Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
564 detections
Filters
Last updated
All Time
Detection languages
464
49
14
12
11
Contributors
217
119
88
54
41
Categories
20,443
11,831
5,872
5,155
4,866
564
Platforms
494
55
21
17
14
Products / Services
467
195
64
23
14
MITRE Techniques
180
93
65
63
59
CVEs
4
4
4
4
3
IDS Classtypes
303
37
23
23
21
IDS Protocols
449
3
This rule detects the string "CheckRemoteDebuggerPresent" within HTTP response payloads. This string is associated with an anti-debugging technique used by malware to detect if it's being analyzed in a debugger environment. The rule specifically looks for this content in data flowing from the server to the client (flow:to_client,established; file.data;). The detection is case-insensitive (nocase).
This rule detects the delivery of an HTA (HTML Application) file via HTTP. It specifically looks for HTTP responses containing a URI with the '.hta' extension (case-insensitive) and the content '<HTA:APPLICATION' (case-insensitive) within the file data, indicating an HTA application being served to a client. This technique is often used by attackers for defense evasion and initial access.
This rule detects the delivery of a tool capable of dumping LSASS memory over HTTP. It specifically looks for the string "MiniDumpWriteDump" within HTTP response data, which is a function commonly used by tools to extract credentials from the LSASS process.
This rule detects the delivery of a payload containing the strings "SpAcceptCredentials" and "hook" within HTTP response body data. This pattern is indicative of an SSPI credential hooking attempt, where an attacker tries to intercept or steal credentials by injecting malicious code into the Security Support Provider Interface (SSPI) process. The detection is focused on traffic flowing from the server to the client.
This rule detects the presence of an API hooking payload within HTTP response data, specifically looking for the strings "SetWindowsHookEx" and "WH_KEYBOARD" (case-insensitive). This combination suggests an attempt to intercept keyboard input, which is a common technique used by malware for credential interception.
This rule detects potential EWM (Event-Window-Message) injection attempts via the SetWindowLong API by looking for the presence of both "SetWindowLongPtr" and "GetWindowLongPtr" strings in HTTP client-bound file data. This technique is often used for privilege escalation or code injection.
This rule detects the delivery of a macOS Startup Item Property List (.plist) file via HTTP that contains the string "StartupParameters". This could indicate an attempt to establish persistence on a macOS system by creating or modifying a startup item.
This rule detects the delivery of a payload associated with a COR_PROFILER DLL hijacking technique. It specifically looks for HTTP traffic flowing to the client that contains both the string "COR_PROFILER" and the file extension ".dll" (case-insensitive) within the file data. This indicates an attempt to deliver a malicious DLL that could be used for persistence or privilege escalation by exploiting the COR_PROFILER environment variable.
This rule detects the delivery of a potential autostart payload as a startup script over HTTP. It looks for HTTP URIs containing keywords like 'startup', 'autostart', or 'autorun' (case-insensitive) and checks the file data for the 'MZ' header, indicating an executable file, within the first 2 bytes of the file content. This combination suggests an attempt to deliver an executable that could be configured for persistence.
This rule detects the download of obfuscated JavaScript code that uses 'eval(String.fromCharCode(' to execute content. This pattern is commonly used by malware to hide malicious scripts, often acting as a stager to download and execute further payloads. The detection specifically targets HTTP responses (flow:to_client) containing this string, indicating a client is receiving such obfuscated code.
This rule detects the delivery of a Node.js reverse shell payload over HTTP. It looks for HTTP responses (flow:to_client) containing the strings "require('net')" and "connect(" (case-insensitive), which are indicative of Node.js code attempting to establish a network connection, often for a reverse shell.
This rule detects the delivery of malicious VBScript macros within Office files over HTTP. It specifically looks for the presence of 'CreateObject' and 'WScript.Shell' strings in the file data, which are commonly used by VBScript macros to interact with the operating system and execute commands.
This rule detects the download of Visual Basic Script (VBS, VBE, VBA) files via HTTP. It specifically looks for HTTP responses where the URI contains file extensions commonly associated with Visual Basic scripts, indicating a potential attempt to deliver malicious scripts to a client system.
This rule detects the transfer of a potentially malicious PDF file containing embedded JavaScript over HTTP. It specifically looks for the PDF file header '%PDF' followed by the string '/JavaScript' within the file data, indicating the presence of JavaScript code within the PDF. This is a common technique used by attackers to execute malicious code when the PDF is opened.
This rule detects the opening of a potentially malicious Office document containing macros. It specifically looks for HTTP traffic where the response body contains both "[Content_Types].xml" and "vbaProject", which are indicators of an Office document (like .docx, .xlsx, .pptx) that includes VBA macros. The 'flow:to_client,established' indicates that the document is being downloaded by a client over an established HTTP connection.
This rule detects the presence of the string "ReflectiveLoader" within HTTP response bodies. This string is commonly associated with Reflective DLL Injection techniques, where a malicious DLL is loaded directly into a process's memory without being written to disk. The detection is case-insensitive and focuses on traffic flowing from the server to the client.
This rule detects potential shellcode delivery over HTTP by looking for the presence of specific Windows API function names, 'VirtualAlloc' and 'WriteProcessMemory', within the file data of HTTP responses. These API calls are commonly used in shellcode to allocate memory and write malicious code into a process.
This rule detects the download of a CSV file that contains a Dynamic Data Exchange (DDE) attack payload. Specifically, it looks for HTTP responses delivering a file with a '.csv' extension and the string '=HYPERLINK(' within the file data, indicating a potential DDE exploit attempt.
This rule detects a payload download after a redirect chain, which is a common technique used in user execution attacks. It specifically looks for HTTP responses containing a redirect pattern in the HTTP referer and then checks for the 'MZ' magic bytes (indicating a Windows executable) in the file data within a short depth. This suggests a user being redirected and then automatically downloading a malicious executable.
This rule detects HTTP traffic containing the string "duckyScript" in the file data, indicating a potential payload delivery page associated with OMG Cables or Rubber Ducky devices. These devices are often used for injecting malicious keystrokes or other payloads.
This rule detects suspicious software installers being downloaded over HTTP. It looks for HTTP responses containing the 'MZ' header (indicating a Windows executable) with a file size greater than 1MB, and where the HTTP URI contains keywords like 'setup', 'install', or 'update'. The rule is thresholded to trigger if three such events occur from the same source within 60 seconds, aiming to identify potential malware or unwanted software distribution.
Page 23 of 27