Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
28 detections
Filters
Last updated
All Time
Detection languages
28
Contributors
28
Categories
25
23
16
6
5
Platforms
26
5
3
Products / Services
28
MITRE Techniques
23
21
3
2
2
IDS Classtypes
1,937
503
461
381
236
28
IDS Protocols
27
1
This rule detects potential thread hijacking attempts by looking for the presence of specific Windows API calls, 'SuspendThread' and 'SetThreadContext', within HTTP client-to-server traffic. These API calls are commonly used in thread hijacking techniques to manipulate the execution flow of a legitimate process, often to inject and execute malicious code. The rule specifically looks for these strings within file data transmitted over HTTP, suggesting an attempt to deliver a payload that utilizes these functions.
This rule detects the presence of the string "ReflectiveLoader" in HTTP response bodies, which is indicative of a Reflective DLL Loading payload. Reflective DLL loading is a technique used by attackers to load a DLL into a process without the need for the DLL to be present on disk, often used for defense evasion.
This rule detects network traffic containing the strings "CreateProcessWithTokenW" and "MAXIMUM_ALLOWED" in HTTP client data. This combination of strings is indicative of a payload attempting a privilege escalation technique, specifically leveraging the Windows API function CreateProcessWithTokenW, often used in conjunction with token manipulation to achieve higher privileges. The `flow:to_client` indicates that the payload is being sent from the server to the client, suggesting a potential download or response containing the malicious code.
This rule detects potential parent PID spoofing attempts by monitoring HTTP traffic for the presence of specific Windows API calls related to process creation and attribute modification. Specifically, it looks for 'UpdateProcThreadAttribute' and 'PROC_THREAD_ATTRIBUTE_PARENT_PROCESS' in the file data of HTTP responses, indicating that a client might be receiving instructions or code to perform parent PID spoofing.
This rule detects the delivery of a Linux ptrace injection tool via HTTP. It specifically looks for the string "ptrace(PTRACE_ATTACH" within HTTP response data, indicating that a file containing this specific ptrace function call is being sent to a client. This technique is often used for process injection and privilege escalation on Linux systems.
This rule detects attempts at token impersonation by looking for the strings "ImpersonateLoggedOnUser" and "DuplicateTokenEx" within HTTP response bodies. This technique is often used by attackers to elevate privileges by impersonating a logged-on user's security token.
This rule detects the delivery of a token manipulation tool over HTTP. It specifically looks for the presence of the strings "AdjustTokenPrivileges" and "OpenProcessToken" (case-insensitive) within the file data of an HTTP response. These strings are associated with Windows API calls used for modifying process tokens, which is a common technique for privilege escalation.
This rule detects HTTP traffic containing the strings "LogonUserA" and "ImpersonateLoggedOnUser" (case-insensitive) in the file data. This combination of strings suggests an attempt to create a token for impersonation, which is a technique used for privilege escalation, specifically related to the MITRE ATT&CK technique T1134.003 (Token Impersonation/Theft: Impersonation). The rule is designed to identify shellcode or malicious code attempting to leverage these Windows API functions for privilege escalation.
This rule detects potential browser exploit delivery via heap spray techniques. It specifically looks for a sequence of 12 NOP (No Operation) instructions (0x90) in HTTP response data flowing to a client. This pattern is commonly used in heap spray attacks to prepare memory for shellcode execution.
This rule detects potential Process Doppelganging attempts by looking for specific Windows API calls related to Transactional NTFS (TxF) within HTTP traffic. Specifically, it looks for the presence of "NtCreateTransaction" and "NtCreateSection" in the file data of HTTP responses, indicating a payload that might be attempting to leverage TxF for process creation manipulation.
This rule detects potential process hollowing activity by looking for specific strings in HTTP client-to-server traffic. It triggers if the traffic contains both 'CREATE_SUSPENDED' and 'NtUnmapViewOfSection' (case-insensitive). These strings are indicative of a technique where a legitimate process is created in a suspended state, its memory unmapped, and then malicious code is injected and executed.
This rule detects the presence of a TLS Callback Injection payload in HTTP traffic flowing from the server to the client. It specifically looks for the case-insensitive strings "TlsCallback" and "IMAGE_TLS_DIRECTORY" within the file data of the HTTP response. This technique is often used by malware to achieve code injection and execution.
This rule detects potential PE injection payloads over HTTP by looking for the presence of both "NtUnmapViewOfSection" and "VirtualAllocEx" in the file data. These API calls are commonly used in process injection techniques, specifically for unmapping legitimate sections of a process and allocating new memory for malicious code.
This rule detects the delivery of a payload that attempts to perform process hollowing using the Runpe technique. It specifically looks for the presence of the Windows API functions 'ZwUnmapViewOfSection' and 'WriteProcessMemory' within HTTP file data being sent to a client. These functions are commonly used in process hollowing to unmap a legitimate process's memory and write malicious code into it.
This rule detects the delivery of a payload containing the string "/proc/self/mem" over HTTP to a client. This string is often associated with process memory write injection techniques, particularly on Linux systems, where an attacker might attempt to write malicious code directly into a process's memory space by interacting with the /proc/self/mem pseudo-file. The rule specifically looks for this content within the file data of an HTTP response flowing to the client.
This rule detects potential APC (Asynchronous Procedure Call) injection attempts over HTTP by looking for the presence of both 'QueueUserAPC' and 'OpenThread' functions in the HTTP response body (flow:to_client). This combination of functions is indicative of a payload delivery mechanism often used in APC injection techniques, which can lead to privilege escalation or arbitrary code execution.
This rule detects the delivery of a process injection toolkit over HTTP by looking for the presence of specific Windows API function names, 'VirtualAllocEx' and 'WriteProcessMemory', within the HTTP response body. These functions are commonly used in process injection techniques to allocate memory in a remote process and write malicious code into it.
This rule detects a 'ListPlanting Injection' attack via the SendMessage API payload within HTTP traffic. It specifically looks for the strings 'LVM_SORTITEMS' and 'SendMessage' (case-insensitive) in the file data of an HTTP response flowing to the client. This type of injection is often associated with shellcode or code injection techniques.
This rule detects the delivery of a Linux VDSO (Virtual Dynamic Shared Object) hijack tool via HTTP. It specifically looks for HTTP traffic to a client containing the strings "[vdso]" and "mprotect" (case-insensitive) within the file data. This combination of strings suggests the presence of code designed to manipulate the VDSO, a technique often used for privilege escalation or evasion on Linux systems.
This rule detects potential DLL injection attempts over HTTP by looking for the presence of both 'LoadLibraryA' and 'VirtualAllocEx' within the file data of an HTTP response. These functions are commonly used in conjunction during DLL injection techniques, where 'VirtualAllocEx' allocates memory in a remote process and 'LoadLibraryA' loads a DLL into that allocated memory. The 'flow:to_client,established' indicates that the detection is looking for these patterns in data flowing from the server to the client over an established HTTP connection.
This rule detects potential process injection shellcode payloads within HTTP responses. It specifically looks for the presence of the strings "OpenProcess" and "CreateRemoteThread" (case-insensitive) in the file data of HTTP responses flowing from the server to the client. These API calls are commonly used in process injection techniques to gain control over another process and execute malicious code.
Page 1 of 2