Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,867 detections
Filters
Last updated
All Time
Detection languages
1,758
1,593
604
243
199
Contributors
944
801
787
614
315
Categories
20,465
11,852
5,880
5,159
4,867
Platforms
3,712
737
613
406
100
Products / Services
1,458
648
498
272
235
MITRE Techniques
1,330
1,214
889
785
772
CVEs
7
5
5
5
5
IDS Classtypes
546
20
16
5
4
IDS Protocols
417
66
60
39
13
This rule identifies accounts that create or modify 10 or more files, each larger than 200MB, within a one-hour period. This behavior can be indicative of data exfiltration, staging of large files, or other suspicious bulk file operations.
This rule detects the execution of a VDSO hijacking payload over an SSH connection. It specifically looks for the case-insensitive strings "vdso" and "mmap" within the TCP payload of an established SSH session, indicating an attempt to manipulate the Virtual Dynamic Shared Object (VDSO) for privilege escalation or other malicious purposes.
This rule detects potential process hollowing activity by looking for specific strings in HTTP client-to-server traffic. It triggers if the traffic contains both 'CREATE_SUSPENDED' and 'NtUnmapViewOfSection' (case-insensitive). These strings are indicative of a technique where a legitimate process is created in a suspended state, its memory unmapped, and then malicious code is injected and executed.
This rule detects the presence of a TLS Callback Injection payload in HTTP traffic flowing from the server to the client. It specifically looks for the case-insensitive strings "TlsCallback" and "IMAGE_TLS_DIRECTORY" within the file data of the HTTP response. This technique is often used by malware to achieve code injection and execution.
Identifies the creation of '.node' payload modules by Lucid Stealer in the Common AppData folder, indicative of the SEA payload staging its remote control and theft modules. This rule specifically looks for file creation events where the file name ends with '.node' and the folder path matches a pattern under the user's local AppData 'Common' folder.
Detects the staging of the Lucid Stealer hidden self-copy loader and the SQLite CLI helper binary in the Temp directory. This rule specifically looks for file creation events in the user's Temp directory with filenames matching patterns associated with Lucid Stealer's staging activities: 'winupd_*.exe' for its self-copy loader and '_sq3e_*.exe' for its SQLite helper.
Detects the execution of the initial stage DLL payload (endpointdlp.dll) via rundll32.exe calling a specific ordinal (#2) to decrypt and load the final MLTBackdoor payload. This behavior is highly specific to the MLTBackdoor threat.
This rule detects attempts to abuse the macOS AuthorizationExecuteWithPrivileges function, which allows an application to execute a command with root privileges. The detection is based on the presence of the string "AuthorizationExecuteWithPrivileges" in HTTP response data, indicating a potential attempt by malware or an attacker to escalate privileges on a macOS system.
This rule detects potential PE injection payloads over HTTP by looking for the presence of both "NtUnmapViewOfSection" and "VirtualAllocEx" in the file data. These API calls are commonly used in process injection techniques, specifically for unmapping legitimate sections of a process and allocating new memory for malicious code.
This rule detects the delivery of a payload designed to bypass macOS Transparency, Consent, and Control (TCC) mechanisms via HTTP. Specifically, it looks for the string "kTCCServiceCamera" within HTTP response data, indicating an attempt to manipulate camera access permissions. This activity is often associated with privilege escalation techniques on macOS.
Detects the staging and installation of the G DATA Avk.exe sideloading set within the unexpected C:\Users\Public\GData\ directory, associated with a Mustang Panda PlugX campaign. This rule specifically looks for the creation of files named "Avk.exe", "Avk.dll", or "AVKTray.dat" in this suspicious public user directory.
This rule detects the delivery of a tool designed to bypass User Account Control (UAC) via HTTP. It specifically looks for HTTP responses containing the strings "IsUserAnAdmin" and "ShellExecute" (case-insensitive) within the file data, indicating the presence of code commonly used in UAC bypass techniques.
This rule detects the download of Visual Studio Code (VS Code) or other Integrated Development Environment (IDE) extensions from official marketplaces (marketplace.visualstudio.com or open-vsx.org) when the downloaded file has a .vsix or .crx extension. This could indicate an attempt to install a malicious extension.
Botnet C2 Panel Access Detected
Suricata
This rule detects potential access to a botnet command and control (C2) panel. It triggers when HTTP URI requests contain both 'panel' and 'bot' (case-insensitive) within the URI. A threshold of 5 such requests from the same source within 60 seconds is set to reduce false positives.
This rule detects HTTP traffic where the referer header contains domains commonly associated with advertising networks (doubleclick.net, adnxs.com, googlesyndication) and the URI contains file extensions typically used for executable or script files (exe, ps1, msi, hta, vbs). This combination suggests a malvertising redirect attempt leading to the download of malicious files.
This rule detects the delivery of an Application Shim Database (.sdb file) over HTTP. Application Shims are used by Windows to ensure compatibility with older applications, but can also be abused by attackers for persistence and privilege escalation (e.g., by shimming malicious DLLs). Detecting the transfer of these files, especially over unencrypted HTTP, can indicate suspicious activity related to T1546.011 (Application Shimming).
This rule detects the delivery of a macOS Launch Daemon Property List (.plist) file via HTTP. Attackers often use Launch Daemons for persistence on macOS systems. The rule specifically looks for HTTP traffic containing '.plist' in the URI and 'LaunchDaemon' within the file data, indicating a potential attempt to establish persistence.
This rule detects the download of potential malware source code by inspecting HTTP URI paths and file data. It triggers if the HTTP URI contains keywords like 'rat', 'trojan', 'keylogger', 'ransomware', or 'botnet' (case-insensitive) and the downloaded file data contains the string 'import socket' (case-insensitive). This combination suggests the download of Python-based malware source code.
This rule detects attempts to upload files containing the 'MZ' magic bytes (indicating a Windows executable) to known file-sharing services such as transfer.sh, mega.nz, mediafire, or anonfiles. It specifically looks for HTTP POST requests with file data.
This rule detects HTTP responses that indicate a potential drive-by download infrastructure redirect. Specifically, it looks for HTTP responses to clients that contain the word "redirect" (case-insensitive) in the URI and also contain the "MZ" magic bytes at the beginning of the file data, suggesting an executable file is being served. This combination implies a server is redirecting to or serving an executable file, which is a common tactic in drive-by download attacks.
This rule detects the download of executable installer files (MSI or EXE) over HTTP that are larger than 500KB and contain the 'MZ' header, which is characteristic of Windows executables. The rule specifically looks for these files being delivered to a client within the home network. The message indicates a potential 'Executable Installer with Weak File Permission Exploit', suggesting that the downloaded file might be malicious or used in an exploit chain related to weak file permissions.
Page 146 of 232