Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,581 detections
Filters
Last updated
All Time
Detection languages
729
235
193
112
98
Contributors
323
311
275
169
73
Categories
20,427
11,813
5,871
5,145
4,864
1,581
Platforms
1,042
289
181
159
111
Products / Services
497
264
238
141
128
MITRE Techniques
852
757
502
416
312
CVEs
5
3
3
3
2
IDS Classtypes
211
4
3
3
2
IDS Protocols
219
7
3
1
1
This rule detects the HTTP download of common boot script file types (batch, command, shell, PowerShell) that contain the string 'HKLM' (HKEY_LOCAL_MACHINE). This combination suggests an attempt to establish persistence or execute malicious code by modifying system-wide registry settings, often associated with trojan activity. The detection is based on the file extension in the URI and the content within the downloaded file's data.
This rule detects when a system daemon configuration file, specifically one containing ".service" in its URI and "[Service]" in its content, is delivered via HTTP from any source to the internal network. This could indicate an attempt to establish persistence or modify system services on a compromised host.
Detects suspicious file downloads from the internet where common DLLs (wininet.dll, urlmon.dll, msxml3.dll) are initiating the file creation of executable, DLL, PowerShell, or batch files. The rule specifically looks for scenarios where 5 or more such files are created by the same initiating process on a device, indicating potential malicious activity like ingress tool transfer.
This rule detects the download of ISO, IMG, VHD, or VHDX files over HTTP that are larger than 500KB. These file types are often used as containers for malware delivery, allowing attackers to bypass traditional file-based security controls by embedding malicious executables or scripts within disk images.
This rule detects attempts to download executable files disguised as common media file types (MP4, MP3, AVI, MOV) over HTTP. It specifically looks for the 'MZ' header, which indicates a Windows executable, within the first two bytes of the file data, combined with a URI ending in a media file extension. This technique is often used by attackers to bypass security controls and trick users into executing malicious payloads.
Detects download of malware builder or generator tools from code repositories
This rule detects the delivery of a stripped binary, specifically an executable (indicated by 'MZ' header) that has been packed or compressed using UPX (indicated by 'UPX' string). The rule triggers on HTTP traffic flowing to the client, suggesting a download or delivery of such a file. The 'Stripped Binary Delivered with Debug Info Removed' message implies an attempt to evade detection or analysis by removing debugging information, often associated with malware or unwanted applications.
This rule detects the delivery of a kernel rootkit module, specifically a Linux Kernel Module (LKM) or a Windows system file, over HTTP. It looks for HTTP responses where the URI ends with '.ko' (Kernel Object for Linux) or '.sys' (system file for Windows) and the file data contains the 'ELF' magic bytes, indicating an Executable and Linkable Format file, which is common for Linux executables and modules. This combination suggests an attempt to deliver a malicious kernel module.
This rule detects the presence of a Right-to-Left Override (RLO) character (Unicode E2 80 AE) in HTTP response content, specifically within file data. This character can be used in filenames to visually reverse the order of characters, making a file appear to have a different extension or name than it actually does, a common technique for defense evasion and tricking users into executing malicious files.
This rule detects multiple instances of PowerShell executing commands that include 'DownloadString' within a one-hour window on the same computer and by the same account. This behavior is often associated with adversaries attempting to download and execute malicious scripts or files from remote sources.
This rule detects processes making a high volume of network connections (10 or more within an hour) to URLs containing 'release' or 'download'. This behavior can be indicative of malware downloading additional components, updates, or exfiltrating data, but could also be legitimate software updates or large file transfers.
This rule detects the download of potential proof-of-concept (PoC) exploit code for CVEs. It specifically looks for HTTP responses containing a URI that matches the pattern 'CVE-YYYY-NNNN' (e.g., CVE-2023-1234) and also contains the word 'exploit' in the file data. This combination suggests that a client on the internal network is downloading code related to a known vulnerability, which could be for research, testing, or malicious purposes.
This rule detects attempts to download raw payload files (PowerShell scripts, executables, DLLs, batch files, VBScripts, Python scripts, or shell scripts) from raw.githubusercontent.com. This activity is often associated with adversaries attempting to retrieve malicious tools or scripts from code repositories.
This Suricata rule detects potential steganography payloads embedded within image downloads. It specifically looks for the JPEG file signature `FF D8 FF` within the first 3 bytes of an HTTP response, combined with a large file size (greater than 500KB). The rule also includes a threshold to prevent excessive alerts, triggering if 5 such downloads occur from the same destination within 60 seconds. This behavior is indicative of an attempt to hide malicious code or data within seemingly innocuous image files to evade detection.
Obfuscated VBScript Download
Suricata
This rule detects the download of potentially obfuscated VBScript files over HTTP. It specifically looks for the string 'Chr(' repeated multiple times within the first 200 bytes of the file data, which is a common obfuscation technique used in malicious VBScripts to hide their true content.
Payload Download from GitLab Raw
Suricata
This rule detects attempts to download executable or script files (PowerShell, executable, DLL, shell script, Python script) from the 'raw' content section of gitlab.com. This behavior is often associated with adversaries staging or retrieving malicious payloads.
This rule detects the delivery of a file over HTTP that contains the strings "AppDomainManager" and "CreateDomain" (case-insensitive). This combination of strings is indicative of an attempt to hijack the AppDomainManager, a technique used for persistence in .NET applications, often associated with T1574.014 (AppDomainManager Hijacking) from MITRE ATT&CK.
This rule detects the download of JavaScript files (.js or .jse extensions) over HTTP that contain the string "WScript.Shell" (case-insensitive). This string is often used in malicious JavaScript to interact with the Windows operating system, indicating potential trojan activity.
This rule detects the download of a Python script that appears to be a reverse shell. It specifically looks for HTTP traffic (flow:to_client,established) containing the strings "import socket" and "connect(" within the file data, case-insensitive. These strings are common indicators of Python code attempting to establish a network connection, often used in reverse shell implementations.
This rule detects the download of a potentially malicious LNK shortcut file over HTTP. It specifically looks for HTTP responses (flow:to_client) containing a URI with ".lnk" (nocase) and the byte sequence "|4C 00 00 00|" at the beginning of the file data (depth:4), which is characteristic of an LNK file header. This activity is often associated with initial access or execution techniques where attackers use shortcut files to deliver malware or execute malicious commands.
This rule detects when a user clicks on a malicious link, indicated by a referrer from common email/webmail services (mail., webmail., outlook., gmail.), and the subsequent HTTP response contains a Windows executable (MZ header). This suggests a drive-by download attempt or a user being tricked into downloading malware after clicking a phishing link.
Page 58 of 76