Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,867 detections
Filters
Last updated
All Time
Detection languages
1,758
1,593
604
243
199
Contributors
944
801
787
614
315
Categories
20,465
11,852
5,880
5,159
4,867
Platforms
3,712
737
613
406
100
Products / Services
1,458
648
498
272
235
MITRE Techniques
1,330
1,214
889
785
772
CVEs
7
5
5
5
5
IDS Classtypes
546
20
16
5
4
IDS Protocols
417
66
60
39
13
This rule detects potential process argument spoofing attempts by looking for specific strings within HTTP traffic. It specifically searches for 'CreateProcessW' and 'lpCommandLine' in the file data of HTTP responses, indicating that a client might be receiving a payload designed to create a process with spoofed command-line arguments. This technique is often used by malware to hide its true intentions or evade detection.
This rule detects the delivery of a Microsoft Installer (MSI) package via HTTP that exhibits characteristics of a malicious file. It specifically looks for HTTP responses (flow:to_client) containing a URI with the ".msi" extension (http.uri; content:".msi"; nocase;) and the magic bytes "D0 CF 11 E0" (content:"|D0 CF 11 E0|"; depth:4;) which are indicative of an OLE2 compound document file format, commonly used by MSI files. The rule classifies this activity as 'trojan-activity'.
This rule detects the presence of anti-debugging techniques within HTTP payload data. Specifically, it looks for the strings "IsDebuggerPresent" and "ExitProcess" (case-insensitive) in the HTTP response body. The combination of these strings suggests that a malicious payload might be checking for a debugger and attempting to terminate if one is detected, a common defense evasion technique used by malware.
This rule detects network traffic containing the string "chmod 777" followed by "/tmp/" (case-insensitive) within a TCP flow to a server on port 22. This pattern suggests an attempt to change file permissions to world-writable (777) in the /tmp directory, which is a common tactic used by malware to hide or execute malicious files.
This rule detects the delivery of a fake GUI login prompt over HTTP, likely for credential capture. It looks for HTTP responses (flow:to_client) containing the strings "ShowDialog", "Password", and "GetWindowText" (case-insensitive) within the file data. This combination of keywords suggests an attempt to mimic a legitimate login interface to trick users into providing their credentials.
This rule detects the delivery of a token manipulation tool over HTTP. It specifically looks for the presence of the strings "AdjustTokenPrivileges" and "OpenProcessToken" (case-insensitive) within the file data of an HTTP response. These strings are associated with Windows API calls used for modifying process tokens, which is a common technique for privilege escalation.
This rule detects the execution of 'python.exe' from within common Chromium-based browser application directories (Google Chrome, Microsoft Edge, Brave Browser). This activity is highly suspicious as Python should not legitimately execute from these paths under normal circumstances. Threat actors, such as UNK_DeadDrop, have been observed using this technique to bypass application-bound encryption path validation and steal sensitive data like browser credentials. Detection of this behavior indicates potential malicious activity, including credential theft or other forms of evasion.
This rule identifies accounts that create or modify 10 or more files, each larger than 200MB, within a one-hour period. This behavior can be indicative of data exfiltration, staging of large files, or other suspicious bulk file operations.
This rule detects the download of Office template files (such as .dot, .dotm, .xlt, .xltm, .pot, .potm) that contain VBA project content. This is indicative of potentially malicious Office documents designed to execute macros, often used for initial access or persistence by attackers.
This rule detects attempts to force the installation of browser extensions via a policy page. It specifically looks for the string "ExtensionInstallForcelist" in HTTP response data flowing to the client, indicating a mechanism used to programmatically install extensions, often abused by malware or unwanted programs to maintain persistence or inject malicious functionality into browsers.
This rule detects the download of a Chrome extension file (.crx) from an HTTP server to a client. It specifically looks for the string ".crx" in the HTTP URI and the string "CrOD" within the first 4 bytes of the file data, which is a common magic number for Chrome extension files. This combination suggests a potential malicious Chrome extension download, often used for persistence or other malicious activities.
This rule detects HTTP POST requests to a web server where the URI contains both 'plugin' and 'install' (case-insensitive). This combination of keywords in a POST request URI could indicate an attempt to install a malicious plugin on a web application.
Detects network connections to a specific malicious GitHub raw URL path used by Miasma to download 5th and 6th stage payloads. This rule specifically targets the URL 'raw.githubusercontent.com/letsgo0/sayyadina-phibian-159'.
This rule detects the delivery of a Lua script payload via HTTP. It specifically looks for HTTP responses containing '.lua' in the URI and the string 'os.execute(' within the file data, indicating an attempt to execute commands on the client system. This is often associated with trojan activity.
This rule detects attempts to fetch Python package files (setup.py or __init__.py) from pypi.org over HTTP. This activity could indicate a client attempting to download or interact with Python packages, potentially including malicious ones, from the Python Package Index. The rule uses a threshold to alert on frequent occurrences from the same source.
This rule detects HTTP traffic where a shortened URL (from services like bit.ly, tinyurl, ow.ly, or t.co) is used in the HTTP referer header, and the HTTP response body contains the 'MZ' magic bytes, indicating a Windows executable file. This combination suggests a malicious redirect leading to the download of a payload, often associated with phishing or drive-by download attacks.
This rule detects various stages of a cryptojacking campaign, as described by Microsoft, involving initial access via autorun.dll sideloading, silent MSI installations, execution of RuntimeHost.exe from suspicious locations, scheduled task creation for persistence, .NET process hollowing, Windows Defender exclusions, and persistence via Startup folder shortcuts and Registry Run keys. The campaign leverages ScreenConnect for remote access and .NET utilities for process hollowing, ultimately leading to GPU mining cryptojacking.
This rule detects network connections from devices to a predefined list of known malicious domains. It identifies attempts by internal systems to communicate with command and control servers, phishing sites, or other infrastructure associated with threat actors.
This rule detects suspicious modifications to registry keys under 'Software\Microsoft\Windows\CurrentVersion\Policies' where the registry value data contains '.exe' or '.dll'. Such changes, especially multiple occurrences within a short timeframe (3 or more changes within an hour), can indicate ransomware activity attempting to alter file associations or execution policies to maintain persistence or execute malicious payloads.
Detects suspicious execution patterns indicative of ransomware utilizing batch scripts. This rule triggers when 'cmd.exe' or 'powershell.exe' execute at least 5 times within a 5-minute window, with command lines containing '.bat', '.cmd', or '/c', suggesting automated script execution often seen in ransomware attacks.
This rule detects an unusually high volume of network connections to common proxy ports (3128, 8080, 80, 443) initiated by critical system processes such as 'services.exe', 'svchost.exe', or 'rundll32.exe'. This behavior can indicate the installation and use of a trojan proxy or other malicious software attempting to exfiltrate data or establish command and control through a proxy.
Page 142 of 232