Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,866 detections
Filters
Last updated
All Time
Detection languages
1,757
1,593
604
243
199
Contributors
944
801
787
614
315
Categories
20,462
11,849
5,879
5,158
4,866
Platforms
3,711
737
612
405
100
Products / Services
1,458
648
498
272
235
MITRE Techniques
1,330
1,214
888
785
772
CVEs
7
5
5
5
5
IDS Classtypes
546
20
16
5
4
IDS Protocols
417
66
60
39
13
This rule detects the inbound transfer of an AsyncRAT installer executable over HTTP. It specifically looks for HTTP responses with a content-type of 'application/x-msdownload', a 'content-disposition' header indicating an attachment named 'asyncclient.exe', and the presence of 'cloudflare.com' in the HTTP response body, along with the 'MZ' header indicating a Windows executable.
ET MALWARE TA398 CurlBack_RAT CnC Activity - Upload Results
This rule detects HTTP traffic where the User-Agent string contains the case-insensitive substring 'iot'. This is often indicative of compromised IoT devices or botnet activity attempting to blend in or identify themselves.
This rule detects inbound network traffic associated with the Braodo Loader malware. It specifically looks for a unique byte sequence and a specific string within the HTTP response body, indicating the download or communication related to this loader.
This rule detects the inbound transfer of a KoiStealer payload over HTTP. It specifically looks for unique string patterns within the HTTP response body that are indicative of the KoiStealer malware, including specific context definitions and keywords like 'CONTEXT_i386', 'CONTEXT_i486', 'CONTEXT_CONTROL', and 'CONTEXT_INTEGER'. This suggests the rule is designed to identify the download of the malware executable or a component of it.
ET MALWARE Observed Malicious Domain (significant-adopted-bearing-own .trycloudflare .com in TLS SNI)
ET MALWARE Observed Malicious Domain (tamku .shoplerter .opnetorologies .net in TLS SNI)
ET MALWARE Observed Malicious Domain (tamku .shop in TLS SNI)
ET ATTACK_RESPONSE Koi Loader/Stealer CnC Config Inbound
ET ATTACK_RESPONSE KoiStealer Payload Inbound
ET ATTACK_RESPONSE TA399 Fake 404 WebPage Inbound
ET ATTACK_RESPONSE ReverseLoader Base64 Encoded Executable In Image M2
ET ATTACK_RESPONSE ReverseLoader Base64 Encoded Executable In Image M1
ET ATTACK_RESPONSE Observed AsyncRat Installer Inbound
Detects network connections to known Command and Control (C2) servers associated with the LANDFALL Android spyware. The spyware communicates over HTTPS, often on non-standard ports.
Lumma Stealer Payload Inbound
Suricata
This rule detects the inbound transfer of a Lumma Stealer payload over HTTP. Specifically, it looks for a unique content string within the HTTP response body, indicating the download of a DLL file associated with Lumma Stealer. The content string 'filename="fuckingdllENCR.dll"' is a strong indicator of this specific malware.
Detects malformed DNG/TIFF image files used to deliver the LANDFALL Android spyware. These files contain an appended ZIP archive which holds the spyware components.
Detects the LANDFALL Android spyware components, specifically the 'b.so' loader and the 'l.so' SELinux policy manipulator.
Detects malformed DNG/TIFF image files containing an embedded ZIP archive, a technique used to deliver the LANDFALL Android spyware.
Detects DLL side-loading patterns associated with the Lazarus Group's Operation DreamJob campaign. This involves legitimate Windows executables loading malicious DLLs from non-standard paths.
Detects the use of command-line download tools to write a file with a web-related extension to a common web server directory. This behavior is consistent with webshell deployment, as seen in Sandworm campaigns.
Page 184 of 232