Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,867 detections
Filters
Last updated
All Time
Detection languages
1,758
1,593
604
243
199
Contributors
944
801
787
614
315
Categories
20,463
11,851
5,879
5,159
4,867
Platforms
3,712
737
613
406
100
Products / Services
1,458
648
498
272
235
MITRE Techniques
1,330
1,214
889
785
772
CVEs
7
5
5
5
5
IDS Classtypes
546
20
16
5
4
IDS Protocols
417
66
60
39
13
This rule detects the deployment of a potentially malicious middleware component on an application server. It specifically looks for HTTP POST requests to port 8080 with a URI containing 'deploy' (case-insensitive) and a data size greater than 10000 bytes. This pattern is indicative of a large payload being sent to deploy an application or component, which could be malicious in nature.
This rule detects the download of JavaScript files (.js or .jse extensions) over HTTP that contain the string "WScript.Shell" (case-insensitive). This string is often used in malicious JavaScript to interact with the Windows operating system, indicating potential trojan activity.
This rule detects the download of a Python script that appears to be a reverse shell. It specifically looks for HTTP traffic (flow:to_client,established) containing the strings "import socket" and "connect(" within the file data, case-insensitive. These strings are common indicators of Python code attempting to establish a network connection, often used in reverse shell implementations.
This rule detects the download of a potentially malicious LNK shortcut file over HTTP. It specifically looks for HTTP responses (flow:to_client) containing a URI with ".lnk" (nocase) and the byte sequence "|4C 00 00 00|" at the beginning of the file data (depth:4), which is characteristic of an LNK file header. This activity is often associated with initial access or execution techniques where attackers use shortcut files to deliver malware or execute malicious commands.
This rule detects when a user clicks on a malicious link, indicated by a referrer from common email/webmail services (mail., webmail., outlook., gmail.), and the subsequent HTTP response contains a Windows executable (MZ header). This suggests a drive-by download attempt or a user being tricked into downloading malware after clicking a phishing link.
This rule detects the delivery of a malicious DLL (Dynamic Link Library) file via HTTP download. It specifically looks for HTTP responses (flow:to_client) containing a URI with ".dll" (case-insensitive) and the "MZ" magic bytes at the beginning of the file data, indicating an executable file. This combination suggests a DLL being downloaded to a client system, which could be part of a malware delivery chain.
This rule detects potential API injection payloads, specifically looking for the strings "CreateRemoteThread" and "OpenProcess" within HTTP response data. These API calls are commonly used in techniques like process injection to execute malicious code within another process. The rule is designed to identify the delivery of such payloads to client systems.
This rule detects when a file containing both ".plist" in its HTTP URI and "LaunchDaemon" in its content is delivered via HTTP. This combination suggests the download of a macOS LaunchDaemon property list file, which could be used for persistence or privilege escalation on macOS systems.
This rule detects the download of a potential trojanized installer file over HTTP. It looks for HTTP responses to clients that contain 'setup', 'install', or 'installer' in the URI, have a file size greater than 500KB, and contain the 'MZ' header, indicating a Windows executable. This combination suggests a user is downloading an executable that could be malicious.
This rule detects the download of archive files (ZIP, RAR, 7Z, TAR.GZ) over HTTP that contain an executable file signature ('MZ' header). This combination suggests a potential user execution scenario where a malicious executable might be delivered within an archive.
This rule detects when an executable file (.exe) is copied to a share associated with a removable drive (indicated by 'USBSTOR') over the SMB protocol. This could indicate an attempt to transfer malicious executables to or from a removable device.
This rule detects suspicious software installers being downloaded over HTTP. It looks for HTTP responses containing the 'MZ' header (indicating a Windows executable) with a file size greater than 1MB, and where the HTTP URI contains keywords like 'setup', 'install', or 'update'. The rule is thresholded to trigger if three such events occur from the same source within 60 seconds, aiming to identify potential malware or unwanted software distribution.
This rule detects attempts to download Python packages from the official Python Package Index (PyPI) where the package name in the URI appears to be a typosquatted version of common legitimate packages. Specifically, it looks for HTTP requests to pypi.org with URIs containing 'requets' (instead of 'requests'), 'boto' (instead of 'boto3' or similar), 'djang0' (instead of 'django'), 'flask2' (instead of 'flask'), or 'numpy2' (instead of 'numpy'). This indicates a potential supply chain attack where an attacker has registered a similarly named malicious package to trick users into downloading it.
This rule detects attempts to download typosquatted NPM packages from registry.npmjs.org. It specifically looks for HTTP requests to the NPM registry where the URI contains common typos of popular packages like 'lodash', 'requests', 'express', 'mongoose', and 'momentjs'. This indicates a potential supply chain attack where developers might accidentally download malicious packages due to a typo.
This rule detects HTTP responses containing JavaScript that attempts to redirect the user's browser to another page and executes code using 'eval()'. This combination is often used in malicious web pages to redirect users to exploit kits or phishing sites, and to obfuscate malicious JavaScript.
Detects the specific threat string used by the Miasma/Shai-Hulud malware variant to wipe systems if a stolen token is revoked. This rule looks for the highly unique string 'IfYouInvalidateThisTokenItWillNukeTheComputerOfTheOwner' within process command lines.
This rule detects indicators of compromise (IOCs) associated with the Red Lamassu (JFMBackdoor) campaign. It identifies malicious file hashes, network communication with known command and control (C2) domains and IP addresses, specific file paths and names used by the malware, and registry modifications for persistence. The rule looks for file events, process creations, network connections, and registry changes that match the defined IOCs.
This rule detects various stages of a cryptojacking campaign, as described by Microsoft, involving initial access via autorun.dll sideloading, silent MSI installations, execution of RuntimeHost.exe from suspicious locations, scheduled task creation for persistence, .NET process hollowing, Windows Defender exclusions, and persistence via Startup folder shortcuts and Registry Run keys. The campaign leverages ScreenConnect for remote access and .NET utilities for process hollowing, ultimately leading to GPU mining cryptojacking.
This rule detects the execution of processes where the command line contains keywords commonly associated with malware, specifically 'backdoor', 'rootkit', or 'trojan'. It monitors Windows Security Event ID 4688 (a process creation event) and flags any command lines containing these terms.
Detects when a web browser (Chrome, Edge, Firefox, Brave, Opera) initiates a process that is not another instance of itself. This could indicate a drive-by download, execution of malicious code, or other suspicious activity originating from a browser.
This rule detects network connections or URL click events to a list of domains known to be associated with phishing or malware distribution. The rule specifically looks for connections to these domains that also contain certain path segments like '/wlc/', '/load/', or '/success/', which are often indicative of malicious activity or payload delivery. It also broadly checks for any URL click events containing these suspicious domains.
Page 153 of 232