Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,937 detections
Filters
Last updated
All Time
Detection languages
1,930
3
2
1
1
Contributors
592
477
360
250
124
Categories
995
927
834
546
538
Platforms
1,753
214
81
54
41
Products / Services
1,868
1,144
65
51
17
MITRE Techniques
564
412
305
201
175
CVEs
4
4
4
2
2
IDS Classtypes
1,937
503
461
381
236
IDS Protocols
1,098
362
201
171
37
This rule detects DNS queries for TXT records that contain specific patterns indicative of DNS calculation C2 (Command and Control) activity. The pattern searched for is a PCRE regex matching two alphanumeric strings, each 4 to 8 characters long, separated by a dot (e.g., 'abcd.efgh.'). This type of activity is often associated with malware using DNS TXT records to encode C2 instructions or data, potentially involving IP math for dynamic C2 server resolution. The rule includes a threshold to prevent excessive alerts, triggering if 5 such queries are observed from the same source within 60 seconds.
This rule detects potential callback activity from a remote hardware implant. It specifically looks for HTTP requests where the URI contains common callback patterns like '/callback', '/checkin', '/ping', or '/heartbeat', and the User-Agent header indicates a scripting tool such as 'python', 'curl', or 'wget'. The rule also specifies that the HTTP body size should be between 1 and 199 bytes, and it uses a threshold to trigger an alert if 10 such events occur within 60 seconds from the same source.
This rule detects the planting of script files, specifically PowerShell scripts (.ps1), on shared network drives. It looks for SMB traffic directed to a server on port 445 (SMB) that contains both the string ".ps1" (case-insensitive) and the string "\\share\\" (case-insensitive). This activity is indicative of an attacker staging scripts on a network share for potential lateral movement within a network.
This rule detects attempts to create or modify email forwarding rules in Office 365 via the Microsoft Graph API. Specifically, it looks for HTTP POST requests to the '/mailFolders/inbox/messageRules' endpoint on 'graph.microsoft.com'. This activity can indicate an attacker setting up an inbox rule to forward emails to an external address for data exfiltration or to maintain persistence.
This rule detects network traffic (specifically HTTP responses) that contains strings indicative of malware attempting to detect the presence of a hypervisor. It looks for the string "GetSystemFirmwareTable" and "VBOX" (case-insensitive) within the file data of the HTTP response. This combination suggests a malware payload checking if it's running in a virtualized environment, specifically VirtualBox, which is a common anti-analysis technique.
This rule detects potential HTML smuggling attempts where a malicious payload is delivered via a Blob URL. It specifically looks for HTTP responses (flow:to_client) that contain both 'URL.createObjectURL' and 'Blob(' (case-insensitive) in the file data. This combination is indicative of JavaScript code creating a Blob object and then generating a URL for it, which can be used to deliver files directly to the client's browser, bypassing traditional network security controls.
This rule detects the delivery of a stripped binary, specifically an executable (indicated by 'MZ' header) that has been packed or compressed using UPX (indicated by 'UPX' string). The rule triggers on HTTP traffic flowing to the client, suggesting a download or delivery of such a file. The 'Stripped Binary Delivered with Debug Info Removed' message implies an attempt to evade detection or analysis by removing debugging information, often associated with malware or unwanted applications.
This rule detects the delivery of a kernel rootkit module, specifically a Linux Kernel Module (LKM) or a Windows system file, over HTTP. It looks for HTTP responses where the URI ends with '.ko' (Kernel Object for Linux) or '.sys' (system file for Windows) and the file data contains the 'ELF' magic bytes, indicating an Executable and Linkable Format file, which is common for Linux executables and modules. This combination suggests an attempt to deliver a malicious kernel module.
This rule detects HTTP C2 traffic attempting to store a fileless payload in the Windows Registry. It specifically looks for HTTP responses (flow:to_client) containing the strings 'HKCU' (likely indicating a registry key path), 'powershell', and 'IEX' (Invoke-Expression), which are common indicators of PowerShell-based fileless malware using the registry for persistence or execution.
This rule detects network traffic, specifically HTTP responses (flow:to_client), that contain the strings "GetProcAddress" and "LoadLibraryA" (case-insensitive). These strings are commonly associated with dynamic API resolution techniques used by malware to load functions at runtime, often to evade static analysis. The rule is classified as detecting trojan activity.
This rule detects the presence of a Right-to-Left Override (RLO) character (Unicode E2 80 AE) in HTTP response content, specifically within file data. This character can be used in filenames to visually reverse the order of characters, making a file appear to have a different extension or name than it actually does, a common technique for defense evasion and tricking users into executing malicious files.
This rule detects attempts to delete a cloud security group rule via the AWS EC2 API. Specifically, it looks for HTTP traffic to 'ec2.amazonaws.com' with the URI containing 'RevokeSecurityGroupIngress', which is the API call used to remove an inbound rule from a security group.
This rule detects network traffic on TCP port 445 (SMB) containing the string "DisableRealtimeMonitoring" (case-insensitive). This string is often associated with attempts to disable real-time monitoring features of security products, typically by modifying registry keys. The detection is focused on traffic flowing from any source to the home network, specifically to the SMB port, and only on established connections. This activity is indicative of an attacker attempting to evade detection by crippling security software.
This rule detects attempts to disable Windows Defender via a registry modification, specifically looking for the string "DisableAntiSpyware" in HTTP client body traffic. This activity is often associated with malware or adversary actions to evade defense mechanisms.
This rule detects attempts to set the hidden attribute on a file using the 'attrib +h' command over a network connection to a Windows machine (port 445). This technique is often used by attackers to hide malicious files from users and system administrators, contributing to defense evasion.
This rule detects attempts to create hidden files or directories in the /tmp directory on a remote host via SSH. Specifically, it looks for SSH traffic (tcp port 22) containing the strings "touch ." and "/tmp/." (case-insensitive). This behavior is often associated with adversaries attempting to hide their artifacts on a compromised system.
This rule detects a TLS downgrade attack where a client attempts to establish a connection using a weaker TLS protocol version, specifically TLS 1.0. This could indicate an attacker forcing a less secure communication channel to exploit vulnerabilities in older TLS versions.
This rule detects attempts to clear the Bash history using the 'history -c' command over an established SSH connection. It specifically looks for the case-insensitive string 'history -c' within TCP traffic flowing from the client to the server on port 22 (SSH). This activity is often associated with an attacker attempting to cover their tracks after gaining unauthorized access.
This rule detects the presence of an MSBuild inline task payload within HTTP traffic. It specifically looks for the combination of the strings "<UsingTask", "TaskFactory", and "Code" (case-insensitive) within the file data of an HTTP response. This pattern is indicative of an MSBuild inline task, which can be used by attackers for proxy execution, often as a defense evasion technique.
This rule detects HTTP requests where the URI contains common developer utility executables (msbuild, csc, vbc, jsc) being used as a proxy for code execution. This behavior is often associated with defense evasion techniques where legitimate tools are leveraged for malicious purposes.
This rule detects attempts to load a PowerShell assembly reflectively in memory. It specifically looks for the string "[System.Reflection.Assembly]::Load(" within HTTP response data flowing to a client. This technique is often used by malware to execute malicious code without writing it to disk, making it a common defense evasion tactic.
Page 79 of 93