Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,867 detections
Filters
Last updated
All Time
Detection languages
1,758
1,593
604
243
199
Contributors
944
801
787
614
315
Categories
20,463
11,851
5,879
5,159
4,867
Platforms
3,712
737
613
406
100
Products / Services
1,458
648
498
272
235
MITRE Techniques
1,330
1,214
889
785
772
CVEs
7
5
5
5
5
IDS Classtypes
546
20
16
5
4
IDS Protocols
417
66
60
39
13
This rule detects attempts to upload malicious web server modules, plugins, or components. It specifically looks for HTTP PUT requests to URIs containing '/modules/', '/plugins/', or '/components/' and checks the file data for the 'MZ' header, indicating an executable file (likely a Windows executable or DLL). This combination suggests an attacker is trying to upload a malicious executable to a web server's module/plugin directory for persistence or further compromise.
This rule detects attempts to drop a payload into the Microsoft Word startup folder via SMB. The detection is based on the presence of the string "Word\STARTUP" (case-insensitive) in SMB traffic flowing to the server on port 445. This activity is indicative of persistence mechanisms used by attackers to ensure malicious code executes when Word starts.
This rule detects when a file containing the string "XLSTART" (case-insensitive) is written to a network share via SMB. This is indicative of an attempt to establish persistence by placing malicious files in the Microsoft Office startup folder, which will be executed when Office applications launch.
This rule detects the delivery of a Windows Dynamic Link Library (DLL) file via HTTP that could be used for execution flow hijacking. It specifically looks for HTTP responses containing a URI with '.dll', the 'MZ' magic bytes at the beginning of the file data, and a file size greater than 10,000 bytes, indicating a potentially legitimate or malicious DLL being downloaded to a client.
This rule detects attempts to plant a DLL file in an application's 'Program Files' directory over SMB. This is a common technique used in DLL hijacking attacks, where a malicious DLL is placed in a location where a legitimate application will load it instead of the intended system DLL. The rule specifically looks for SMB traffic to port 445, containing '.dll' and '\Program Files\' in a case-insensitive manner, indicating a file transfer to a sensitive application directory.
This rule detects potential Remote Access Trojan (RAT) callbacks occurring after a remote support session. It specifically looks for HTTP GET requests where the URI contains keywords like 'setup', 'install', 'support', or 'remote' (case-insensitive) and the User-Agent header contains 'MSIE'. This combination suggests a possible RAT communicating with its command and control server, masquerading as legitimate remote support or installation traffic.
This rule detects the download of a Microsoft Office document that is macro-enabled. It specifically looks for HTTP traffic flowing to the client (download) that contains both "[Content_Types].xml" and "vbaProject" within the file data. These strings are indicative of an Office Open XML (OOXML) file (like .docx, .xlsx, .pptx) that contains VBA macros, which are often used in phishing attacks for initial access.
This rule detects the download of a compiled AutoIT script payload over HTTP. It specifically looks for the 'AU3!' magic bytes at the beginning of the file data, which is characteristic of compiled AutoIT executables. The detection is focused on traffic flowing from the server to the client (to_client) and assumes an established connection.
This rule detects HTTP responses that contain specific keywords indicative of a fake CAPTCHA paste attack page. It looks for the terms "CAPTCHA", "paste", and "Win+R" (case-insensitive) within the HTTP response body. This combination suggests a social engineering attempt where users are tricked into pasting malicious content, often after being instructed to open the 'Run' dialog (Win+R).
This rule detects HTTP responses where the 'Content-Type' header is 'application/json' and the response body contains both 'balance' and '0.00' (case-insensitive). This combination, especially in the context of a 'trojan-activity' classification, suggests a potential Man-in-the-Middle (MitM) attack manipulating financial or account balance data within a JSON response to show a zero balance.
This rule detects drive-by malicious iframe injection by looking for HTTP responses (flow:to_client) that contain an iframe tag, the 'display:none' style attribute, and a 'src=' attribute. This combination is often used by attackers to embed malicious content invisibly into legitimate websites, leading to drive-by downloads or other client-side attacks.
This rule detects potential malicious script injection from ad networks. It looks for HTTP responses (flow:to_client) that contain common ad-related terms in the HTTP referer header (ad., ads., advert., banner.) and also contain JavaScript code obfuscation techniques like 'eval(' and 'fromCharCode' within the file data. This combination suggests an ad network might be serving malicious JavaScript to clients.
This rule detects C2 traffic that attempts to impersonate legitimate Microsoft Update services. It specifically looks for HTTP traffic where the host header contains 'windowsupdate.com' or 'update.microsoft.com' (case-insensitive) and the User-Agent header contains 'Windows-Update-Agent'. A threshold of 10 occurrences within 60 seconds from the same source IP triggers the alert, indicating potential command and control activity trying to blend in with normal Windows update traffic.
This rule detects HTTP POST requests from the home network to any destination that contain a large amount of junk data padding in the client body. Specifically, it looks for a client body size greater than 1000 bytes and a PCRE match for at least 500 alphanumeric characters, indicating potential command and control (C2) communication using data padding for obfuscation or to bypass detection. A threshold is set to trigger an alert if 10 such requests are observed from the same source within 60 seconds.
This rule detects suspicious TLS certificates that are valid for only one day and have a common name (CN) consisting of 6 or more alphanumeric characters. This pattern is often associated with malware or command and control (C2) activity, where certificates are generated on the fly with short validity periods to evade detection.
This rule detects network traffic (HTTP response) from a server to a client that contains both 'GetUserDefaultLCID' and 'ExitProcess' in the file data, case-insensitively. This combination of strings is indicative of malware attempting to evade sandboxes or target specific locales by checking the system's default locale identifier and then potentially exiting if the environment is not suitable. This behavior is often associated with trojan activity.
This rule detects the delivery of source code files (C, C++, C#, Java, Go, Rust) over HTTP to a client, specifically looking for content that includes 'main(' within the file data. This pattern suggests that a source code payload intended for compilation after delivery is being transferred, which could be indicative of malicious activity such as a staged attack where the attacker compiles and executes code on the victim's machine.
This rule detects potential sandbox evasion techniques by identifying HTTP responses containing a 'Sleep(' function call with a duration of 1,000,000 milliseconds (1000 seconds) or more. This long sleep duration is often used by malware to delay execution and bypass time-based sandboxes, which typically have limited execution times for analysis.
This rule detects the delivery of a raw volume access tool via HTTP. It specifically looks for HTTP traffic (flow:to_client,established) containing the strings "CreateFile", "\\.\", and "GENERIC_READ" within the file data. These strings are indicative of an application attempting to open a raw volume device for direct read access, often a technique used by malware or forensic tools to bypass file system controls.
This rule detects HTML smuggling attempts by identifying the 'msSaveOrOpenBlob' API call within HTTP response bodies. This API is often used by attackers to deliver malicious files directly to a user's browser, bypassing traditional network security controls. The rule specifically looks for the case-insensitive string 'msSaveOrOpenBlob' in the file data of HTTP responses flowing from the server to the client.
This rule detects the use of renamed system binaries (svchost, explorer, lsass, csrss) with appended digits (e.g., svchost1.exe) being used as proxy execution. It specifically looks for HTTP responses containing a Windows executable (MZ header) where the HTTP URI matches the pattern of these renamed binaries. This behavior is often indicative of defense evasion tactics by malware.
Page 147 of 232