Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
564 detections
Filters
Last updated
All Time
Detection languages
464
49
14
12
11
Contributors
217
119
88
54
41
Categories
20,443
11,831
5,872
5,155
4,866
564
Platforms
494
55
21
17
14
Products / Services
467
195
64
23
14
MITRE Techniques
180
93
65
63
59
CVEs
4
4
4
4
3
IDS Classtypes
303
37
23
23
21
IDS Protocols
449
3
This rule detects the delivery of a raw volume access tool via HTTP. It specifically looks for HTTP traffic (flow:to_client,established) containing the strings "CreateFile", "\\.\", and "GENERIC_READ" within the file data. These strings are indicative of an application attempting to open a raw volume device for direct read access, often a technique used by malware or forensic tools to bypass file system controls.
This rule detects HTML smuggling attempts by identifying the 'msSaveOrOpenBlob' API call within HTTP response bodies. This API is often used by attackers to deliver malicious files directly to a user's browser, bypassing traditional network security controls. The rule specifically looks for the case-insensitive string 'msSaveOrOpenBlob' in the file data of HTTP responses flowing from the server to the client.
This rule detects attempts to masquerade an executable file as a PDF document during an HTTP download. It specifically looks for HTTP responses where the 'Content-Type' header is set to 'application/pdf', but the actual file data begins with the 'MZ' magic bytes, indicating it is a Windows executable.
This rule detects the use of renamed system binaries (svchost, explorer, lsass, csrss) with appended digits (e.g., svchost1.exe) being used as proxy execution. It specifically looks for HTTP responses containing a Windows executable (MZ header) where the HTTP URI matches the pattern of these renamed binaries. This behavior is often indicative of defense evasion tactics by malware.
This rule detects the delivery of a VBA stomped Office document via HTTP. It looks for specific content within the HTTP response body, indicating a Microsoft Office document that has been manipulated to hide malicious VBA macros. The rule specifically checks for the presence of "[Content_Types].xml", "vbaProject", and "PerformanceCache" within the file data, which are characteristic of Office documents containing VBA macros, with "PerformanceCache" being a potential indicator of VBA stomping.
This rule detects network traffic containing the strings "SW_HIDE" and "CreateProcess" within file data in an HTTP response. This combination suggests an attempt to execute a process with a hidden window, which is a common technique used by malicious software to evade detection.
This rule detects the delivery of a malicious Control Panel (.cpl) file over HTTP. It specifically looks for HTTP responses containing a URI ending with ".cpl" (case-insensitive) and the "MZ" magic bytes at the beginning of the file data, indicating an executable file. This technique is often used for defense evasion and to execute malicious code.
This rule detects attempts to leverage Regsvr32 for COM scriptlet remote execution. It specifically looks for HTTP traffic where the URI contains '.sct' (indicating a scriptlet file) and the file data contains XML content with the word 'registration', which are common characteristics of COM scriptlets used in Regsvr32 attacks.
This rule detects the delivery of a payload that uses InstallUtil for proxy execution. It specifically looks for HTTP traffic (flow:to_client,established) containing the strings "System.Configuration.Install" and "Installer" (case-insensitive) within the file data. This pattern is indicative of malicious use of InstallUtil, a legitimate Microsoft utility, to execute code, often for defense evasion.
This rule detects attempts to inject remote office templates via HTTP. It specifically looks for HTTP traffic flowing to the client that contains both 'attachedTemplate' and 'http' (case-insensitive) in the file data, indicating a potential attempt to load a remote template.
This rule detects HTTP responses containing XSL Transform with embedded JScript payloads. It specifically looks for the presence of 'language="JScript"' and 'WScript.Shell' within the file data of an HTTP response flowing to the client. This combination indicates an attempt to execute JScript code, potentially for malicious purposes, often associated with defense evasion or initial access techniques.
This rule detects the delivery of a macOS Keychain Access tool via HTTP. It specifically looks for the string "SecKeychainFindInternetPassword" within the file data of HTTP traffic flowing from the server to the client. This string is indicative of an application attempting to access or manipulate macOS Keychain passwords, suggesting the presence of malware or a malicious utility designed to extract credentials.
This rule detects the download of a potential post-exploitation framework binary over HTTP. It looks for HTTP responses containing the 'MZ' magic bytes (indicating a Windows executable) and specific keywords like 'beacon', 'agent', 'implant', 'payload', or 'stager' in the HTTP URI. This combination suggests an attempt to deliver malicious tools to a compromised system.
This rule detects the download of known exploit kits by inspecting HTTP URI patterns. It specifically looks for the strings 'rig', 'fallout', 'spelevo', or 'purplefox' followed by 'kit' (case-insensitive) within the HTTP URI. The detection is triggered on traffic flowing to the client that is part of an established connection.
This rule detects HTTP responses that contain hidden keywords, a technique often used in SEO poisoning. It specifically looks for HTML content with 'display:none' and 'font-size:0' which are common methods to hide text from users while still being parsed by search engine crawlers.
This rule detects HTTP downloads where a file is disguised as a PDF but is actually an executable. It specifically looks for the 'MZ' magic bytes (indicating a Windows executable) within the first two bytes of the file data, combined with a '.pdf' extension in the HTTP URI. This is a common technique used by attackers to bypass security filters and trick users into executing malicious code.
This rule detects the delivery of a payload that attempts to perform process hollowing using the Runpe technique. It specifically looks for the presence of the Windows API functions 'ZwUnmapViewOfSection' and 'WriteProcessMemory' within HTTP file data being sent to a client. These functions are commonly used in process hollowing to unmap a legitimate process's memory and write malicious code into it.
This rule detects the delivery of a payload containing the string "/proc/self/mem" over HTTP to a client. This string is often associated with process memory write injection techniques, particularly on Linux systems, where an attacker might attempt to write malicious code directly into a process's memory space by interacting with the /proc/self/mem pseudo-file. The rule specifically looks for this content within the file data of an HTTP response flowing to the client.
This rule detects potential APC (Asynchronous Procedure Call) injection attempts over HTTP by looking for the presence of both 'QueueUserAPC' and 'OpenThread' functions in the HTTP response body (flow:to_client). This combination of functions is indicative of a payload delivery mechanism often used in APC injection techniques, which can lead to privilege escalation or arbitrary code execution.
This rule detects the delivery of a process injection toolkit over HTTP by looking for the presence of specific Windows API function names, 'VirtualAllocEx' and 'WriteProcessMemory', within the HTTP response body. These functions are commonly used in process injection techniques to allocate memory in a remote process and write malicious code into it.
This rule detects the delivery of potentially malicious Office add-in files (VSTO, XLA, XLAM) or COM files over HTTP. It specifically looks for these file extensions in the HTTP URI and verifies that the file content starts with 'MZ', indicating a Windows executable or DLL.
Page 19 of 27