Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,867 detections
Filters
Last updated
All Time
Detection languages
1,758
1,593
604
243
199
Contributors
944
801
787
614
315
Categories
20,465
11,852
5,880
5,159
4,867
Platforms
3,712
737
613
406
100
Products / Services
1,458
648
498
272
235
MITRE Techniques
1,330
1,214
889
785
772
CVEs
7
5
5
5
5
IDS Classtypes
546
20
16
5
4
IDS Protocols
417
66
60
39
13
This rule detects HTTP responses from a server to a client that contain specific strings ('ComputerName', 'UserName', and 'MZ') within the file data. The presence of 'MZ' at the beginning (depth:2) suggests an executable file. The combination of these strings indicates a potential 'guardrail' payload checking the environment (computer name and user name) before executing, which is a common technique used by malware to evade analysis environments or target specific systems. The rule is designed to identify trojan activity related to defense evasion.
This rule detects attempts to replace system binaries via malicious updates by inspecting HTTP responses. It specifically looks for HTTP traffic directed to the client, containing a file with the 'MZ' header (indicating a Windows executable) and a URI path that suggests a system binary location (e.g., /bin/, /sbin/, /usr/bin/). This combination indicates a potential malicious update delivering an executable to a critical system directory.
This rule detects network traffic containing the string "LSSharedFileList" (case-insensitive) on TCP port 22 (SSH). This string is associated with macOS Login Items, which can be used for persistence by adversaries. The rule specifically looks for this content in traffic flowing from the client to the server.
This rule detects the use of SVG files for HTML smuggling payloads. Specifically, it looks for HTTP responses containing an SVG file ('.svg' in the URI) that also contain '<script' and 'Blob(' within its data. This combination is indicative of an HTML smuggling technique where malicious content is hidden within a seemingly innocuous SVG file and then processed by JavaScript to construct a malicious payload, often a file download.
This rule detects network traffic on TCP port 445 (SMB) containing the case-insensitive string "Print Processors". This pattern is indicative of an attempt to register a malicious Print Processor DLL for persistence, a technique used by adversaries to maintain access to a system. The rule specifically looks for traffic flowing to the home network, suggesting an inbound attempt to establish persistence.
This rule detects potential malware payloads encrypted with RC4. It specifically looks for HTTP responses (flow:to_client,established) containing the string "RC4" (case-insensitive) and a long base64-like string (at least 100 characters, optionally ending with padding) within the file data. This combination suggests an RC4-encrypted payload being delivered to a client.
This rule detects attempts to masquerade an executable file as a PDF document during an HTTP download. It specifically looks for HTTP responses where the 'Content-Type' header is set to 'application/pdf', but the actual file data begins with the 'MZ' magic bytes, indicating it is a Windows executable.
This rule detects the delivery of a payload via HTTP that contains the string "SetWindowsHookEx" (case-insensitive). This string is associated with a Windows API function used to install a hook procedure that monitors system events. Attackers often use this technique for persistence or to inject malicious code into other processes.
This rule detects network traffic containing the string "signal(SIGTERM, SIG_IGN)" case-insensitively, indicating a process attempting to ignore the SIGTERM signal. This behavior can be used by malware or adversaries to achieve persistence on Linux systems by making a process harder to terminate gracefully.
This rule detects attempts to spoof process arguments to evade detection by looking for specific strings in HTTP traffic. It specifically looks for the strings "NtQueryInformationProcess" and "ProcessCommandLineInformation" (case-insensitive) in file data within established HTTP client-to-server flows. This behavior is often associated with malware or advanced persistent threats trying to hide their true command-line arguments from security tools.
This rule detects the delivery of a VBA stomped Office document via HTTP. It looks for specific content within the HTTP response body, indicating a Microsoft Office document that has been manipulated to hide malicious VBA macros. The rule specifically checks for the presence of "[Content_Types].xml", "vbaProject", and "PerformanceCache" within the file data, which are characteristic of Office documents containing VBA macros, with "PerformanceCache" being a potential indicator of VBA stomping.
This rule detects the use of the JamPlus build tool for potentially malicious execution. It specifically looks for HTTP traffic where the URI contains 'jamplus' or 'jam.exe' and the file data starts with 'MZ', indicating an executable file download. This combination suggests an attempt to deliver or execute a malicious JamPlus-compiled executable.
This rule detects attempts to move executable files (.exe) over SMB (Server Message Block) by looking for the 'MoveFile' string and the '.exe' extension in network traffic on port 445. This activity could indicate malware being relocated on a network share.
This rule detects the delivery of a Compiled HTML Help (CHM) file via HTTP that contains the string "ITSF" within its file data. CHM files can be used to deliver malicious content, and the presence of "ITSF" (likely indicating an InfoTech Storage Format header) combined with HTTP delivery suggests a potential attempt to bypass security controls or execute malicious code. This is often associated with T1218.001 (Signed Binary Proxy Execution: Compiled HTML Help) from the MITRE ATT&CK framework.
This rule detects the delivery of a Windows Credential Manager dump tool over HTTP. It specifically looks for the case-insensitive string "CredEnumerate" within the file data of an HTTP response flowing to the client. This string is indicative of tools designed to interact with or dump credentials from the Windows Credential Manager.
Detects process command lines executing an `_index.js` payload using the Bun runtime, which is characteristic of the Hades stealer's execution chain where a Python loader downloads Bun to execute an obfuscated JavaScript payload.
This rule flags a large number of files receiving a '.lalia' extension at once, indicating potential Lalia ransomware activity. Bulk extension changes are a common initial indicator of ransomware infection. The rule looks for at least 20 file events (renamed, created, or modified) where the file name ends with '.lalia' within a 30-day window.
This rule detects various stages of a cryptojacking campaign, as described by Microsoft, involving initial access via autorun.dll sideloading, silent MSI installations, execution of RuntimeHost.exe from suspicious locations, scheduled task creation for persistence, .NET process hollowing, Windows Defender exclusions, and persistence via Startup folder shortcuts and Registry Run keys. The campaign leverages ScreenConnect for remote access and .NET utilities for process hollowing, ultimately leading to GPU mining cryptojacking.
This YARA rule detects Compiled HTML Help (CHM) files based on specific internal strings related to their structure and compilation. The rule identifies CHM files that contain internal data space and compression references, as well as specific compiler signatures such as "Free Pascal's chm package 3.0.4", "CHMCmd 3.0.4", and "HHA Version 4.74.8702". While the rule's name suggests detection of JavaScript execution via PowerShell within CHM files, the current string-based logic primarily focuses on the file's internal characteristics and compiler metadata, which can be indicative of potentially malicious CHM files used in attack campaigns.
This rule detects the download of a file over HTTP that contains the string "=cmd|" (case-insensitive) within its data. This pattern is indicative of a DDE (Dynamic Data Exchange) formula injection attempt, often used in Office documents to execute commands.
This rule detects attempts by users to download fake software cracks, keygens, activators, patches, or serials from HTTP servers. It specifically looks for HTTP responses containing URIs with keywords like 'crack', 'keygen', 'activator', 'patch', or 'serial' (case-insensitive) and verifies that the downloaded file data starts with 'MZ', indicating a Windows executable. This combination suggests a user is downloading potentially malicious software disguised as a legitimate software cracking tool.
Page 144 of 232