Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,937 detections
Filters
Last updated
All Time
Detection languages
1,930
3
2
1
1
Contributors
592
477
360
250
124
Categories
995
927
834
546
538
Platforms
1,753
214
81
54
41
Products / Services
1,868
1,144
65
51
17
MITRE Techniques
564
412
305
201
175
CVEs
4
4
4
2
2
IDS Classtypes
1,937
503
461
381
236
IDS Protocols
1,098
362
201
171
37
This rule detects attempts to bypass the Mark-of-the-Web (MOTW) security feature by removing or altering the Zone.Identifier stream from downloaded files. Specifically, it looks for HTTP traffic (flow:to_client,established) containing both 'Zone.Identifier' and 'ZoneId=3' (which typically indicates an internet zone download) in the file data, suggesting an attempt to strip this metadata during transit to prevent security warnings or restrictions on the client side. This technique is often used by attackers to make malicious files appear less suspicious.
This rule detects attempts to obfuscate PowerShell commands by looking for the 'IEX' (Invoke-Expression) command combined with '(New-Object' within the HTTP URI. This combination is often used by attackers to execute malicious PowerShell scripts downloaded from a remote source, while attempting to evade detection through obfuscation.
This rule detects the delivery of a payload via HTTP that contains junk code padding and appears to be an executable file. Specifically, it looks for the byte sequence '90 90 90 90 90 90 90 90 90 90' (often used as NOPs for padding or obfuscation) followed by the 'MZ' magic bytes at the beginning of a file (indicating a Windows executable). The detection is triggered on HTTP responses flowing to the client.
This rule detects the delivery of a polymorphic engine payload via HTTP. It looks for specific content within the HTTP response body, including the strings "mutate" and "engine" (case-insensitive), and the "MZ" magic bytes at the beginning of the file data, indicating a Windows executable. This combination suggests the download of a polymorphic malware component designed to evade detection.
This rule detects attempts to clear network connection history by deleting the wtmp log file via an SSH connection. The rule specifically looks for the command 'rm -rf /var/log/wtmp' being sent over TCP port 22 (SSH). This activity is often associated with defense evasion tactics used by attackers to remove forensic evidence.
This rule detects HTTP traffic where the client body contains a long string of hexadecimal characters, which could indicate the use of non-standard encoding for Command and Control (C2) communication. The rule specifically looks for a hexadecimal string of at least 200 characters in the HTTP client body.
This rule detects the download of a multi-stage Command and Control (C2) stage two payload. It specifically looks for HTTP traffic where the referer header contains 'pastebin', 'github', 'discord', or 'telegram' (case-insensitive) and the file data starts with 'MZ', indicating a Windows executable. This combination suggests a potential malicious download from common code/file sharing platforms often used by attackers for C2 infrastructure.
This rule detects HTTP traffic where the host is 'gist.github.com' and the URI contains '/raw/', indicating a potential Dead Drop Resolver using GitHub Gist for Command and Control (C2) activities. It triggers an alert if five such connections are observed from the same source IP within 300 seconds.
This rule detects potential memory injection attempts on Linux systems via an SSH session. It specifically looks for the strings "/proc/" and "/mem" within TCP traffic directed to an SSH server ($HOME_NET 22). This combination of strings suggests an attempt to access or manipulate process memory, which is a common technique used by attackers for privilege escalation or code injection.
This rule detects network traffic attempting to exploit a Service Registry ACL weakness remotely. Specifically, it looks for TCP traffic on port 445 (SMB) directed to the home network, containing the string "HKLM\System\CurrentControlSet\Services" (case-insensitive) in the payload. This string is indicative of an attempt to modify or interact with Windows services via the registry, potentially leveraging weak ACLs to establish persistence or execute malicious code.
This rule detects attempts to modify the end-of-file marker on a network share, specifically looking for the 'SetEndOfFile' operation over SMB. This activity can be indicative of an attacker manipulating file sizes or content on shared resources, potentially as part of data staging or to evade detection. The rule is configured with a threshold to alert on 20 such events from the same source within 30 seconds, aiming to reduce noise from legitimate, infrequent operations.
This rule detects potential command and control (C2) activity where commands are hidden within PNG image files. It specifically looks for HTTP traffic flowing from the server to the client (to_client) that contains the PNG file signature (89 50 4E 47) within the first 4 bytes of the file data, and where the file size is greater than 100,000 bytes. A threshold is applied to trigger an alert if 10 such events occur within 60 seconds from the same destination IP address, indicating a potential high volume of C2 communication disguised as image downloads.
This rule detects HTTP POST requests where the client body contains a large string (over 200 characters) that appears to be Base64 encoded. The `pcre` (Perl Compatible Regular Expression) `/^[A-Za-z0-9+\/]{200,}={0,2}$/` specifically looks for strings composed of Base64 characters (alphanumeric, '+', '/', and optional '==') with a minimum length of 200 characters. This pattern is often used by malware for command and control (C2) communication to obfuscate data within HTTP traffic.
This rule detects an HTML file being served to a client that contains an embedded Base64 encoded executable payload. It specifically looks for the HTML download attribute (<a download=), the 'base64,' string, and the 'TVQAA' string, which is a common signature for the beginning of a Base64 encoded Windows executable (MZ header). The detection is performed on HTTP traffic flowing to the client.
This rule detects the delivery of a malicious LNK file via HTTP that utilizes icon smuggling. It specifically looks for HTTP responses containing a URI with ".lnk" and the byte sequence "|4C 00 00 00|" at the beginning of the file data, which is characteristic of LNK files. Icon smuggling is a defense evasion technique where a malicious file disguises itself with a legitimate icon to trick users into executing it.
This rule detects attempts to disable the Linux Auditd service via a remote SSH connection. It specifically looks for the string "systemctl stop auditd" within TCP traffic destined for port 22 (SSH). Disabling auditd can be an attempt by an attacker to evade detection by removing system auditing capabilities.
This rule detects the presence of a Right-to-Left Override (RLO) character sequence in the content of an email sent over SMTP. The RLO character (U+202E, represented as E2 80 AE in UTF-8) is often used in phishing or malware campaigns to visually reverse the order of characters in a filename, making an executable file appear to be a benign file type (e.g., 'document.txt.exe' could appear as 'document.exe.txt'). The rule specifically looks for this byte sequence in traffic destined for port 25 (SMTP) and flags it as trojan activity.
This rule detects attempts to clear syslog files by looking for the command 'truncate -s 0' followed by 'syslog' within an SSH session. This activity is often associated with an attacker trying to remove evidence of their presence on a compromised system.
This rule detects the download of a ClickOnce application manifest that contains specific content indicating it might be malicious. It looks for HTTP responses (flow:to_client,established) where the URI contains ".application" (case-insensitive) and the file data contains "asmv1:assembly" (case-insensitive). This combination suggests a ClickOnce deployment, which can be abused to deliver malware.
This rule detects network traffic indicating the deletion of a persistence registry key, specifically 'CurrentVersion\\Run', after an execution. It looks for TCP traffic to the home network on port 445 (SMB) containing both 'CurrentVersion\\Run' and 'RegDeleteKey' (case-insensitive). This behavior is often associated with malware attempting to clean up its persistence mechanisms to evade detection.
This rule detects HTTP traffic where the URI contains both "pcalua" and "-a" (case-insensitive). This pattern is indicative of indirect execution via pcalua.exe, a legitimate Windows utility that can be abused by attackers to proxy execution of other programs, often for defense evasion. The rule specifically looks for this behavior in HTTP requests, suggesting an attempt to download or execute a payload indirectly.
Page 62 of 93