Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,867 detections
Filters
Last updated
All Time
Detection languages
1,758
1,593
604
243
199
Contributors
944
801
787
614
315
Categories
20,464
11,852
5,880
5,159
4,867
Platforms
3,712
737
613
406
100
Products / Services
1,458
648
498
272
235
MITRE Techniques
1,330
1,214
889
785
772
CVEs
7
5
5
5
5
IDS Classtypes
546
20
16
5
4
IDS Protocols
417
66
60
39
13
This rule detects the download of a potential post-exploitation framework binary over HTTP. It looks for HTTP responses containing the 'MZ' magic bytes (indicating a Windows executable) and specific keywords like 'beacon', 'agent', 'implant', 'payload', or 'stager' in the HTTP URI. This combination suggests an attempt to deliver malicious tools to a compromised system.
This rule detects the download of known exploit kits by inspecting HTTP URI patterns. It specifically looks for the strings 'rig', 'fallout', 'spelevo', or 'purplefox' followed by 'kit' (case-insensitive) within the HTTP URI. The detection is triggered on traffic flowing to the client that is part of an established connection.
This rule detects HTTP responses that contain hidden keywords, a technique often used in SEO poisoning. It specifically looks for HTML content with 'display:none' and 'font-size:0' which are common methods to hide text from users while still being parsed by search engine crawlers.
Detects installation or execution of known typo-squatted npm packages linked to TeamPCP copycats (Shai-Hulud clones and DDoS botnets).
This rule detects the download of remote support tools such as AnyDesk, TeamViewer, Atera, Splashtop, and ConnectWise. The detection is based on HTTP URI patterns that match these tool names. This activity is often associated with phone scams where attackers trick users into installing remote access software, giving the attackers control over their systems.
This rule detects an unusually high number of file rename events (20 or more within a 1-hour window) initiated by a single process account. This behavior can be indicative of malicious activities such as data staging prior to exfiltration, ransomware encryption, or attempts to evade detection by renaming malicious files or legitimate system utilities.
This rule detects suspicious background downloads initiated via BITS (Background Intelligent Transfer Service) where the HTTP User-Agent contains "Microsoft BITS" and the requested URI ends with common executable or script file extensions (.exe, .dll, .ps1, .bat). This behavior can indicate an adversary using BITS for ingress tool transfer or to download malicious payloads.
This rule detects HTTP downloads where a file is disguised as a PDF but is actually an executable. It specifically looks for the 'MZ' magic bytes (indicating a Windows executable) within the first two bytes of the file data, combined with a '.pdf' extension in the HTTP URI. This is a common technique used by attackers to bypass security filters and trick users into executing malicious code.
Obfuscated VBScript Download
Suricata
This rule detects the download of potentially obfuscated VBScript files over HTTP. It specifically looks for the string 'Chr(' repeated multiple times within the first 200 bytes of the file data, which is a common obfuscation technique used in malicious VBScripts to hide their true content.
This rule detects the download of a malicious Office template file (.dotm) over HTTP. The rule specifically looks for HTTP traffic flowing to the client that contains the ".dotm" string in the URI, indicating a potential template injection attack where a malicious template is delivered to a user.
This rule detects the delivery of a payload that attempts to perform process hollowing using the Runpe technique. It specifically looks for the presence of the Windows API functions 'ZwUnmapViewOfSection' and 'WriteProcessMemory' within HTTP file data being sent to a client. These functions are commonly used in process hollowing to unmap a legitimate process's memory and write malicious code into it.
This rule detects potential APC (Asynchronous Procedure Call) injection attempts over HTTP by looking for the presence of both 'QueueUserAPC' and 'OpenThread' functions in the HTTP response body (flow:to_client). This combination of functions is indicative of a payload delivery mechanism often used in APC injection techniques, which can lead to privilege escalation or arbitrary code execution.
This rule detects potential command and control (C2) communication related to disk wiping activities. It specifically looks for the keywords "wipe" and "disk" (case-insensitive) within 50 bytes of each other in TCP traffic flowing from the server to the client. This pattern suggests a C2 server instructing a compromised client to perform disk wiping, which aligns with the MITRE ATT&CK technique T1561 (Disk Wipe) under the Impact tactic.
This rule detects C2 beaconing activity originating from a potentially injected process. It specifically looks for HTTP traffic where the User-Agent header matches a common Windows Mozilla/5.0 pattern, indicating a Windows client, and the data size is between 1 and 199 bytes. A threshold of 20 such events within 60 seconds from the same source IP triggers the alert, suggesting a beaconing behavior.
This rule detects the delivery of a process injection toolkit over HTTP by looking for the presence of specific Windows API function names, 'VirtualAllocEx' and 'WriteProcessMemory', within the HTTP response body. These functions are commonly used in process injection techniques to allocate memory in a remote process and write malicious code into it.
This rule detects the delivery of potentially malicious Office add-in files (VSTO, XLA, XLAM) or COM files over HTTP. It specifically looks for these file extensions in the HTTP URI and verifies that the file content starts with 'MZ', indicating a Windows executable or DLL.
This rule detects the creation of malicious Outlook rules via Exchange Web Services (EWS). It specifically looks for HTTP traffic to '/EWS/Exchange.asmx' containing the 'CreateRule' string in the client body, indicating an attempt to establish persistence within an Outlook environment.
This rule detects network traffic containing the string "sethc.exe" over TCP port 445 (SMB). This is indicative of an attacker attempting to exploit the 'Sticky Keys' accessibility feature for backdoor access, often by replacing the sethc.exe binary with a malicious executable. The detection specifically looks for this string in traffic flowing to the server on an established connection.
This rule detects the string "LC_LOAD_DYLIB" within HTTP response bodies (file data). This string is associated with the loading of dynamic libraries (DYLIBs) on macOS systems. In a malicious context, this could indicate an attempt to inject a malicious DYLIB into a process, potentially for persistence or code execution. The rule specifically looks for this content in traffic flowing from the server to the client.
This rule detects the delivery of potentially malicious kernel modules or extensions over HTTP. It specifically looks for HTTP responses containing files with '.ko' (Linux kernel object) or '.kext' (macOS kernel extension) file extensions in the URI, indicating a client is downloading such a file. The 'flow:to_client,established' ensures the detection occurs on files being sent from a server to a client over an established HTTP connection.
This rule detects attempts to hijack macOS applications using malicious dynamic libraries (DYLIBs). It specifically looks for HTTP responses containing a URI with the ".dylib" extension and the content "__TEXT" within the file data, indicating a Mach-O executable segment. This combination suggests the delivery of a potentially malicious dynamic library designed for hijacking purposes on macOS systems.
Page 149 of 232