Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,867 detections
Filters
Last updated
All Time
Detection languages
1,758
1,593
604
243
199
Contributors
944
801
787
614
315
Categories
20,468
11,855
5,880
5,159
4,867
Platforms
3,712
737
613
406
100
Products / Services
1,458
648
498
272
235
MITRE Techniques
1,330
1,214
889
785
772
CVEs
7
5
5
5
5
IDS Classtypes
546
20
16
5
4
IDS Protocols
417
66
60
39
13
This rule detects potential air-gap bridging activity via removable media. Specifically, it looks for SMB traffic on port 445 containing the string "USBSTOR" (case-insensitive) and the file extension ".bin" (case-insensitive). This combination suggests a file transfer related to USB storage, possibly a firmware update or a malicious payload, being moved across a network segment, potentially bypassing an air-gapped system.
Detects connections to domains associated with observed ACR Stealer command-and-control infrastructure.
This rule detects the delivery of potentially malicious Microsoft Office startup files (Excel, Word, PowerPoint macro-enabled or binary files) via HTTP. It specifically looks for files with extensions like .xlsb, .xlsm, .docm, .pptm, or .dotm in the HTTP URI and checks for the presence of "vbaProject" content within the file data, indicating the presence of VBA macros which are often used in malicious documents.
This rule detects the delivery of an AppleScript payload over HTTP. It specifically looks for HTTP responses (flow:to_client) that contain the string ".scpt" (case-insensitive) in the HTTP URI. This indicates a potential malicious script being downloaded to a client system, often used for execution on macOS systems.
This rule detects patterns indicative of a USB autorun payload download. Specifically, it looks for HTTP traffic (flow:to_client,established) containing the strings "[autorun]" and "open=" (case-insensitive) within the file data. This combination suggests a client is receiving a file that attempts to leverage the autorun feature, often used by malware for initial execution from removable media.
This rule detects the download of common remote access tools (AnyDesk, TeamViewer, RustDesk, Zoho, Atera, UltraViewer) over HTTP. The detection is triggered when an HTTP response flows to the client, is established, contains a URI, and the URI matches one of the specified tool names using a case-insensitive PCRE. Additionally, the response body size must be greater than 100,000 bytes, indicating a potential executable or installer download. This activity is classified as trojan activity and is associated with the MITRE ATT&CK technique T1566.004 (Phishing: Voice Phishing) and tactic Initial Access, suggesting that the download might occur after a voice phishing call.
Payload Ransomware File Artifacts
Cortex XDR
Detects the creation of files with the .payload extension or the RECOVER_payload.txt ransom note, indicating active encryption by Payload ransomware.
This rule detects attempts to push malicious firmware to a device via TFTP (Trivial File Transfer Protocol). It specifically looks for UDP traffic on port 69 (TFTP) where the packet content starts with "|00 02|" (indicating a TFTP write request) and the data size is greater than 10000 bytes, suggesting a firmware image transfer.
This rule detects HTTP traffic that attempts to impersonate legitimate browser traffic (specifically Chrome on Safari) for command and control (C2) purposes. It looks for a specific User-Agent pattern that mimics Chrome on Safari and a URI pattern consisting of 8 to 16 lowercase alphanumeric characters. A threshold is applied to prevent excessive alerts, triggering if 20 such events occur within 60 seconds from the same source.
This rule detects obfuscated protocol data in non-standard command and control (C2) channels over TCP. It triggers when TCP traffic flows from the home network to any destination, is established, has a data size between 101 and 499 bytes, and occurs at a high frequency (30 times in 60 seconds from the same source). This pattern is indicative of trojan activity, specifically related to command and control communications.
This rule detects potential command and control (C2) communication over TCP that uses AES encryption with a hardcoded key pattern. It specifically looks for the byte sequence "41 45 53" (which corresponds to the ASCII string "AES") within the payload of a TCP flow from the internal network to any external destination. The rule further refines detection by checking for a payload size between 100 and 500 bytes and applies a threshold of 20 occurrences within 60 seconds from the same source IP to reduce false positives. This pattern is indicative of certain malware families that use predictable AES keying for their C2 channels.
This rule detects when an executable file (.exe) is dropped into a shared network folder. It specifically looks for SMB traffic containing both ".exe" and "\\share\\" in the content, indicating a potential attempt to distribute malicious executables or move them laterally within a network.
Detects outbound network connections to 'api.masscan.cloud', a known Miasma Command and Control (C2) domain. This rule identifies potential compromise by the Miasma malware family attempting to communicate with its C2 infrastructure.
Detects the execution of the LotusLite backdoor by identifying its unique command-line argument '--DaDaBar' in conjunction with known executable names ('SmartPrintScreen.exe') or specific staging directories ('\ProgramData\SmartPrint\'). This rule targets a specific execution pattern of the LotusLite malware.
Detects network connections from PowerShell or script interpreters to specific Cloudflare Workers or R2 infrastructure observed hosting steganographic payloads, associated with the 'Evil MSI Background campaign'. This rule identifies attempts to download malicious content from known adversary-controlled Cloudflare resources.
This rule detects potential sandbox evasion techniques by identifying HTTP traffic (specifically client-to-server responses) that contains both 'GetCursorPos' and 'Sleep' within the file data. This combination is often used by malware to check for user interaction (mouse movement) and introduce delays, which can indicate an attempt to determine if it's running in a sandboxed environment.
This rule detects network traffic (specifically HTTP responses) that contains patterns indicative of malware attempting to prevent double execution using mutexes. It looks for the strings "CreateMutex" and "ALREADY_EXISTS" (case-insensitive) within the file data of the HTTP response. This behavior is common in malware to ensure only one instance of itself is running on a system, often as a defense evasion technique.
This rule detects the download of executable files (EXE, DLL, BIN) over HTTP that appear to be stripped of their standard headers. It specifically looks for the 'MZ' magic bytes at the beginning of the file data, indicating a Windows executable, but then implies a lack of full header structure by the 'Stripped Executable Payload Without Headers' message. The rule also requires the file size to be greater than 10000 bytes.
This rule detects HTTP responses containing SVG (Scalable Vector Graphics) content that also embeds base64 encoded data starting with 'TVQAA'. This specific sequence ('TVQAA') is characteristic of a base64 encoded Windows executable (MZ header). The rule aims to identify a technique known as SVG smuggling, where malicious executables are hidden within SVG files and delivered to clients, often as a defense evasion tactic.
This rule detects HTTP responses that contain a URI with a double extension, where the first extension is a common document or image file type (doc, pdf, jpg, png, txt) and the second extension is an executable or script file type (exe, bat, vbs, ps1, cmd). This pattern is often used in file masquerading to trick users into executing malicious files.
This rule detects the delivery of a CMSTP INF file over HTTP that contains specific content indicative of a User Account Control (UAC) bypass attempt. It looks for HTTP responses containing a URI with ".inf", and within the file data, the strings "[DefaultInstall]" and "RegisterOCXs". This combination suggests an attempt to leverage CMSTP (Connection Manager Profile Installer) to execute arbitrary code, often used by adversaries for defense evasion and privilege escalation.
Page 139 of 232