Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,937 detections
Filters
Last updated
All Time
Detection languages
1,930
3
2
1
1
Contributors
592
477
360
250
124
Categories
995
927
834
546
538
Platforms
1,753
214
81
54
41
Products / Services
1,868
1,144
65
51
17
MITRE Techniques
564
412
305
201
175
CVEs
4
4
4
2
2
IDS Classtypes
1,937
503
461
381
236
IDS Protocols
1,098
362
201
171
37
This rule detects the delivery of a Microsoft Installer (MSI) package via HTTP that exhibits characteristics of a malicious file. It specifically looks for HTTP responses (flow:to_client) containing a URI with the ".msi" extension (http.uri; content:".msi"; nocase;) and the magic bytes "D0 CF 11 E0" (content:"|D0 CF 11 E0|"; depth:4;) which are indicative of an OLE2 compound document file format, commonly used by MSI files. The rule classifies this activity as 'trojan-activity'.
This rule detects the presence of anti-debugging techniques within HTTP payload data. Specifically, it looks for the strings "IsDebuggerPresent" and "ExitProcess" (case-insensitive) in the HTTP response body. The combination of these strings suggests that a malicious payload might be checking for a debugger and attempting to terminate if one is detected, a common defense evasion technique used by malware.
This rule detects network traffic containing the string "chmod 777" followed by "/tmp/" (case-insensitive) within a TCP flow to a server on port 22. This pattern suggests an attempt to change file permissions to world-writable (777) in the /tmp directory, which is a common tactic used by malware to hide or execute malicious files.
This rule detects the delivery of a fake GUI login prompt over HTTP, likely for credential capture. It looks for HTTP responses (flow:to_client) containing the strings "ShowDialog", "Password", and "GetWindowText" (case-insensitive) within the file data. This combination of keywords suggests an attempt to mimic a legitimate login interface to trick users into providing their credentials.
This rule detects suspicious activity related to Microsoft Teams chat messages being scraped for credentials. Specifically, it looks for HTTP requests to 'graph.microsoft.com' with URIs containing '/chats/' and '/messages'. A threshold of 20 such requests within 60 seconds from a single source IP triggers the alert, indicating potential automated data exfiltration or credential harvesting from Teams chats.
This rule detects attempts to copy the Active Directory Certificate Services (ADCS) certificate database for offline forgery. Specifically, it looks for SMB traffic to a server on port 445 (SMB) containing the string "certnew.cer" (case-insensitive) in the content, indicating a file transfer of a newly issued certificate. This activity is often associated with credential access techniques, where an attacker might exfiltrate certificate data to forge credentials.
This rule detects attempts to perform process injection using the 'ptrace' system call, specifically looking for 'ptrace' and 'PTRACE_ATTACH' within TCP traffic destined for SSH (port 22). This activity is indicative of an attacker trying to attach to a running process, often for debugging, modifying its memory, or injecting malicious code, potentially after gaining remote access via SSH.
This rule detects attempts to abuse Active Directory Certificate Services (AD CS) by requesting certificates through the /certsrv/ interface. Specifically, it looks for HTTP requests containing both '/certsrv/' and 'request' in the URI, indicating a certificate enrollment request. The thresholding mechanism (5 requests from the same source within 60 seconds) aims to reduce false positives and highlight potentially automated or repeated attempts to exploit AD CS.
This rule detects potential unauthorized access attempts using forged web credentials. It specifically looks for HTTP requests containing a cookie with a long, base64-like encoded string (100 or more characters) which could indicate a forged session token or credential. A threshold of 10 such occurrences within 5 seconds from the same destination IP address triggers the alert, suggesting a brute-force or automated credential stuffing attempt.
This rule detects attempts to create a setuid binary on a remote host via an SSH connection. It specifically looks for the string "chmod u+s" within TCP traffic destined for port 22 (SSH), indicating a command to set the setuid bit on a file. This activity is often associated with privilege escalation attempts where an attacker tries to create a backdoor or maintain persistence with elevated privileges.
This rule detects the download of Office template files (such as .dot, .dotm, .xlt, .xltm, .pot, .potm) that contain VBA project content. This is indicative of potentially malicious Office documents designed to execute macros, often used for initial access or persistence by attackers.
This rule detects attempts to force the installation of browser extensions via a policy page. It specifically looks for the string "ExtensionInstallForcelist" in HTTP response data flowing to the client, indicating a mechanism used to programmatically install extensions, often abused by malware or unwanted programs to maintain persistence or inject malicious functionality into browsers.
This rule detects the download of a Chrome extension file (.crx) from an HTTP server to a client. It specifically looks for the string ".crx" in the HTTP URI and the string "CrOD" within the first 4 bytes of the file data, which is a common magic number for Chrome extension files. This combination suggests a potential malicious Chrome extension download, often used for persistence or other malicious activities.
This rule detects network traffic containing the string ".bashrc" on TCP port 22 (SSH). This could indicate an attempt to modify a user's shell profile for persistence, as .bashrc is a common file used to configure the Bash shell environment and can be leveraged by attackers to execute malicious commands upon login.
This rule detects network traffic over SMB (port 445) containing the string "SCRNSAVE.EXE" in a case-insensitive manner. This is indicative of a potential persistence mechanism where the screensaver executable has been replaced with a malicious one, and its name is being transmitted over the network, possibly during file transfer or command and control activities. The rule specifically looks for traffic flowing to the server on an established connection.
This rule detects attempts to modify the SSH daemon configuration file (sshd_config) remotely over an established TCP connection to port 22. The detection is based on the presence of the string "sshd_config" within the network flow, indicating potential remote manipulation of SSH authentication settings.
This rule detects attempts to execute AppleScript commands remotely over SSH. It specifically looks for the string "osascript" (case-insensitive) within TCP traffic destined for port 22 (SSH) on the home network, indicating a potential remote execution of AppleScript.
This rule detects the delivery of a Lua script payload via HTTP. It specifically looks for HTTP responses containing '.lua' in the URI and the string 'os.execute(' within the file data, indicating an attempt to execute commands on the client system. This is often associated with trojan activity.
This rule detects suspicious inter-process communication (IPC) activity involving named pipes. Specifically, it looks for network traffic within the home network ($HOME_NET to $HOME_NET) that contains the string "\\.\pipe\\" (case-insensitive) and has a data payload size greater than 1000 bytes. This pattern is often associated with malware or advanced persistent threats (APTs) using named pipes for communication, especially when large amounts of data are transferred, indicating potential data exfiltration or command and control (C2) activity.
This rule detects HTTP POST requests where the URI contains both 'wp-content' and 'uploads', indicating potential command and control (C2) communication from a compromised website, likely a WordPress site. The rule specifically looks for requests with a body size greater than 500 bytes, suggesting data exfiltration or command execution.
This rule detects the download of common offensive security tools such as Mimikatz, LaZagne, Rubeus, BloodHound, and SharpHound. It specifically looks for these tool names within the HTTP URI during client-to-server HTTP traffic.
Page 67 of 93