Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,937 detections
Filters
Last updated
All Time
Detection languages
1,930
3
2
1
1
Contributors
592
477
360
250
124
Categories
995
927
834
546
538
Platforms
1,753
214
81
54
41
Products / Services
1,868
1,144
65
51
17
MITRE Techniques
564
412
305
201
175
CVEs
4
4
4
2
2
IDS Classtypes
1,937
503
461
381
236
IDS Protocols
1,098
362
201
171
37
This rule detects potential session hijacking attempts by monitoring HTTP traffic for unusually long cookie values. Specifically, it looks for HTTP cookies containing base64-like strings (alphanumeric characters, plus, slash, and equals signs) that are 100 characters or longer. A threshold of 5 such occurrences within 3 seconds from the same destination IP address triggers the alert, indicating a possible attempt to use a stolen browser session cookie.
This rule detects potential browser session token injection via a Man-in-the-Middle (MitM) attack. It looks for HTTP responses (flow:to_client) that contain the strings "document.cookie", "=", and "XMLHttpRequest" (case-insensitive) within the file data. The combination of these strings in a client-bound HTTP response suggests an attempt to manipulate browser cookies, possibly to inject session tokens, often seen in MitM scenarios where an attacker intercepts and modifies traffic to compromise user sessions.
This rule detects the exfiltration of a custom XOR-compressed archive over HTTP. It specifically looks for HTTP POST requests originating from the home network, containing file data, with a payload size greater than 10000 bytes, and a PCRE match for a sequence of at least 200 non-ASCII or control characters, which is indicative of XOR-compressed binary data.
This rule detects the exfiltration of browser bookmarks over HTTP POST requests. It specifically looks for HTTP POST requests where the client body contains the string "Bookmarks" (case-insensitive) and the data size is greater than 500 bytes. This pattern is indicative of an attacker or malware attempting to steal a user's browser bookmarks.
This rule detects potential sandbox evasion techniques by identifying HTTP traffic (specifically client-to-server responses) that contains both 'GetCursorPos' and 'Sleep' within the file data. This combination is often used by malware to check for user interaction (mouse movement) and introduce delays, which can indicate an attempt to determine if it's running in a sandboxed environment.
This rule detects network traffic (specifically HTTP responses) that contains patterns indicative of malware attempting to prevent double execution using mutexes. It looks for the strings "CreateMutex" and "ALREADY_EXISTS" (case-insensitive) within the file data of the HTTP response. This behavior is common in malware to ensure only one instance of itself is running on a system, often as a defense evasion technique.
This rule detects the download of executable files (EXE, DLL, BIN) over HTTP that appear to be stripped of their standard headers. It specifically looks for the 'MZ' magic bytes at the beginning of the file data, indicating a Windows executable, but then implies a lack of full header structure by the 'Stripped Executable Payload Without Headers' message. The rule also requires the file size to be greater than 10000 bytes.
This rule detects HTTP responses containing SVG (Scalable Vector Graphics) content that also embeds base64 encoded data starting with 'TVQAA'. This specific sequence ('TVQAA') is characteristic of a base64 encoded Windows executable (MZ header). The rule aims to identify a technique known as SVG smuggling, where malicious executables are hidden within SVG files and delivered to clients, often as a defense evasion tactic.
This rule detects attempts to remotely disable the Windows Event Log service over SMB (port 445). It specifically looks for TCP traffic to port 445 on the home network, containing the case-insensitive strings "EventLog" and "StopService". This activity is indicative of an attacker trying to hinder forensic analysis or evade detection by stopping logging services.
This rule detects HTTP responses that contain a URI with a double extension, where the first extension is a common document or image file type (doc, pdf, jpg, png, txt) and the second extension is an executable or script file type (exe, bat, vbs, ps1, cmd). This pattern is often used in file masquerading to trick users into executing malicious files.
This rule detects attempts to submit a Dockerfile containing 'FROM' and 'RUN' instructions to the Docker API via an HTTP POST request to the '/build' endpoint. This activity could indicate an attacker attempting to build a malicious Docker image on a compromised Docker host.
This rule detects attempts to modify macOS Plist files over an SSH connection. Specifically, it looks for TCP traffic on port 22 (SSH) where the payload contains both '/Library/Preferences/' and '.plist' (case-insensitive). This activity is flagged as potential defense evasion, as modifying Plist files can be used to alter system behavior or application settings to evade security mechanisms.
This rule detects the delivery of a CMSTP INF file over HTTP that contains specific content indicative of a User Account Control (UAC) bypass attempt. It looks for HTTP responses containing a URI with ".inf", and within the file data, the strings "[DefaultInstall]" and "RegisterOCXs". This combination suggests an attempt to leverage CMSTP (Connection Manager Profile Installer) to execute arbitrary code, often used by adversaries for defense evasion and privilege escalation.
This rule detects the delivery of an Electron application ASAR (Atom Shell Archive) package over HTTP. The detection is based on the presence of '.asar' in the HTTP URI, indicating a potential malicious Electron application being downloaded to a client within the home network. Electron applications are often used for desktop applications and can be exploited if malicious code is embedded within their ASAR packages.
This rule detects the download of a Microsoft Management Console (MMC) snap-in file (.msc) over HTTP that also contains the string "MMCVersion". This combination is often used by attackers to execute malicious code or establish persistence, leveraging the trusted nature of MMC snap-ins. The rule specifically looks for the file extension in the URI and the 'MMCVersion' string within the file's data, indicating a potential malicious MMC snap-in being delivered via HTTP.
This rule detects attempts to grep for passwords within the bash history file over an SSH connection. Specifically, it looks for the string 'grep -i password ~/.bash_history' in TCP traffic destined for port 22 (SSH). This activity is indicative of an attacker attempting to discover credentials on a compromised system.
This rule detects potential exfiltration of password manager database files over HTTP. It specifically looks for HTTP POST requests with a URI containing common password manager names (keepass, lastpass, 1password, bitwarden) and a data size greater than 1000 bytes. This combination suggests a large file, potentially a database, is being uploaded.
This rule detects attempts to harvest Slack messages for credential tokens by monitoring HTTP requests to slack.com with the URI '/conversations.history'. A threshold of 20 such requests within 60 seconds from the same source IP triggers the alert, indicating potential automated data exfiltration or reconnaissance.
This rule detects attempts to read the 'cpassword' field from Group Policy Preferences XML files over SMB. The 'cpassword' field was historically used to store encrypted passwords, which could be easily decrypted, leading to credential exposure. Detection of this string in SMB traffic indicates an attempt to access or exfiltrate these sensitive credentials.
This rule detects the submission of a Golden SAML attack token to a service. It specifically looks for HTTP POST requests where the URI contains 'saml', the client body contains 'Assertion', and the body size is greater than 2000 bytes. This combination of indicators suggests an attempt to authenticate using a forged SAML assertion.
This rule detects the use of a forged SAML token for identity federation bypass. It specifically looks for HTTP POST requests (flow:to_server,established; http.client_body;) containing the string "SAMLResponse" (content:"SAMLResponse"; nocase;) and a long base64-encoded string (pcre:"/[A-Za-z0-9+\/]{500,}={0,2}/";) within the client body. The presence of a large base64 string in conjunction with "SAMLResponse" suggests a potentially malicious SAML assertion being submitted.
Page 64 of 93