Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
564 detections
Filters
Last updated
All Time
Detection languages
464
49
14
12
11
Contributors
217
119
88
54
41
Categories
20,443
11,831
5,872
5,155
4,866
564
Platforms
494
55
21
17
14
Products / Services
467
195
64
23
14
MITRE Techniques
180
93
65
63
59
CVEs
4
4
4
4
3
IDS Classtypes
303
37
23
23
21
IDS Protocols
449
3
ET ATTACK_RESPONSE ClickFix CnC Response (Click Logged Successfully)
ET ATTACK_RESPONSE Unknown Payload Downloader Inbound
ET ATTACK_RESPONSE Observed ClickFix Powershell Delivery Page Inbound
ET ATTACK_RESPONSE Observed ClickFix Powershell Delivery Page (Portuguese)
This rule detects the 'Stop-ScheduledTask' PowerShell cmdlet within the HTTP response body, indicating that a client on the internal network is receiving a command to stop a scheduled task. This could be part of an adversary's attempt to disable persistence mechanisms or disrupt system operations.
ET ATTACK_RESPONSE Likely ClickFix Related Staging Domain
ET ATTACK_RESPONSE HTML Smuggling Powershell Payload In iframe
This rule detects the inbound transfer of an AsyncRAT installer executable over HTTP. It specifically looks for HTTP responses with a content-type of 'application/x-msdownload', a 'content-disposition' header indicating an attachment named 'asyncclient.exe', and the presence of 'cloudflare.com' in the HTTP response body, along with the 'MZ' header indicating a Windows executable.
This rule detects the presence of the PowerShell cmdlet 'Set-ScheduledTask' within the HTTP response body. This could indicate an attacker using a web-based mechanism to deliver or execute commands related to scheduled task creation or modification on a compromised system, potentially for persistence.
This rule detects the presence of the 'schtasks /query' command within the HTTP response body. This could indicate an attacker enumerating scheduled tasks on a compromised system, potentially as part of reconnaissance or lateral movement activities. The rule specifically looks for 'schtasks' and '/query' (case-insensitive) in HTTP responses with a 200 status code.
This rule detects the presence of the 'schtasks /create' command within the HTTP response body. This could indicate an adversary attempting to schedule tasks on a compromised system by delivering the command via an HTTP response, potentially for persistence or execution.
This rule detects the presence of the PowerShell cmdlet 'Start-ScheduledTask' within the HTTP response body. This could indicate an attacker attempting to establish persistence on a compromised system by creating scheduled tasks, potentially delivered via a web-based command and control channel or during an exploit.
This rule detects the presence of the PowerShell cmdlet 'Disable-ScheduledTask' within the HTTP response body. This could indicate an attacker attempting to disable scheduled tasks on a compromised system, potentially to remove persistence mechanisms or hinder forensic analysis. The rule specifically looks for a successful HTTP status code (200) and the 'disable-scheduledtask' string, optionally preceded by '-taskname' or '-taskpath'.
This rule detects inbound network traffic associated with the Braodo Loader malware. It specifically looks for a unique byte sequence and a specific string within the HTTP response body, indicating the download or communication related to this loader.
This rule detects the inbound transfer of a KoiStealer payload over HTTP. It specifically looks for unique string patterns within the HTTP response body that are indicative of the KoiStealer malware, including specific context definitions and keywords like 'CONTEXT_i386', 'CONTEXT_i486', 'CONTEXT_CONTROL', and 'CONTEXT_INTEGER'. This suggests the rule is designed to identify the download of the malware executable or a component of it.
This rule detects the presence of 'activeMQConnectionURL' and 'tcp://' within HTTP response bodies, which is indicative of a Commvault server exposing its hostname or connection details. This information could be leveraged by attackers for reconnaissance or to identify vulnerable Commvault instances.
ET ATTACK_RESPONSE Base64 Encoded Powershell Performing Byte Operations Inbound
ET ATTACK_RESPONSE Koi Loader/Stealer CnC Config Inbound
This rule detects the presence of the PowerShell cmdlet 'Enable-ScheduledTask' within the HTTP response body. This could indicate an attacker using a web server to deliver or instruct a client to enable a scheduled task, potentially for persistence or privilege escalation. The detection specifically looks for 'enable-scheduledtask' case-insensitively, optionally preceded by '-taskname' or '-taskpath', within a successful HTTP 200 OK response.
This rule detects the string "schtasks" followed by "/end" and then "/tn" within the HTTP response body. This pattern indicates that a client is receiving a response that contains a command to end a scheduled task using the `schtasks` utility. This could be part of a command-and-control communication or a lateral movement attempt where an adversary is managing scheduled tasks on a compromised system.
This rule detects the presence of 'schtasks' followed by '/delete' and '/tn' (task name) in the HTTP response body with a 200 status code. This could indicate an attacker attempting to delete scheduled tasks on a compromised Windows system, potentially to remove forensic evidence or disrupt legitimate operations. The detection is case-insensitive and uses a PCRE to match the specific command structure.
Page 26 of 27