file. It specifically looks for HTTP responses (flow:to_client) containing a URI with the ".msi" extension (http.uri; content:".msi"; nocase;) and the magic bytes "D0 CF 11 E0" (content:"|D0 CF 11 E0|"; depth:4;) which are indicative of an OLE2 compound document file format, commonly used by MSI files. The rule classifies this activity as 'trojan-activity'.
This rule detects the delivery of a token manipulation tool over HTTP. It specifically looks for the presence of the strings "AdjustTokenPrivileges" and "OpenProcessToken" (case-insensitive) within the file data of an HTTP response. These strings are associated with Windows API calls used for modifying process tokens, which is a common technique for privilege escalation.
Detects the anomalous download of the Bun JavaScript runtime during npm/node-gyp installation phases. The Miasma malware uses a standalone Bun runtime to execute its obfuscated payloads outside of standard Node.js security tooling contexts to evade monitoring.
Detects downloads of CVE exploit proof-of-concept code
Detects download of password wordlists or hash dumps for offline cracking
This rule detects processes making a high volume of successful network connections (3 or more within an hour) to domains containing 'codeartifact' or 'artifactory'. This behavior could indicate an attempt to download tools, libraries, or other artifacts, potentially as part of an ingress tool transfer or supply chain attack.
Detects the execution of `wget` or `curl` commands that also contain keywords like `execute` or `eval` in the command line. This combination can indicate an attempt to download and immediately execute malicious code or scripts, often associated with initial access or persistence mechanisms. The rule aggregates these events by computer and account over a one-hour period and triggers if three or more such events occur.
This rule detects when a single user downloads 50 or more files from OneDrive within a one-hour period. This could indicate data exfiltration or unauthorized bulk access to sensitive information.
This rule detects an unusual spike in large file downloads from SharePoint by a single user within a one-hour window. It specifically looks for users downloading 5 or more files, each larger than 100MB, from SharePoint.
This rule detects the download of Office template files (such as .dot, .dotm, .xlt, .xltm, .pot, .potm) that contain VBA project content. This is indicative of potentially malicious Office documents designed to execute macros, often used for initial access or persistence by attackers.
This rule detects the download of a Chrome extension file (.crx) from an HTTP server to a client. It specifically looks for the string ".crx" in the HTTP URI and the string "CrOD" within the first 4 bytes of the file data, which is a common magic number for Chrome extension files. This combination suggests a potential malicious Chrome extension download, often used for persistence or other malicious activities.
This rule detects the delivery of a Lua script payload via HTTP. It specifically looks for HTTP responses containing '.lua' in the URI and the string 'os.execute(' within the file data, indicating an attempt to execute commands on the client system. This is often associated with trojan activity.
This rule detects attempts to fetch Python package files (setup.py or __init__.py) from pypi.org over HTTP. This activity could indicate a client attempting to download or interact with Python packages, potentially including malicious ones, from the Python Package Index. The rule uses a threshold to alert on frequent occurrences from the same source.
Detects download of software updates containing embedded malicious payloads
This rule detects HTTP traffic that appears to be a fake IT helpdesk page attempting to host a remote tool. It looks for the keywords "helpdesk", "download", and "remote" (case-insensitive) within the file data of HTTP responses. This combination of keywords suggests a social engineering attempt to trick users into downloading and executing remote access software under the guise of IT support.
This rule detects the download of common offensive security tools such as Mimikatz, LaZagne, Rubeus, BloodHound, and SharpHound. It specifically looks for these tool names within the HTTP URI during client-to-server HTTP traffic.
This rule detects a recurring download pattern associated with Microsoft BITS (Background Intelligent Transfer Service). Specifically, it looks for HTTP traffic where the User-Agent header contains "Microsoft BITS" and triggers an alert if 10 such events occur within 3600 seconds from the same source IP address. This pattern can indicate an adversary using BITS for persistent downloads, potentially for malware delivery or command and control.
Page 54 of 76