Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,937 detections
Filters
Last updated
All Time
Detection languages
1,930
3
2
1
1
Contributors
592
477
360
250
124
Categories
995
927
834
546
538
Platforms
1,753
214
81
54
41
Products / Services
1,868
1,144
65
51
17
MITRE Techniques
564
412
305
201
175
CVEs
4
4
4
2
2
IDS Classtypes
1,937
503
461
381
236
IDS Protocols
1,098
362
201
171
37
This rule detects network traffic containing the string "/etc/udev/rules.d/" over TCP port 22 (SSH). This string is indicative of an attempt to modify udev rules, which can be used for Linux persistence by executing malicious scripts or commands when specific hardware events occur. The detection is focused on traffic flowing from the home network to a server on the home network, suggesting an internal system attempting to modify udev rules on another internal system via SSH.
This rule detects the download of installer packages (MSI, PKG, DEB, RPM) over HTTP that contain the string 'CustomAction'. This combination is often used by malicious installers to establish persistence on a system by creating custom actions that execute at specific events.
This rule detects the creation of an Emond rule on macOS systems, which can be used for persistence. It specifically looks for network traffic containing the string "/etc/emond.d/" in a TCP flow to a server on port 22 (SSH). This indicates an attempt to establish or modify an Emond rule, which allows for scheduled execution of commands or scripts.
This rule detects the delivery of a payload associated with a COR_PROFILER DLL hijacking technique. It specifically looks for HTTP traffic flowing to the client that contains both the string "COR_PROFILER" and the file extension ".dll" (case-insensitive) within the file data. This indicates an attempt to deliver a malicious DLL that could be used for persistence or privilege escalation by exploiting the COR_PROFILER environment variable.
This rule detects attempts to block defender access by holding a file or resource lock. Specifically, it looks for TCP traffic on port 445 (SMB) containing the string "LockFile" in a case-insensitive manner. A threshold of 10 occurrences within 10 seconds from the same source IP is set to trigger an alert, indicating potential malicious activity aimed at hindering security software.
This rule detects the delivery of a potential autostart payload as a startup script over HTTP. It looks for HTTP URIs containing keywords like 'startup', 'autostart', or 'autorun' (case-insensitive) and checks the file data for the 'MZ' header, indicating an executable file, within the first 2 bytes of the file content. This combination suggests an attempt to deliver an executable that could be configured for persistence.
This rule detects the download of obfuscated JavaScript code that uses 'eval(String.fromCharCode(' to execute content. This pattern is commonly used by malware to hide malicious scripts, often acting as a stager to download and execute further payloads. The detection specifically targets HTTP responses (flow:to_client) containing this string, indicating a client is receiving such obfuscated code.
This rule detects the delivery of a Node.js reverse shell payload over HTTP. It looks for HTTP responses (flow:to_client) containing the strings "require('net')" and "connect(" (case-insensitive), which are indicative of Node.js code attempting to establish a network connection, often for a reverse shell.
This rule detects the download of a Python script that contains code indicative of operating system command execution. Specifically, it looks for the strings "os.system(" and "subprocess" within HTTP response data, suggesting the script intends to execute system commands.
This rule detects email attachments with VBScript extensions (.vbs, .vbe) delivered via SMTP. It specifically looks for the filename attribute in the email flow to the server, indicating a potential malicious script delivery.
This rule detects the delivery of malicious VBScript macros within Office files over HTTP. It specifically looks for the presence of 'CreateObject' and 'WScript.Shell' strings in the file data, which are commonly used by VBScript macros to interact with the operating system and execute commands.
This rule detects the download of Visual Basic Script (VBS, VBE, VBA) files via HTTP. It specifically looks for HTTP responses where the URI contains file extensions commonly associated with Visual Basic scripts, indicating a potential attempt to deliver malicious scripts to a client system.
This rule detects the transfer of a potentially malicious PDF file containing embedded JavaScript over HTTP. It specifically looks for the PDF file header '%PDF' followed by the string '/JavaScript' within the file data, indicating the presence of JavaScript code within the PDF. This is a common technique used by attackers to execute malicious code when the PDF is opened.
This rule detects the opening of a potentially malicious Office document containing macros. It specifically looks for HTTP traffic where the response body contains both "[Content_Types].xml" and "vbaProject", which are indicators of an Office document (like .docx, .xlsx, .pptx) that includes VBA macros. The 'flow:to_client,established' indicates that the document is being downloaded by a client over an established HTTP connection.
This rule detects attempts to load a DLL module from a remote network path over SMB. It specifically looks for traffic on port 445 (SMB) containing both ".dll" and "\\" (indicating a network path) in a case-insensitive manner. This behavior is often associated with trojan activity or other forms of malicious execution where an attacker might try to load a malicious DLL from a shared network drive.
This rule detects the download of a CSV file that contains a Dynamic Data Exchange (DDE) attack payload. Specifically, it looks for HTTP responses delivering a file with a '.csv' extension and the string '=HYPERLINK(' within the file data, indicating a potential DDE exploit attempt.
This rule detects a payload download after a redirect chain, which is a common technique used in user execution attacks. It specifically looks for HTTP responses containing a redirect pattern in the HTTP referer and then checks for the 'MZ' magic bytes (indicating a Windows executable) in the file data within a short depth. This suggests a user being redirected and then automatically downloading a malicious executable.
This rule detects the download of files that have a 'double extension' pattern, specifically where a common document or image file extension (pdf, doc, jpg, png) is followed by an executable extension (exe, bat, vbs, ps1). This pattern is often used by attackers to trick users into executing malicious files, as the operating system might only display the first extension, making the file appear benign. The detection is based on analyzing the HTTP URI for this specific naming convention.
This rule detects suspicious executable downloads from email-related referers. It specifically looks for HTTP traffic where the referer header contains keywords like 'mail.', 'webmail.', 'outlook.', 'gmail.', or 'yahoo.com', indicating the download originated from an email client or webmail interface. The rule further narrows down the detection to files containing the 'MZ' header (characteristic of Windows executables) with a size greater than 10000 bytes, suggesting a potential malicious executable being delivered via email.
This rule detects HTTP traffic containing the string "duckyScript" in the file data, indicating a potential payload delivery page associated with OMG Cables or Rubber Ducky devices. These devices are often used for injecting malicious keystrokes or other payloads.
This rule detects suspicious software installers being downloaded over HTTP. It looks for HTTP responses containing the 'MZ' header (indicating a Windows executable) with a file size greater than 1MB, and where the HTTP URI contains keywords like 'setup', 'install', or 'update'. The rule is thresholded to trigger if three such events occur from the same source within 60 seconds, aiming to identify potential malware or unwanted software distribution.
Page 87 of 93