Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,937 detections
Filters
Last updated
All Time
Detection languages
1,930
3
2
1
1
Contributors
592
477
360
250
124
Categories
995
927
834
546
538
Platforms
1,753
214
81
54
41
Products / Services
1,868
1,144
65
51
17
MITRE Techniques
564
412
305
201
175
CVEs
4
4
4
2
2
IDS Classtypes
1,937
503
461
381
236
IDS Protocols
1,098
362
201
171
37
This rule detects the use of the 'trap' command with 'EXIT' in TCP traffic, which is a common technique used for persistence on Unix-like systems. Attackers can use the 'trap' command to execute arbitrary commands when a shell exits, ensuring their malicious code runs even after a session is closed.
This rule detects the delivery of a macOS Launch Daemon Property List (.plist) file via HTTP. Attackers often use Launch Daemons for persistence on macOS systems. The rule specifically looks for HTTP traffic containing '.plist' in the URI and 'LaunchDaemon' within the file data, indicating a potential attempt to establish persistence.
This rule detects the download of potential malware source code by inspecting HTTP URI paths and file data. It triggers if the HTTP URI contains keywords like 'rat', 'trojan', 'keylogger', 'ransomware', or 'botnet' (case-insensitive) and the downloaded file data contains the string 'import socket' (case-insensitive). This combination suggests the download of Python-based malware source code.
Dual-Use Hacking Tool Download
Suricata
This rule detects the download of dual-use hacking tools by inspecting HTTP URI paths for keywords like 'nmap', 'metasploit', 'cobaltstrike', 'empire', 'covenant', and 'sliver'. It specifically looks for these keywords in a case-insensitive manner within the HTTP URI, indicating a potential attempt to download tools that can be used for both legitimate security testing and malicious activities.
This rule detects network traffic patterns indicative of an attempt to use the 'Active Setup' registry key for persistence. Specifically, it looks for TCP traffic on port 445 (commonly used for SMB/CIFS) directed to the home network, containing the strings 'Active Setup' and 'StubPath' (case-insensitive). This combination suggests an attacker might be trying to establish persistence by modifying the 'StubPath' value within an 'Active Setup' registry key, which Windows uses to run commands during user logon.
This rule detects attempts to upload files containing the 'MZ' magic bytes (indicating a Windows executable) to known file-sharing services such as transfer.sh, mega.nz, mediafire, or anonfiles. It specifically looks for HTTP POST requests with file data.
This rule detects HTTP responses that indicate a potential drive-by download infrastructure redirect. Specifically, it looks for HTTP responses to clients that contain the word "redirect" (case-insensitive) in the URI and also contain the "MZ" magic bytes at the beginning of the file data, suggesting an executable file is being served. This combination implies a server is redirecting to or serving an executable file, which is a common tactic in drive-by download attacks.
This rule detects network traffic containing the string "HKCU\\Software\\Classes\\CLSID" on TCP port 135 (DCE/RPC) directed towards the home network. This pattern is indicative of an attempt to modify registry keys related to COM objects, which can be used for persistence or privilege escalation by hijacking COM object execution.
This rule detects HTTP responses that originate from search engines (Google, Bing, Yahoo) and contain a Windows executable (MZ header) in the file data. This behavior is indicative of SEO poisoning, where malicious actors manipulate search engine results to redirect users to malware downloads.
This rule detects the download of executable installer files (MSI or EXE) over HTTP that are larger than 500KB and contain the 'MZ' header, which is characteristic of Windows executables. The rule specifically looks for these files being delivered to a client within the home network. The message indicates a potential 'Executable Installer with Weak File Permission Exploit', suggesting that the downloaded file might be malicious or used in an exploit chain related to weak file permissions.
This rule detects network traffic indicating that reversible password encryption might be enabled in Active Directory. It specifically looks for the string "AllowReversiblePasswordEncryption" in TCP traffic destined for port 389 (LDAP). Enabling reversible password encryption stores passwords in a format that can be easily decrypted, making them vulnerable to theft if the system is compromised.
This rule detects a potential network device authentication bypass attempt via SSH. Specifically, it looks for SSH traffic (port 22) directed to the home network that contains the strings "aaa authentication" and "none" (case-insensitive). This combination suggests a configuration where authentication, authorization, and accounting (AAA) is set to 'none', which could allow unauthorized access.
This rule detects network traffic on TCP port 445 (SMB) containing the string "Notification Packages" in a case-insensitive manner, flowing to the server. This pattern is indicative of an attempt to install a password filter DLL for credential harvesting, a technique used by attackers to capture user credentials.
This rule detects attempts to drop a payload into the Microsoft Word startup folder via SMB. The detection is based on the presence of the string "Word\STARTUP" (case-insensitive) in SMB traffic flowing to the server on port 445. This activity is indicative of persistence mechanisms used by attackers to ensure malicious code executes when Word starts.
This rule detects when a file containing the string "XLSTART" (case-insensitive) is written to a network share via SMB. This is indicative of an attempt to establish persistence by placing malicious files in the Microsoft Office startup folder, which will be executed when Office applications launch.
This rule detects attempts to modify login scripts, specifically '.profile', on a remote host via SSH. The detection is based on observing the string ".profile" within TCP traffic destined for port 22 (SSH) on the home network. This activity could indicate an attacker establishing persistence by modifying user login scripts to execute malicious commands upon subsequent logins.
This rule detects the writing of a file containing both the string "Startup" (case-insensitive) and the string ".bat" (case-insensitive) to a remote host via the Server Message Block (SMB) protocol on port 445. This activity is indicative of an attempt to establish persistence by creating a startup script on a remote system.
This rule detects when a batch script (.bat) is dropped onto a network share, specifically targeting the NETLOGON share, which is often used for logon scripts. This activity can be indicative of an attacker attempting to establish persistence or execute malicious code on systems that process logon scripts from this share. The rule triggers if three such events are observed from the same source within 60 seconds.
This rule detects the delivery of a Windows Dynamic Link Library (DLL) file via HTTP that could be used for execution flow hijacking. It specifically looks for HTTP responses containing a URI with '.dll', the 'MZ' magic bytes at the beginning of the file data, and a file size greater than 10,000 bytes, indicating a potentially legitimate or malicious DLL being downloaded to a client.
This rule detects attempts to plant a DLL file in an application's 'Program Files' directory over SMB. This is a common technique used in DLL hijacking attacks, where a malicious DLL is placed in a location where a legitimate application will load it instead of the intended system DLL. The rule specifically looks for SMB traffic to port 445, containing '.dll' and '\Program Files\' in a case-insensitive manner, indicating a file transfer to a sensitive application directory.
This rule detects network traffic on TCP port 445 (SMB) containing the strings "system32" and "msv1_0.dll" in a case-insensitive manner. This pattern is indicative of an attempt to replace the authentication DLL (msv1_0.dll) on a remote Windows host, which is a known technique for persistence and credential manipulation.
Page 72 of 93