Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,937 detections
Filters
Last updated
All Time
Detection languages
1,930
3
2
1
1
Contributors
592
477
360
250
124
Categories
995
927
834
546
538
Platforms
1,753
214
81
54
41
Products / Services
1,868
1,144
65
51
17
MITRE Techniques
564
412
305
201
175
CVEs
4
4
4
2
2
IDS Classtypes
1,937
503
461
381
236
IDS Protocols
1,098
362
201
171
37
This rule detects a recurring download pattern associated with Microsoft BITS (Background Intelligent Transfer Service). Specifically, it looks for HTTP traffic where the User-Agent header contains "Microsoft BITS" and triggers an alert if 10 such events occur within 3600 seconds from the same source IP address. This pattern can indicate an adversary using BITS for persistent downloads, potentially for malware delivery or command and control.
This rule detects the download of a potentially malicious browser extension in CRX format. It specifically looks for HTTP responses containing ".crx" in the URI and the string "CrOD" within the first 4 bytes of the file data, indicating a Chrome extension download. This could be an attempt to install a malicious extension for persistence or other adversarial activities.
This rule detects the use of the Sliver C2 Framework based on a specific pattern in the TLS certificate subject. It looks for the common name (CN) 'multiplayer' within the TLS certificate subject, which is a known indicator for Sliver C2 communications.
This rule detects attempts to exfiltrate clipboard data over HTTP using a POST request. It specifically looks for HTTP POST requests where the URI or content contains the string "clipboard" (case-insensitive). This behavior is indicative of malware or malicious scripts trying to steal sensitive information copied by the user.
This rule detects suspicious TLS certificates that are self-signed and potentially used for Command and Control (C2) communication. Specifically, it looks for TLS certificates where both the issuer and subject country codes are 'US' and the common name (CN) in the subject field consists of 8 or more hexadecimal characters. This pattern is often observed in malware using dynamically generated self-signed certificates for C2.
This rule detects a high volume of TCP traffic on port 445 (SMB) directed to the home network, specifically looking for the SMB protocol signature. The threshold of 500 connections within 30 seconds from a single source IP suggests an attempt at mass file deletion or disk wiping activity on network shares, often associated with ransomware or destructive malware.
This rule detects multiple HTTP requests to 'iam.amazonaws.com' with the URI containing 'DeleteAccessKey'. This activity, especially when occurring frequently (5 times in 30 seconds from the same source), could indicate an attempt to revoke cloud account access keys, potentially as part of a lockout impact attack.
This rule detects potential banking web inject form overlays by looking for specific keywords in HTTP response data. It triggers when an HTTP response contains 'account_number', 'routing_number', and 'XMLHttpRequest' (all case-insensitive). This combination of keywords suggests an attempt to inject malicious forms into a legitimate banking website to steal credentials or financial information.
This rule detects HTTP POST requests that are likely associated with financial transaction hijacking by banking Trojans. It specifically looks for HTTP POST requests where the host header or URI contains keywords related to banking or payment services (bank, paypal, stripe, wise, transferwise) and the URI also contains the word 'transfer'. Additionally, the request body size must be greater than 200 bytes, indicating a substantial data transfer, which is common in financial transactions.
This rule detects the delivery of a potential ransomware MBR (Master Boot Record) wiper payload via HTTP. It specifically looks for HTTP responses containing file data that starts with the byte sequence '55 AA' (which often indicates a boot sector or MBR) and also contains 'MZ' (the DOS executable signature), with a file size greater than 10,000 bytes. This combination suggests a malicious executable designed to overwrite the MBR, a common tactic used by certain types of ransomware or disk wipers.
This rule detects HTTP POST requests with a client body that appears to be RC4 symmetric encrypted C2 beacon traffic. It specifically looks for HTTP traffic flowing to the server, with a client body between 100 and 500 bytes in size, and whose content matches a PCRE regex for base64 encoded strings. The rule is thresholded to trigger if 20 such events occur from the same source IP within 60 seconds, indicating potential beaconing activity.
This rule detects non-DNS traffic attempting to use port 53, which is typically reserved for DNS queries. This behavior is often indicative of command and control (C2) evasion techniques, where attackers tunnel their C2 communications over a commonly allowed port to bypass firewalls and network monitoring. The rule specifically looks for TCP traffic to port 53 that is not identified as DNS application-layer protocol, originating from the home network, and establishes a flow. A threshold of 5 such events within 30 seconds from the same source IP triggers the alert.
This rule detects the upload of a malicious executable file (identified by the 'MZ' header) to a SharePoint server via the REST API endpoint for folder manipulation. Specifically, it looks for HTTP POST requests to URIs containing '/_api/web/getfolderbyserverrelativeurl' with file data that starts with 'MZ'. This indicates an attempt to upload an executable file, potentially for lateral movement or further compromise within a SharePoint environment.
This rule detects potential data exfiltration of screen window lists via HTTP POST requests. It specifically looks for HTTP POST requests where the URI contains the case-insensitive string "windows" and the data size is greater than 200 bytes. This combination suggests an attempt to send information about open windows on a system to a remote server.
This rule detects when a Windows logon script (specifically a .bat file) is written to the NETLOGON share over SMB. This activity is often associated with persistence techniques where an attacker modifies or creates a logon script to execute malicious code when a user logs on to a domain-joined machine.
This rule detects the delivery of a payload containing the strings "Office Test" and "HKCU" over HTTP, indicating an attempt to modify the registry for persistence, potentially related to Office applications. The detection is based on inspecting file data within HTTP traffic flowing to the client.
This rule detects the upload of virtual machine disk images (VMDK, OVA, OVF, QCOW2, VHD) to cloud storage via HTTP PUT requests. The rule specifically looks for HTTP PUT methods, URIs ending with common VM image file extensions, and a minimum file size of 1MB, indicating a substantial file transfer. This activity could signify an attacker attempting to upload a backdoored or malicious VM image for persistence or to establish a foothold in a cloud environment.
This rule detects the upload of a vSphere Installation Bundle (VIB) to an ESXi host. It specifically looks for HTTP PUT requests to the '/bundle' URI with a payload size greater than 100,000 bytes, which is indicative of a VIB file transfer. This activity could be part of a persistence mechanism where an attacker installs malicious software or backdoors on an ESXi host.
This rule detects attempts to enable the 'xp_cmdshell' stored procedure in Microsoft SQL Server. The rule specifically looks for network traffic on port 1433 (default SQL Server port) containing the keywords 'sp_configure', 'xp_cmdshell', and '1' (indicating enablement). Enabling xp_cmdshell allows SQL Server to execute operating system commands, which is a common technique used by attackers for remote execution and persistence.
This rule detects attempts to inject a malicious URL into the Outlook Home Page setting for persistence. It specifically looks for HTTP traffic (flow:to_client,established) containing the strings "HomePageURL" and "http" (case-insensitive) in the file data, indicating a potential attempt to modify Outlook's home page setting to point to an attacker-controlled URL.
This rule detects the delivery of a potential rootkit payload via HTTP download. It specifically looks for HTTP responses (flow:to_client) where the URI contains keywords like 'rootkit', 'rkill', 'kernel.module', or 'lkm' (case-insensitive) and the file data starts with 'MZ', indicating a Windows executable.
Page 68 of 93