Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,937 detections
Filters
Last updated
All Time
Detection languages
1,930
3
2
1
1
Contributors
592
477
360
250
124
Categories
995
927
834
546
538
Platforms
1,753
214
81
54
41
Products / Services
1,868
1,144
65
51
17
MITRE Techniques
564
412
305
201
175
CVEs
4
4
4
2
2
IDS Classtypes
1,937
503
461
381
236
IDS Protocols
1,098
362
201
171
37
This rule detects HTTP requests originating from Microsoft Office Word that are attempting to fetch remote templates with specific file extensions (.dotx, .dotm, .dot). This behavior can be indicative of malicious documents attempting to retrieve external content, often used in phishing or malware delivery campaigns to bypass security controls or fetch additional stages of an attack.
This rule detects attempts to query the Windows Registry remotely for the 'HKLM\Software\RealVNC' key over TCP port 445 (SMB). This activity is indicative of an attacker attempting to locate stored credentials, specifically those related to RealVNC, which could then be used for further lateral movement or privilege escalation. The detection is based on the presence of the string 'HKLM\Software\RealVNC' in the network traffic.
This rule detects DNS queries that contain non-standard hex-encoded data, which is often indicative of Command and Control (C2) communication. Specifically, it looks for DNS queries where the query name contains a sequence of 32 or more hexadecimal characters (0-9, a-f). This pattern is frequently used by malware to exfiltrate data or receive commands via DNS tunneling, where data is encoded into subdomains.
This rule detects potential air-gap bridging activity via removable media. Specifically, it looks for SMB traffic on port 445 containing the string "USBSTOR" (case-insensitive) and the file extension ".bin" (case-insensitive). This combination suggests a file transfer related to USB storage, possibly a firmware update or a malicious payload, being moved across a network segment, potentially bypassing an air-gapped system.
This rule detects attempts to perform remote DLL injection via UNC path writes over SMB. It specifically looks for SMB traffic to port 445 on the home network, containing ".dll", "\\", and "System32" in a case-insensitive manner. This combination suggests an attempt to write a DLL file to a System32 directory on a remote machine using a UNC path, which is a common technique for DLL injection.
This rule detects the delivery of a malicious PowerShell profile script named 'profile.ps1' via HTTP. The rule specifically looks for the string 'IEX' (Invoke-Expression) within the file data, indicating an attempt to execute arbitrary commands. This technique is often used for persistence, where an attacker modifies a PowerShell profile to execute malicious code every time PowerShell is launched.
This rule detects network traffic on TCP port 445 (SMB) containing the strings "Winlogon" and "Userinit" (case-insensitive). This pattern is indicative of a potential modification to the Winlogon Helper DLL for persistence, as Winlogon and Userinit are key components in the Windows logon process. An attacker might modify a helper DLL to execute malicious code during system startup.
This rule detects the delivery of potentially malicious Microsoft Office startup files (Excel, Word, PowerPoint macro-enabled or binary files) via HTTP. It specifically looks for files with extensions like .xlsb, .xlsm, .docm, .pptm, or .dotm in the HTTP URI and checks for the presence of "vbaProject" content within the file data, indicating the presence of VBA macros which are often used in malicious documents.
This rule detects attempts to modify the Windows Registry remotely, specifically targeting the 'HKLM' hive and paths containing 'shell\open\command'. This pattern is often used by adversaries to establish persistence or achieve privilege escalation by modifying how applications or the system execute commands, for example, by hijacking file associations or application startup commands. The detection is based on network traffic over TCP port 445, which is commonly used for SMB/CIFS, indicating a remote registry operation.
This rule detects the delivery of an AppleScript payload over HTTP. It specifically looks for HTTP responses (flow:to_client) that contain the string ".scpt" (case-insensitive) in the HTTP URI. This indicates a potential malicious script being downloaded to a client system, often used for execution on macOS systems.
This rule detects patterns indicative of a USB autorun payload download. Specifically, it looks for HTTP traffic (flow:to_client,established) containing the strings "[autorun]" and "open=" (case-insensitive) within the file data. This combination suggests a client is receiving a file that attempts to leverage the autorun feature, often used by malware for initial execution from removable media.
This rule detects the download of common remote access tools (AnyDesk, TeamViewer, RustDesk, Zoho, Atera, UltraViewer) over HTTP. The detection is triggered when an HTTP response flows to the client, is established, contains a URI, and the URI matches one of the specified tool names using a case-insensitive PCRE. Additionally, the response body size must be greater than 100,000 bytes, indicating a potential executable or installer download. This activity is classified as trojan activity and is associated with the MITRE ATT&CK technique T1566.004 (Phishing: Voice Phishing) and tactic Initial Access, suggesting that the download might occur after a voice phishing call.
This rule detects attempts to push malicious firmware to a device via TFTP (Trivial File Transfer Protocol). It specifically looks for UDP traffic on port 69 (TFTP) where the packet content starts with "|00 02|" (indicating a TFTP write request) and the data size is greater than 10000 bytes, suggesting a firmware image transfer.
This rule detects the creation of an Azure Blob Lifecycle Management rule that is configured for deletion. It specifically looks for HTTP PUT requests to blob.core.windows.net with 'managementPolicies' in the URI, indicating an attempt to define or modify lifecycle policies for Azure Blob Storage, potentially for data deletion.
This rule detects potential command and control (C2) communication over the MQTT protocol. It specifically looks for TCP traffic on port 1883 (the standard MQTT port) from the home network to any destination. The detection is triggered by the presence of a specific byte sequence ('|10|') at the beginning of the payload, which corresponds to an MQTT PUBLISH message type. A threshold of 5 such messages within 60 seconds from the same source IP is set to reduce false positives, indicating a sustained pattern of MQTT PUBLISH activity that could be indicative of C2.
This rule detects HTTP traffic that attempts to impersonate legitimate browser traffic (specifically Chrome on Safari) for command and control (C2) purposes. It looks for a specific User-Agent pattern that mimics Chrome on Safari and a URI pattern consisting of 8 to 16 lowercase alphanumeric characters. A threshold is applied to prevent excessive alerts, triggering if 20 such events occur within 60 seconds from the same source.
This rule detects obfuscated protocol data in non-standard command and control (C2) channels over TCP. It triggers when TCP traffic flows from the home network to any destination, is established, has a data size between 101 and 499 bytes, and occurs at a high frequency (30 times in 60 seconds from the same source). This pattern is indicative of trojan activity, specifically related to command and control communications.
This rule detects DNS queries to known dynamic DNS services that are frequently abused by C2 infrastructure. Specifically, it looks for queries ending in '.duckdns.org', '.no-ip.com', '.ddns.net', '.hopto.org', or '.zapto.org'. A threshold of 5 queries within 60 seconds from the same source IP is applied to reduce false positives.
This rule detects HTTP traffic where the 'Host' header contains common Content Delivery Network (CDN) domains (cloudfront.net, azureedge.net, fastly.net, cloudflare.net) and the 'X-Forwarded-Host' header is also present. This pattern can indicate C2 infrastructure attempting to hide behind CDN fronting, a technique used by adversaries to obscure the true origin of their command and control servers.
This rule detects potential command and control (C2) communication over TCP that uses AES encryption with a hardcoded key pattern. It specifically looks for the byte sequence "41 45 53" (which corresponds to the ASCII string "AES") within the payload of a TCP flow from the internal network to any external destination. The rule further refines detection by checking for a payload size between 100 and 500 bytes and applies a threshold of 20 occurrences within 60 seconds from the same source IP to reduce false positives. This pattern is indicative of certain malware families that use predictable AES keying for their C2 channels.
This rule detects when an executable file (.exe) is dropped into a shared network folder. It specifically looks for SMB traffic containing both ".exe" and "\\share\\" in the content, indicating a potential attempt to distribute malicious executables or move them laterally within a network.
Page 63 of 93