Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,866 detections
Filters
Last updated
All Time
Detection languages
1,757
1,593
604
243
199
Contributors
944
801
787
614
315
Categories
20,460
11,847
5,879
5,158
4,866
Platforms
3,711
737
612
405
100
Products / Services
1,458
648
498
272
235
MITRE Techniques
1,330
1,214
888
785
772
CVEs
7
5
5
5
5
IDS Classtypes
546
20
16
5
4
IDS Protocols
417
66
60
39
13
This rule detects a potential watering hole attack where a legitimate website has been injected with a script that attempts to load content from an IP address. Specifically, it looks for HTTP responses (flow:to_client) containing '<script src=' followed by a URL where the source is an IP address (e.g., 'src="http://1.2.3.4/script.js"'). This technique is often used by attackers to compromise visitors of a trusted site by redirecting them to malicious content or exploiting vulnerabilities.
This rule detects potential drive-by exploit kit landing pages by inspecting HTTP response data for the presence of both "exploit" and "shellcode" (case-insensitive). It specifically looks for these keywords in the data flowing from the server to the client over an established HTTP connection. The rule is categorized as an exploit-kit detection and is associated with MITRE ATT&CK technique T1189 (Drive-by Compromise) and tactic Initial Access.
Detects the creation of a scheduled task named 'SystemUpdate' using 'schtasks.exe', which is a persistence mechanism observed in the Phantom Bot malware distributed via malicious npm packages. The rule specifically looks for the 'create' action and the 'SystemUpdate' task name in the command line.
This rule detects an unusually high number of executable (.exe or .msi) file creations within common installation or binary folders (containing 'setup', 'install', or 'bin' in their path) by a single process within a one-hour window. This behavior could indicate the staging or unpacking of malicious software, or a legitimate but potentially suspicious installation activity.
Identifies the SHA-256 hash associated with the BLUEBEAM (Godzilla) web shell payload (LoadLibrary.dll) dropped during KnowledgeDeliver exploitation. This rule looks for the specific hash across file creation, image load, or process execution events.
Detects the execution of cmd.exe when it is spawned by a temporary executable named 'svcXXX.exe' (where XXX is a 3 to 6 digit number) located in the user's AppData\Local\Temp directory. This pattern is indicative of the CrystalX RAT's behavior.
This rule detects suspicious DLL side-loading activity. It looks for DLL files being loaded from common user-writable or temporary directories (like `\temp\` or `\users\`) by legitimate Windows processes such as `rundll32.exe`, `explorer.exe`, or `svchost.exe`. The rule specifically flags instances where a DLL is loaded more than 3 times within an hour by these processes, indicating potential malicious activity where an adversary might be attempting to execute their own malicious DLLs by hijacking the loading process of a legitimate application.
This rule detects potential Agent Tesla malware activity by correlating process execution with network connections. It looks for processes named 'agenttesla.exe', 'atsvc.exe', or 'atservice.exe' that execute with command-line arguments indicative of data exfiltration (e.g., 'smtp', 'ftp', 'http.post', 'exfil'). The rule then correlates these process events with outbound network connections to non-private IP addresses, flagging instances where multiple process runs and multiple network connections occur within a 30-minute window.
This rule detects network connections originating from clients using a specific User-Agent string associated with the SessionGate malware. The User-Agent string 'NSIS_InetLoad' combined with 'Mozilla' is indicative of SessionGate C2 check-ins, leveraging the NSIS (Nullsoft Scriptable Install System) InetLoad plugin. The rule searches across common proxy and web logs for this pattern.
Identifies npm or node executing lifecycle scripts (e.g., preinstall) for known malicious typosquatted packages. This campaign utilizes these hooks to silently execute a stage-2 credential harvester targeting cloud environments.
This rule detects potential command and control (C2) activity where a compromised WordPress site is used as a relay. It specifically looks for HTTP POST requests to URIs containing "wp-admin" with a data size greater than 1000 bytes. A threshold of 5 such events within 60 seconds from the same source IP triggers the alert, indicating a potential high volume of C2 communication.
MSHTA HTA Application Download
Suricata
This rule detects the download of an HTML Application (HTA) file that contains the string "<HTA:APPLICATION". HTA files can be used to execute malicious code, often bypassing browser security restrictions. The rule specifically looks for HTTP traffic where the URI contains ".hta" and the file data contains the HTA application tag, indicating a potential attempt to deliver or execute a malicious HTA.
This rule detects the delivery of shellcode via HTTP that contains a NOP sled pattern. The rule specifically looks for a sequence of eight or more '90' (hexadecimal) bytes in the HTTP response body, which is a common indicator of a NOP sled used to prepare for shellcode execution. The detection is focused on traffic flowing from the server to the client over an established HTTP connection.
This rule detects the download of a potential bootkit payload designed to overwrite the Master Boot Record (MBR). It specifically looks for HTTP traffic where the file data contains the byte sequence '|55 AA|' (which corresponds to the MBR signature) within the first 512 bytes and has a total size greater than 500 bytes. This pattern is indicative of malicious software attempting to modify the MBR for persistence or system control.
This rule detects potential JavaScript obfuscation within HTTP responses by looking for the presence of both 'eval(' and 'unescape(' within the first 500 bytes of file data in a client-bound HTTP flow. This combination of functions is often used in malicious JavaScript to hide its true intent and evade detection.
Havoc C2 Agent Beacon Detected
Suricata
This rule detects beaconing activity associated with the Havoc C2 agent. It specifically looks for HTTP POST requests to the '/login' URI, with a User-Agent header of 'Mozilla/5.0', and a data size between 101 and 499 bytes. A threshold of 10 such events within 60 seconds from the same source IP triggers the alert, indicating potential command and control communication.
This rule detects the presence of a common China Chopper web shell pattern in HTTP client body content. Specifically, it looks for the string "eval(base64_decode(" (case-insensitive) within HTTP requests flowing to the server. This pattern is characteristic of how China Chopper web shells execute commands on compromised web servers.
This rule detects HTTP traffic where the URI contains ".sct" (scriptlet) in a case-insensitive manner. This is indicative of an attempt to download a scriptlet, which can be used by MSHTA (Microsoft HTML Application host) for defense evasion, often to execute malicious code.
This rule detects the presence of a large Base64 encoded string (at least 100 characters) within the HTTP client body of network traffic. This pattern is often used by attackers to obfuscate malicious payloads, aligning with the MITRE ATT&CK technique T1027 for Defense Evasion.
This rule detects the download of executable files (such as .exe, .dll, .bat, .ps1, .vbs, .hta) over HTTP. It specifically looks for the 'MZ' header, which is characteristic of Windows executables, and checks the HTTP URI for common executable file extensions. This activity is often associated with initial access or command and control techniques where adversaries download malicious payloads.
Detects the creation of specific Payouts King ransomware artifacts, including its ransom note ('readme_locker.txt') and known encrypted file extensions ('.ZWIAAW') or temporary backup file extensions ('.esVnyj'). This rule focuses on file creation events indicative of a Payouts King ransomware infection.
Page 158 of 232