Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,581 detections
Filters
Last updated
All Time
Detection languages
729
235
193
112
98
Contributors
323
311
275
169
73
Categories
20,427
11,813
5,871
5,145
4,864
1,581
Platforms
1,042
289
181
159
111
Products / Services
497
264
238
141
128
MITRE Techniques
852
757
502
416
312
CVEs
5
3
3
3
2
IDS Classtypes
211
4
3
3
2
IDS Protocols
219
7
3
1
1
This rule detects the delivery of source code files (C, C++, C#, Java, Go, Rust) over HTTP to a client, specifically looking for content that includes 'main(' within the file data. This pattern suggests that a source code payload intended for compilation after delivery is being transferred, which could be indicative of malicious activity such as a staged attack where the attacker compiles and executes code on the victim's machine.
This rule detects the delivery of a raw volume access tool via HTTP. It specifically looks for HTTP traffic (flow:to_client,established) containing the strings "CreateFile", "\\.\", and "GENERIC_READ" within the file data. These strings are indicative of an application attempting to open a raw volume device for direct read access, often a technique used by malware or forensic tools to bypass file system controls.
This rule detects HTML smuggling attempts by identifying the 'msSaveOrOpenBlob' API call within HTTP response bodies. This API is often used by attackers to deliver malicious files directly to a user's browser, bypassing traditional network security controls. The rule specifically looks for the case-insensitive string 'msSaveOrOpenBlob' in the file data of HTTP responses flowing from the server to the client.
This rule detects the use of renamed system binaries (svchost, explorer, lsass, csrss) with appended digits (e.g., svchost1.exe) being used as proxy execution. It specifically looks for HTTP responses containing a Windows executable (MZ header) where the HTTP URI matches the pattern of these renamed binaries. This behavior is often indicative of defense evasion tactics by malware.
This rule detects the delivery of a VBA stomped Office document via HTTP. It looks for specific content within the HTTP response body, indicating a Microsoft Office document that has been manipulated to hide malicious VBA macros. The rule specifically checks for the presence of "[Content_Types].xml", "vbaProject", and "PerformanceCache" within the file data, which are characteristic of Office documents containing VBA macros, with "PerformanceCache" being a potential indicator of VBA stomping.
This rule detects the delivery of a malicious Control Panel (.cpl) file over HTTP. It specifically looks for HTTP responses containing a URI ending with ".cpl" (case-insensitive) and the "MZ" magic bytes at the beginning of the file data, indicating an executable file. This technique is often used for defense evasion and to execute malicious code.
This rule detects the delivery of a macOS Keychain Access tool via HTTP. It specifically looks for the string "SecKeychainFindInternetPassword" within the file data of HTTP traffic flowing from the server to the client. This string is indicative of an application attempting to access or manipulate macOS Keychain passwords, suggesting the presence of malware or a malicious utility designed to extract credentials.
This rule detects when a Kerberos credential cache (ccache) file is copied over SMB. Attackers may attempt to steal Kerberos ccache files to obtain Kerberos tickets, which can then be used for various credential access attacks like 'Pass the Ticket'. The rule specifically looks for the string '.ccache' within SMB traffic on port 445, indicating the transfer of such a file.
Detects the anomalous download or extraction of the Bun JavaScript runtime. The Miasma worm downloads Bun during npm/node-gyp installation phases to execute its payloads outside of standard Node.js monitoring, evading detection.
Detects instances where curl.exe is used to download payloads from storage.googleapis.com, with the initiating process being a .lnk file. This behavior is characteristic of the PXDropper/10FXRAT LNK campaign.
This rule detects the download of a potential post-exploitation framework binary over HTTP. It looks for HTTP responses containing the 'MZ' magic bytes (indicating a Windows executable) and specific keywords like 'beacon', 'agent', 'implant', 'payload', or 'stager' in the HTTP URI. This combination suggests an attempt to deliver malicious tools to a compromised system.
This rule detects the download of remote support tools such as AnyDesk, TeamViewer, Atera, Splashtop, and ConnectWise. The detection is based on HTTP URI patterns that match these tool names. This activity is often associated with phone scams where attackers trick users into installing remote access software, giving the attackers control over their systems.
This rule detects suspicious background downloads initiated via BITS (Background Intelligent Transfer Service) where the HTTP User-Agent contains "Microsoft BITS" and the requested URI ends with common executable or script file extensions (.exe, .dll, .ps1, .bat). This behavior can indicate an adversary using BITS for ingress tool transfer or to download malicious payloads.
This rule detects HTTP downloads where a file is disguised as a PDF but is actually an executable. It specifically looks for the 'MZ' magic bytes (indicating a Windows executable) within the first two bytes of the file data, combined with a '.pdf' extension in the HTTP URI. This is a common technique used by attackers to bypass security filters and trick users into executing malicious code.
This rule detects the download of a malicious Office template file (.dotm) over HTTP. The rule specifically looks for HTTP traffic flowing to the client that contains the ".dotm" string in the URI, indicating a potential template injection attack where a malicious template is delivered to a user.
This rule detects the download of tools or files that contain 'uac' and 'bypass' in their HTTP URI. This is indicative of an attempt to download a User Account Control (UAC) bypass tool, which adversaries might use for privilege escalation on Windows systems.
Detects cURL making direct HTTP requests to raw IPv4 addresses specifically seeking 'installer' binaries. This specific command-line pattern is a documented staging technique used by UNC3753 to deploy RMM payloads on victim machines.
This rule detects the download of a payload that might be used in a User Account Control (UAC) bypass technique. It specifically looks for HTTP traffic where the URI contains keywords like 'uac.bypass', 'elevate', 'privesc', or 'bypassuac' (case-insensitive) and the file data starts with 'MZ', indicating a Windows executable.
This rule detects the delivery of potentially malicious Office add-in files (VSTO, XLA, XLAM) or COM files over HTTP. It specifically looks for these file extensions in the HTTP URI and verifies that the file content starts with 'MZ', indicating a Windows executable or DLL.
This rule detects the delivery of potentially malicious kernel modules or extensions over HTTP. It specifically looks for HTTP responses containing files with '.ko' (Linux kernel object) or '.kext' (macOS kernel extension) file extensions in the URI, indicating a client is downloading such a file. The 'flow:to_client,established' ensures the detection occurs on files being sent from a server to a client over an established HTTP connection.
This rule detects attempts to hijack macOS applications using malicious dynamic libraries (DYLIBs). It specifically looks for HTTP responses containing a URI with the ".dylib" extension and the content "__TEXT" within the file data, indicating a Mach-O executable segment. This combination suggests the delivery of a potentially malicious dynamic library designed for hijacking purposes on macOS systems.
Page 57 of 76