Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,581 detections
Filters
Last updated
All Time
Detection languages
729
235
193
112
98
Contributors
323
311
275
169
73
Categories
20,427
11,813
5,871
5,145
4,864
1,581
Platforms
1,042
289
181
159
111
Products / Services
497
264
238
141
128
MITRE Techniques
852
757
502
416
312
CVEs
5
3
3
3
2
IDS Classtypes
211
4
3
3
2
IDS Protocols
219
7
3
1
1
This rule detects HTTP responses containing a Windows executable (identified by the 'MZ' header) where the URI path suggests it's masquerading as a legitimate Windows system binary like svchost.exe, winlogon.exe, lsass.exe, services.exe, or csrss.exe. This is a common technique used by malware to evade detection by appearing as a trusted process.
This rule detects the delivery of a hidden virtual file system container over HTTP. It looks for HTTP traffic flowing to the client that contains both the string "VirtualDisk" (case-insensitive) and the "MZ" header (indicating a Windows executable or DLL) within the file data. This combination suggests the download of a malicious executable designed to create or utilize a hidden virtual disk.
This rule detects the presence of an XOR decoding routine within a downloaded script. It specifically looks for the keywords "XOR" and "fromCharCode" (case-insensitive) in the file data of HTTP traffic flowing to the client. This combination is often used by malicious scripts to deobfuscate their payload.
This rule detects HTTP responses that contain a Windows executable (indicated by 'MZ' header) and where the HTTP URI path contains specific Windows utility names (mshta, rundll32, regsvr32, msiexec, installutil, cmstp). This combination suggests a potential attempt to use signed binaries as proxies for malicious execution, a common defense evasion technique.
This rule detects the delivery of an HTA (HTML Application) file via HTTP. It specifically looks for HTTP responses containing a URI with the '.hta' extension (case-insensitive) and the content '<HTA:APPLICATION' (case-insensitive) within the file data, indicating an HTA application being served to a client. This technique is often used by attackers for defense evasion and initial access.
This rule detects the delivery of a tool capable of dumping LSASS memory over HTTP. It specifically looks for the string "MiniDumpWriteDump" within HTTP response data, which is a function commonly used by tools to extract credentials from the LSASS process.
Detects network connections attempting to download the specific Bun v1.3.13 archive from the oven-sh GitHub repository, which is used by the stage 3 bootstrapper in the Miasma npm malware campaign.
Detects the use of bitsadmin.exe to download the Argamal RAT encrypted payload file (zaesdl.dat), a technique utilized in the Stage 2 delivery script.
This rule detects the delivery of a macOS Startup Item Property List (.plist) file via HTTP that contains the string "StartupParameters". This could indicate an attempt to establish persistence on a macOS system by creating or modifying a startup item.
This rule detects the download of installer packages (MSI, PKG, DEB, RPM) over HTTP that contain the string 'CustomAction'. This combination is often used by malicious installers to establish persistence on a system by creating custom actions that execute at specific events.
This rule detects the delivery of a payload associated with a COR_PROFILER DLL hijacking technique. It specifically looks for HTTP traffic flowing to the client that contains both the string "COR_PROFILER" and the file extension ".dll" (case-insensitive) within the file data. This indicates an attempt to deliver a malicious DLL that could be used for persistence or privilege escalation by exploiting the COR_PROFILER environment variable.
This rule detects the delivery of a potential autostart payload as a startup script over HTTP. It looks for HTTP URIs containing keywords like 'startup', 'autostart', or 'autorun' (case-insensitive) and checks the file data for the 'MZ' header, indicating an executable file, within the first 2 bytes of the file content. This combination suggests an attempt to deliver an executable that could be configured for persistence.
Detects the initial script execution phase of the Red Lamassu JFMBackdoor infection chain, specifically PowerShell downloading components into the TEMP directory. This rule looks for PowerShell execution that uses common download commandlets (Invoke-WebRequest, iwr, wget, Net.WebClient) to save specific Red Lamassu payload filenames (FLTLIB.dll, scr.mui, flt.bin, fltMC.exe) into a temporary directory.
This rule detects the download of obfuscated JavaScript code that uses 'eval(String.fromCharCode(' to execute content. This pattern is commonly used by malware to hide malicious scripts, often acting as a stager to download and execute further payloads. The detection specifically targets HTTP responses (flow:to_client) containing this string, indicating a client is receiving such obfuscated code.
This rule detects the download of a Python script that contains code indicative of operating system command execution. Specifically, it looks for the strings "os.system(" and "subprocess" within HTTP response data, suggesting the script intends to execute system commands.
This rule detects the delivery of malicious VBScript macros within Office files over HTTP. It specifically looks for the presence of 'CreateObject' and 'WScript.Shell' strings in the file data, which are commonly used by VBScript macros to interact with the operating system and execute commands.
This rule detects the download of Visual Basic Script (VBS, VBE, VBA) files via HTTP. It specifically looks for HTTP responses where the URI contains file extensions commonly associated with Visual Basic scripts, indicating a potential attempt to deliver malicious scripts to a client system.
This rule detects the transfer of a potentially malicious PDF file containing embedded JavaScript over HTTP. It specifically looks for the PDF file header '%PDF' followed by the string '/JavaScript' within the file data, indicating the presence of JavaScript code within the PDF. This is a common technique used by attackers to execute malicious code when the PDF is opened.
This rule detects the download of a CSV file that contains a Dynamic Data Exchange (DDE) attack payload. Specifically, it looks for HTTP responses delivering a file with a '.csv' extension and the string '=HYPERLINK(' within the file data, indicating a potential DDE exploit attempt.
This rule detects a payload download after a redirect chain, which is a common technique used in user execution attacks. It specifically looks for HTTP responses containing a redirect pattern in the HTTP referer and then checks for the 'MZ' magic bytes (indicating a Windows executable) in the file data within a short depth. This suggests a user being redirected and then automatically downloading a malicious executable.
This rule detects the download of files that have a 'double extension' pattern, specifically where a common document or image file extension (pdf, doc, jpg, png) is followed by an executable extension (exe, bat, vbs, ps1). This pattern is often used by attackers to trick users into executing malicious files, as the operating system might only display the first extension, making the file appear benign. The detection is based on analyzing the HTTP URI for this specific naming convention.
Page 60 of 76