Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,581 detections
Filters
Last updated
All Time
Detection languages
729
235
193
112
98
Contributors
323
311
275
169
73
Categories
20,427
11,813
5,871
5,145
4,864
1,581
Platforms
1,042
289
181
159
111
Products / Services
497
264
238
141
128
MITRE Techniques
852
757
502
416
312
CVEs
5
3
3
3
2
IDS Classtypes
211
4
3
3
2
IDS Protocols
219
7
3
1
1
Detects Office documents fetching remote templates for template injection attacks
Detects download of tools designed to bypass Windows trust control mechanisms
Detects SVG files embedding base64 executables for HTML smuggling
Detects download of macro-enabled Office templates for persistent macro execution
This rule detects suspicious activity involving PowerShell downloading content (using Invoke-WebRequest, iex, or DownloadString) followed by the creation of specific suspicious files (Browser Update.exe, update.zip, update.msi) on the same device within a 10-minute window. This correlation suggests a potential ingress of malicious tools or updates.
This rule detects multiple instances of PowerShell executing commands that include 'DownloadString' within a one-hour window on the same computer and by the same account. This behavior is often associated with adversaries attempting to download and execute malicious scripts or files from remote sources.
Detects the execution of cURL commands downloading an MSI installer and passing it to msiexec for silent installation, matching UNC3753's SuperOps RMM staging tactic.
cURL Request to Raw IP for Installer
Cortex XDR
Detects cURL making direct HTTP requests to raw IPv4 addresses specifically seeking 'installer' binaries. This staging pattern is utilized by UNC3753 to deploy RMM payloads on victim machines.
This rule detects the delivery of a tool designed to bypass User Account Control (UAC) via HTTP. It specifically looks for HTTP responses containing the strings "IsUserAnAdmin" and "ShellExecute" (case-insensitive) within the file data, indicating the presence of code commonly used in UAC bypass techniques.
This rule detects attempts to update system firmware from an unverified source. It specifically looks for HTTP traffic (flow:to_client,established) where the URI contains the string "firmware" (case-insensitive) and the file data contains the byte sequence "AA 55". This combination suggests a potential firmware update being delivered over HTTP, which could be malicious if the source is not legitimate.
This rule detects the download of Visual Studio Code (VS Code) or other Integrated Development Environment (IDE) extensions from official marketplaces (marketplace.visualstudio.com or open-vsx.org) when the downloaded file has a .vsix or .crx extension. This could indicate an attempt to install a malicious extension.
This rule detects the delivery of an Application Shim Database (.sdb file) over HTTP. Application Shims are used by Windows to ensure compatibility with older applications, but can also be abused by attackers for persistence and privilege escalation (e.g., by shimming malicious DLLs). Detecting the transfer of these files, especially over unencrypted HTTP, can indicate suspicious activity related to T1546.011 (Application Shimming).
This rule detects the delivery of a macOS Launch Daemon Property List (.plist) file via HTTP. Attackers often use Launch Daemons for persistence on macOS systems. The rule specifically looks for HTTP traffic containing '.plist' in the URI and 'LaunchDaemon' within the file data, indicating a potential attempt to establish persistence.
This rule detects the download of potential malware source code by inspecting HTTP URI paths and file data. It triggers if the HTTP URI contains keywords like 'rat', 'trojan', 'keylogger', 'ransomware', or 'botnet' (case-insensitive) and the downloaded file data contains the string 'import socket' (case-insensitive). This combination suggests the download of Python-based malware source code.
Dual-Use Hacking Tool Download
Suricata
This rule detects the download of dual-use hacking tools by inspecting HTTP URI paths for keywords like 'nmap', 'metasploit', 'cobaltstrike', 'empire', 'covenant', and 'sliver'. It specifically looks for these keywords in a case-insensitive manner within the HTTP URI, indicating a potential attempt to download tools that can be used for both legitimate security testing and malicious activities.
This rule detects HTTP responses that indicate a potential drive-by download infrastructure redirect. Specifically, it looks for HTTP responses to clients that contain the word "redirect" (case-insensitive) in the URI and also contain the "MZ" magic bytes at the beginning of the file data, suggesting an executable file is being served. This combination implies a server is redirecting to or serving an executable file, which is a common tactic in drive-by download attacks.
This rule detects HTTP responses that originate from search engines (Google, Bing, Yahoo) and contain a Windows executable (MZ header) in the file data. This behavior is indicative of SEO poisoning, where malicious actors manipulate search engine results to redirect users to malware downloads.
This rule detects the download of executable installer files (MSI or EXE) over HTTP that are larger than 500KB and contain the 'MZ' header, which is characteristic of Windows executables. The rule specifically looks for these files being delivered to a client within the home network. The message indicates a potential 'Executable Installer with Weak File Permission Exploit', suggesting that the downloaded file might be malicious or used in an exploit chain related to weak file permissions.
This rule detects the delivery of a Windows Dynamic Link Library (DLL) file via HTTP that could be used for execution flow hijacking. It specifically looks for HTTP responses containing a URI with '.dll', the 'MZ' magic bytes at the beginning of the file data, and a file size greater than 10,000 bytes, indicating a potentially legitimate or malicious DLL being downloaded to a client.
This rule detects the download of a Microsoft Office document that is macro-enabled. It specifically looks for HTTP traffic flowing to the client (download) that contains both "[Content_Types].xml" and "vbaProject" within the file data. These strings are indicative of an Office Open XML (OOXML) file (like .docx, .xlsx, .pptx) that contains VBA macros, which are often used in phishing attacks for initial access.
This rule detects the download of a compiled AutoIT script payload over HTTP. It specifically looks for the 'AU3!' magic bytes at the beginning of the file data, which is characteristic of compiled AutoIT executables. The detection is focused on traffic flowing from the server to the client (to_client) and assumes an established connection.
Page 56 of 76