Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,866 detections
Filters
Last updated
All Time
Detection languages
1,757
1,593
604
243
199
Contributors
944
801
787
614
315
Categories
20,460
11,847
5,879
5,158
4,866
Platforms
3,711
737
612
405
100
Products / Services
1,458
648
498
272
235
MITRE Techniques
1,330
1,214
888
785
772
CVEs
7
5
5
5
5
IDS Classtypes
546
20
16
5
4
IDS Protocols
417
66
60
39
13
This rule detects attempts to drop executable files (.exe) into shared network folders (specifically those containing '\share\') over SMB (Server Message Block) protocol. This activity is indicative of an attacker attempting to move tools or malware laterally within a network.
This rule detects a pattern indicative of ransomware encrypting files over SMB. It specifically looks for TCP traffic on port 445 (SMB) within the home network, containing the byte sequence '|FF|SMB'. A threshold of 500 such events from a single source IP within 30 seconds triggers the alert, classifying it as trojan activity.
XOR Encoded C2 Traffic Pattern
Suricata
This rule detects HTTP client body traffic that appears to be XOR encoded, characterized by a long sequence of non-printable ASCII characters (bytes 0x01-0x1f and 0x7f-0xff) of at least 50 characters. This pattern is often indicative of Command and Control (C2) communication used by malware to evade detection.
This rule detects HTTP C2 beaconing activity characterized by regular interval GET requests. It specifically looks for 20 GET requests within a 60-second window from the same source IP address to any destination. This pattern is indicative of command and control communication, often used by malware to check in with its operators.
This rule detects DNS queries for domains ending with '.onion', which are typically associated with the Tor network. In the context of ransomware, this pattern can indicate communication with Command and Control (C2) servers hosted on the dark web, often used for exfiltration or receiving further instructions.
This rule detects HTTP requests where the URI contains the string "ransom" (case-insensitive). This pattern is indicative of potential ransomware command and control (C2) check-ins, as ransomware often uses terms like 'ransom' in its communication with C2 servers.
Detects the creation of a scheduled task named '\MicrosoftSystem64', which is a specific Indicator of Compromise (IoC) associated with the Windows variant of the FAMOUS CHOLLIMA / MicrosoftSystem64 RAT malware for persistence. The rule identifies this activity through Windows Event Log (Event ID 4698 for task creation), command-line execution of 'schtasks.exe' with '/create' and the specific task name, and Defender EDR telemetry for scheduled task creation.
This rule detects potential command and control (C2) communication over SMTP by looking for repeated 'EHLO' commands within a short timeframe from the same source IP address. The threshold is set to trigger if 10 'EHLO' commands are observed within 300 seconds (5 minutes) from a single source.
This rule detects a potential FTP C2 (Command and Control) channel exhibiting a regular beaconing pattern. It triggers an alert if 10 or more TCP connections are made to port 21 (FTP) from a single source IP address within a 300-second window, indicating established communication from the internal network to an external FTP server. This behavior is characteristic of malware using FTP for C2 communications.
This rule detects a high volume of DNS NXDOMAIN (Non-Existent Domain) responses originating from a single source IP address within a short timeframe. This pattern is indicative of Domain Generation Algorithm (DGA) activity, often used by malware for command and control (C2) beaconing. The threshold is set to trigger if 20 NXDOMAIN responses are observed from the same source within 60 seconds.
This rule detects the delivery of a kernel driver enumeration tool via HTTP. Specifically, it looks for the string "EnumDeviceDrivers" (case-insensitive) within HTTP response data flowing to a client. This string is indicative of tools or malware attempting to enumerate loaded kernel drivers, which is a common reconnaissance technique used by attackers.
Detects process executions or command-line arguments referencing the installation of identified malicious npm packages, specifically 'chalk-tempalte', '@deadcode09284814/axios-util', 'axois-utils', and 'color-style-utils'. These packages are associated with 'Shai-Hulud clones' and 'Phantom Bot' campaigns, often involving typosquatting or similar deceptive naming conventions to trick developers into installing malicious dependencies.
This rule detects HTTP requests that contain 'gcc' and '-o' in the URI, which could indicate an attempt to compile malware on a host using the GCC compiler. This activity is often associated with defense evasion techniques where an attacker compiles malicious code directly on a compromised system.
This rule detects attempts to install a kernel module (rootkit) on a Linux system via an SSH session. It specifically looks for the 'insmod' command followed by a '.ko' file extension within TCP traffic destined for port 22 (SSH). This combination suggests an attacker is trying to load a malicious kernel object.
This rule detects network traffic on TCP port 445 (SMB) containing the string "wintrust.dll" in a case-insensitive manner. This specific DLL is associated with Windows Trust Provider functionality. The detection is flagged as 'trojan-activity' and is linked to MITRE ATT&CK technique T1553.003 (Code Signing: Code Signing Policy Modification) and tactic Defense Evasion, suggesting an attempt to bypass code signing policies by replacing or manipulating the wintrust.dll.
This rule detects the delivery of a payload designed to bypass trust controls via HTTP. It specifically looks for HTTP responses (flow:to_client) containing the 'MZ' magic bytes (indicating an executable file) within the first 2 bytes of the file data, combined with URI paths that include keywords like 'bypass', 'unsigned', or 'notrust'. This combination suggests an attempt to deliver malicious or untrusted executables that aim to circumvent security mechanisms.
This rule detects the string "DisableAntiSpyware" in HTTP response bodies. This string is often associated with commands or responses related to disabling security defenses, specifically anti-spyware features, which is a common tactic used by malware or attackers for defense evasion. The rule is designed to alert when such a command or response is delivered to a client within an established HTTP flow.
This rule detects HTTP responses containing a Windows executable (identified by the 'MZ' header) where the URI path suggests it's masquerading as a legitimate Windows system binary like svchost.exe, winlogon.exe, lsass.exe, services.exe, or csrss.exe. This is a common technique used by malware to evade detection by appearing as a trusted process.
This rule detects the delivery of a hidden virtual file system container over HTTP. It looks for HTTP traffic flowing to the client that contains both the string "VirtualDisk" (case-insensitive) and the "MZ" header (indicating a Windows executable or DLL) within the file data. This combination suggests the download of a malicious executable designed to create or utilize a hidden virtual disk.
This rule detects the presence of an XOR decoding routine within a downloaded script. It specifically looks for the keywords "XOR" and "fromCharCode" (case-insensitive) in the file data of HTTP traffic flowing to the client. This combination is often used by malicious scripts to deobfuscate their payload.
This rule detects the string "mount --bind" within TCP traffic on port 22 (SSH). This string indicates an attempt to create a bind mount, which can be used by attackers to obscure the true location of malicious files or to manipulate file system access. The rule specifically looks for this activity on the home network, suggesting an internal system being targeted or used for malicious purposes.
Page 155 of 232