Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
452 detections
Filters
Last updated
All Time
Detection languages
251
100
69
13
8
Contributors
113
74
46
46
44
Categories
20,427
11,813
5,871
5,145
4,864
Platforms
302
94
46
43
29
Products / Services
317
231
88
54
28
MITRE Techniques
171
167
100
60
59
CVEs
4
3
2
2
2
IDS Classtypes
5
3
3
1
1
IDS Protocols
7
6
Detects the download of executable, script, archive, and document file types from hosts associated with dynamic DNS services. These services are often abused by adversaries for command and control or for hosting malicious content due to their ability to frequently change IP addresses, making them harder to track and block.
Detects network requests to '/pwndrop/' URI paths, which are indicative of communication with a PwnDrp web server. PwnDrp is a tool developed for red team testing and is also known to be used for malicious activities, typically for command and control or data exfiltration.
Detects the use of WebDAV by a client, specifically identifying the 'Microsoft-WebDAV-MiniRedir/' user agent during a GET request. This behavior is often associated with 'DownloadCradle' techniques used by adversaries to download malicious content or exfiltrate data.
Detects attempts to download a Flash Player update from a suspicious, non-official location. This rule specifically looks for requests containing '/flash_install.php' or ending with '/install_flash_player.exe' that do not originate from a legitimate Adobe domain.
Detects HTTP User-Agent strings that end with an equal sign, which can be an indicator of Base64 encoding. This technique is often used by malware to obfuscate C2 communications.
Malware User Agent
Sigma
Detects suspicious user agent strings used by malware in proxy logs
Detects Baby Shark C2 Framework default communication patterns
Detects WebDav DownloadCradle
Detects suspicious encoded User-Agent strings, as seen used by some malware.
Detects suspicious malformed user agent strings in proxy logs
Detects User Agent strings that end with an equal sign, which can be a sign of base64 encoding.
Page 22 of 22