Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
564 detections
Filters
Last updated
All Time
Detection languages
464
49
14
12
11
Contributors
217
119
88
54
41
Categories
20,443
11,831
5,872
5,155
4,866
564
Platforms
494
55
21
17
14
Products / Services
467
195
64
23
14
MITRE Techniques
180
93
65
63
59
CVEs
4
4
4
4
3
IDS Classtypes
303
37
23
23
21
IDS Protocols
449
3
This rule detects attempts to spoof a Windows login credential dialog box over HTTP. It specifically looks for the string "CredUIPromptForCredentials" (case-insensitive) within the file data of HTTP traffic flowing from the server to the client. This string is associated with the Windows Credential UI API, and its presence in unexpected contexts, especially in HTTP responses, could indicate a phishing attempt or malware trying to trick users into entering credentials.
This rule detects potential brute force or enumeration attempts against an IIS web server by identifying a high volume of access denied (HTTP 401 or 403) responses from a single IP address within a one-hour window. A count of 20 or more such responses from the same IP is considered suspicious.
This rule detects potential brute force or enumeration attempts against an IIS web server by identifying a high volume of access denied (HTTP 401 or 403) responses from a single IP address within a one-hour window. A count of 20 or more such responses from the same IP is considered suspicious.
This rule detects the download of potential proof-of-concept (PoC) exploit code for CVEs. It specifically looks for HTTP responses containing a URI that matches the pattern 'CVE-YYYY-NNNN' (e.g., CVE-2023-1234) and also contains the word 'exploit' in the file data. This combination suggests that a client on the internal network is downloading code related to a known vulnerability, which could be for research, testing, or malicious purposes.
This rule detects attempts to fingerprint a browser's configuration using JavaScript by looking for the presence of 'navigator.userAgent' and 'navigator.platform' within HTTP response data. This technique is often used during reconnaissance phases by attackers to gather information about a target's browser environment.
This rule detects attempts to harvest credentials using a fake Microsoft login page. It triggers when HTTP traffic from the server to the client contains both "microsoftonline" and "password" in the file data, and the HTTP host is an IP address. This combination suggests a phishing attempt where a malicious server is impersonating a Microsoft login page to capture user credentials.
This Suricata rule detects potential steganography payloads embedded within image downloads. It specifically looks for the JPEG file signature `FF D8 FF` within the first 3 bytes of an HTTP response, combined with a large file size (greater than 500KB). The rule also includes a threshold to prevent excessive alerts, triggering if 5 such downloads occur from the same destination within 60 seconds. This behavior is indicative of an attempt to hide malicious code or data within seemingly innocuous image files to evade detection.
This rule detects the delivery of a malicious document exploiting CVE-2021-40444, an MSHTML remote code execution vulnerability. It specifically looks for HTTP traffic containing a Word document (word/document.xml) with embedded relationships that include an HTTP reference, indicating an attempt to fetch remote content, which is characteristic of the exploit delivery mechanism.
This rule detects a 'ListPlanting Injection' attack via the SendMessage API payload within HTTP traffic. It specifically looks for the strings 'LVM_SORTITEMS' and 'SendMessage' (case-insensitive) in the file data of an HTTP response flowing to the client. This type of injection is often associated with shellcode or code injection techniques.
This rule detects the delivery of a Linux VDSO (Virtual Dynamic Shared Object) hijack tool via HTTP. It specifically looks for HTTP traffic to a client containing the strings "[vdso]" and "mprotect" (case-insensitive) within the file data. This combination of strings suggests the presence of code designed to manipulate the VDSO, a technique often used for privilege escalation or evasion on Linux systems.
This rule detects potential DLL injection attempts over HTTP by looking for the presence of both 'LoadLibraryA' and 'VirtualAllocEx' within the file data of an HTTP response. These functions are commonly used in conjunction during DLL injection techniques, where 'VirtualAllocEx' allocates memory in a remote process and 'LoadLibraryA' loads a DLL into that allocated memory. The 'flow:to_client,established' indicates that the detection is looking for these patterns in data flowing from the server to the client over an established HTTP connection.
This rule detects potential process injection shellcode payloads within HTTP responses. It specifically looks for the presence of the strings "OpenProcess" and "CreateRemoteThread" (case-insensitive) in the file data of HTTP responses flowing from the server to the client. These API calls are commonly used in process injection techniques to gain control over another process and execute malicious code.
This rule detects the delivery of a malicious Outlook form script over HTTP. It specifically looks for HTTP traffic flowing to the client that contains the strings "IPM.Note", "Script", and "VBScript" within the file data, indicating an attempt to deliver a VBScript-based Outlook form.
This rule detects the delivery of a file over HTTP that contains the strings "AppDomainManager" and "CreateDomain" (case-insensitive). This combination of strings is indicative of an attempt to hijack the AppDomainManager, a technique used for persistence in .NET applications, often associated with T1574.014 (AppDomainManager Hijacking) from MITRE ATT&CK.
This rule detects when a system daemon configuration file, specifically one containing ".service" in its URI and "[Service]" in its content, is delivered via HTTP from any source to the internal network. This could indicate an attempt to establish persistence or modify system services on a compromised host.
This rule detects the download of JavaScript files (.js or .jse extensions) over HTTP that contain the string "WScript.Shell" (case-insensitive). This string is often used in malicious JavaScript to interact with the Windows operating system, indicating potential trojan activity.
This rule detects the download of a Python script that appears to be a reverse shell. It specifically looks for HTTP traffic (flow:to_client,established) containing the strings "import socket" and "connect(" within the file data, case-insensitive. These strings are common indicators of Python code attempting to establish a network connection, often used in reverse shell implementations.
This rule detects the download of a potentially malicious LNK shortcut file over HTTP. It specifically looks for HTTP responses (flow:to_client) containing a URI with ".lnk" (nocase) and the byte sequence "|4C 00 00 00|" at the beginning of the file data (depth:4), which is characteristic of an LNK file header. This activity is often associated with initial access or execution techniques where attackers use shortcut files to deliver malware or execute malicious commands.
This rule detects when a user clicks on a malicious link, indicated by a referrer from common email/webmail services (mail., webmail., outlook., gmail.), and the subsequent HTTP response contains a Windows executable (MZ header). This suggests a drive-by download attempt or a user being tricked into downloading malware after clicking a phishing link.
This rule detects the delivery of a malicious DLL (Dynamic Link Library) file via HTTP download. It specifically looks for HTTP responses (flow:to_client) containing a URI with ".dll" (case-insensitive) and the "MZ" magic bytes at the beginning of the file data, indicating an executable file. This combination suggests a DLL being downloaded to a client system, which could be part of a malware delivery chain.
This rule detects potential API injection payloads, specifically looking for the strings "CreateRemoteThread" and "OpenProcess" within HTTP response data. These API calls are commonly used in techniques like process injection to execute malicious code within another process. The rule is designed to identify the delivery of such payloads to client systems.
Page 21 of 27