Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,867 detections
Filters
Last updated
All Time
Detection languages
1,758
1,593
604
243
199
Contributors
944
801
787
614
315
Categories
20,468
11,855
5,880
5,159
4,867
Platforms
3,712
737
613
406
100
Products / Services
1,458
648
498
272
235
MITRE Techniques
1,330
1,214
889
785
772
CVEs
7
5
5
5
5
IDS Classtypes
546
20
16
5
4
IDS Protocols
417
66
60
39
13
Detects the creation of files with names commonly associated with LockBit ransomware, such as '.lockbit', 'lockbit_note', or '.abcd'. This rule specifically looks for these file names being created on devices, which is indicative of ransomware activity.
This rule detects the presence of the string "io.popen(" within HTTP response data. This string is indicative of a Lua script attempting to execute shell commands, which is a common technique used by malware to achieve arbitrary code execution on a compromised system. The rule specifically looks for this pattern in data flowing from the server to the client (flow:to_client), suggesting a malicious script being delivered to a user's browser or an application.
This rule detects the download of AutoHotKey (AHK) or AutoIt (AU3) script files over HTTP. These script files are often used for automation but can also be leveraged by attackers for malicious purposes, such as executing arbitrary code, keylogging, or other forms of automation in an attack chain. The rule specifically looks for HTTP responses where the URI contains file extensions '.ahk' or '.au3'.
This rule detects suspicious file drops over SMB (port 445) that contain both ".lnk" (likely a shortcut file) and "System32" in their content. This combination is often indicative of malware attempting to spread via removable media, using shortcut files to execute malicious payloads, potentially mimicking legitimate system directories.
Detects network connections to specific API endpoints used by the HarborWatch Agent for Command and Control (C2) communication. This rule helps identify active C2 beaconing and tasking, even if the underlying IP infrastructure changes, by monitoring for unique URI paths like '/api/agent/tasks/' and '/api/heartbeat'.
ClickFix RAT C2 Connection
Cortex XDR
Detects network traffic to the primary command and control (C2) IP address (104.207.131.216) over port 16443, which is used by the ClickFix Python Remote Access Trojan (RAT) for malicious communication.
This rule detects HTTP traffic to JetBrains Remote IDE tunnel domains (jetbrains.space or gateway.jetbrains.com). This activity is flagged as potential Command and Control (C2) communication, specifically leveraging remote access software for malicious purposes. A threshold of 10 connections within 60 seconds from a single source IP is set to reduce alerts on legitimate, less frequent usage.
This rule detects Fast Flux DNS activity, specifically rapid IP rotation on a single domain. It triggers when a destination IP address associated with a DNS query changes at least 20 times within a 10-second window. This behavior is characteristic of fast fluxing, a technique used by malware to hide command and control servers behind a constantly changing set of IP addresses.
This rule detects attempts to exfiltrate wireless network lists (SSIDs) over HTTP POST requests. It specifically looks for HTTP POST requests with a body size greater than 200 bytes that contain the string "SSID" (case-insensitive). This activity is indicative of a trojan attempting to steal network information.
This rule detects the use of the Sliver C2 Framework based on a specific pattern in the TLS certificate subject. It looks for the common name (CN) 'multiplayer' within the TLS certificate subject, which is a known indicator for Sliver C2 communications.
This rule detects internal HTTP file transfers using the PUT method, specifically looking for executable files (identified by the 'MZ' header) being transferred. This behavior is indicative of a possible tool drop within a network, aligning with the MITRE ATT&CK technique T1570 (Lateral Movement - Internal HTTP File Transfer). The rule focuses on traffic within the home network, suggesting an internal adversary or compromised host attempting to move malicious tools.
This rule detects DNS queries that match a specific pattern indicative of C2 fallback domain rotation. The pattern looks for domains consisting of 8 to 12 alphanumeric characters followed by a top-level domain (TLD) from a list including .top, .xyz, .club, .icu, or .pw. This behavior is often associated with malware using domain generation algorithms (DGAs) or similar techniques for command and control communication, specifically as a fallback mechanism when primary C2 channels are disrupted.
This rule detects potential sandbox evasion techniques by identifying HTTP traffic containing specific API calls often used by malware to determine if it's running in a sandboxed environment. Specifically, it looks for the 'GetForegroundWindow' function, which retrieves a handle to the foreground window, and the 'Sleep' function, which can be used to delay execution and bypass time-based sandbox analysis. The combination of these two indicates an attempt to check for user interaction and evade detection.
This rule detects HTTP responses (flow:to_client) that contain specific strings indicative of an environment-keyed payload checking the domain before execution. Specifically, it looks for the case-insensitive strings "GetComputerNameEx" and "NetworkDomain" within the file data of the HTTP response. This behavior is often associated with malware attempting to determine its execution environment to evade analysis or target specific systems.
This rule detects when an executable file is embedded within an Office document that is being downloaded over HTTP. It specifically looks for the presence of both the Office document content type indicator "[Content_Types].xml" and the "MZ" magic bytes, which signify a Windows executable, within the same file data stream. This combination is a strong indicator of a malicious Office document attempting to deliver malware.
This rule detects network traffic where a TLS certificate is presented with an issuer's common name (CN) containing at least 8 alphanumeric characters and a subject organization (O) that includes common company suffixes like 'LLC', 'Ltd', or 'Inc'. This combination, especially with an unusually formatted issuer CN, could indicate an invalid or suspicious code signing certificate used for executables, potentially associated with trojan activity or defense evasion tactics.
This rule detects the download of a compressed executable payload over HTTP. It specifically looks for HTTP traffic flowing to the client that contains both the GZIP magic number (1F 8B) and the Windows executable magic number (MZ) within the file data. This combination suggests a compressed executable file being delivered, which is a common technique used by malware to evade detection.
This rule detects DNS queries for TXT records that contain a long, base64-encoded string, which could indicate a fileless payload being stored or retrieved via DNS. The rule specifically looks for TXT records with content matching a regular expression for base64-encoded strings of at least 80 characters.
This rule detects when an executable file is masquerading as an image file during an HTTP download. It specifically looks for HTTP responses with a 'Content-Type: image/' header, but where the file data begins with 'MZ', which is the magic number for Windows Portable Executable (PE) files. This indicates a potential attempt to bypass security controls by disguising malicious executables as benign image files.
This rule detects HTTP responses from a server to a client that contain the phrase "Your computer is infected" (case-insensitive). This is indicative of a fake security alert page, often used in social engineering attacks to trick users into downloading malware or providing credentials. The rule specifically looks for this content within the file data of an established HTTP flow directed to the client.
This rule detects the delivery of an executable file over HTTP where the filename in the URI contains a space character immediately before the file extension '.exe'. This technique is often used by attackers to obfuscate the true file type or to bypass basic file type checks, making the file appear as a non-executable or a different file type to a casual observer or some automated systems. The rule specifically looks for the pattern '.exe ' (dot, exe, space) in the HTTP URI, case-insensitive.
Page 141 of 232