Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,937 detections
Filters
Last updated
All Time
Detection languages
1,930
3
2
1
1
Contributors
592
477
360
250
124
Categories
995
927
834
546
538
Platforms
1,753
214
81
54
41
Products / Services
1,868
1,144
65
51
17
MITRE Techniques
564
412
305
201
175
CVEs
4
4
4
2
2
IDS Classtypes
1,937
503
461
381
236
IDS Protocols
1,098
362
201
171
37
This rule detects the download of potentially trojanized software updates. It specifically looks for HTTP traffic flowing to the client, where the URI contains "update" (case-insensitive), the HTTP host contains "update.", "cdn.", or "download." (case-insensitive), and the file data starts with "MZ" (indicating a Windows executable) within the first 2 bytes. Additionally, the downloaded file size must be greater than 500,000 bytes.
This rule detects attempts to download Python packages from the official Python Package Index (PyPI) where the package name in the URI appears to be a typosquatted version of common legitimate packages. Specifically, it looks for HTTP requests to pypi.org with URIs containing 'requets' (instead of 'requests'), 'boto' (instead of 'boto3' or similar), 'djang0' (instead of 'django'), 'flask2' (instead of 'flask'), or 'numpy2' (instead of 'numpy'). This indicates a potential supply chain attack where an attacker has registered a similarly named malicious package to trick users into downloading it.
This rule detects a potential watering hole attack where a legitimate website has been injected with a script that attempts to load content from an IP address. Specifically, it looks for HTTP responses (flow:to_client) containing '<script src=' followed by a URL where the source is an IP address (e.g., 'src="http://1.2.3.4/script.js"'). This technique is often used by attackers to compromise visitors of a trusted site by redirecting them to malicious content or exploiting vulnerabilities.
This rule detects potential command and control (C2) activity where a compromised WordPress site is used as a relay. It specifically looks for HTTP POST requests to URIs containing "wp-admin" with a data size greater than 1000 bytes. A threshold of 5 such events within 60 seconds from the same source IP triggers the alert, indicating a potential high volume of C2 communication.
MSHTA HTA Application Download
Suricata
This rule detects the download of an HTML Application (HTA) file that contains the string "<HTA:APPLICATION". HTA files can be used to execute malicious code, often bypassing browser security restrictions. The rule specifically looks for HTTP traffic where the URI contains ".hta" and the file data contains the HTA application tag, indicating a potential attempt to deliver or execute a malicious HTA.
This rule detects the download of a potential bootkit payload designed to overwrite the Master Boot Record (MBR). It specifically looks for HTTP traffic where the file data contains the byte sequence '|55 AA|' (which corresponds to the MBR signature) within the first 512 bytes and has a total size greater than 500 bytes. This pattern is indicative of malicious software attempting to modify the MBR for persistence or system control.
This rule detects potential JavaScript obfuscation within HTTP responses by looking for the presence of both 'eval(' and 'unescape(' within the first 500 bytes of file data in a client-bound HTTP flow. This combination of functions is often used in malicious JavaScript to hide its true intent and evade detection.
This rule detects attempts to modify the 'Run' key in the Windows Registry remotely over SMB (port 445). The 'Run' key is a common persistence mechanism used by attackers to ensure their malicious code executes every time a user logs in. The rule specifically looks for network traffic on port 445 containing the string 'SOFTWARE\Microsoft\Windows\CurrentVersion\Run', indicating a potential remote registry modification related to startup programs.
This rule detects attempts to disable the system firewall via HTTP traffic. It specifically looks for the 'netsh firewall disable' command within the HTTP flow, indicating a potential defense evasion tactic.
This rule detects attempts to modify the remote registry via Server Message Block (SMB) by looking for the strings "winreg" and "RegSetValue" in TCP traffic destined for port 445 on the home network. This activity could indicate an attacker attempting to establish persistence, elevate privileges, or evade defenses by altering system configurations.
This rule detects the download of a file that appears to be an Office document template designed for remote template injection. It specifically looks for HTTP responses containing the strings "[Content_Types].xml" and "attachedTemplate" (case-insensitive) within the file data, which are indicators of a malicious Office document attempting to load a remote template.
Havoc C2 Agent Beacon Detected
Suricata
This rule detects beaconing activity associated with the Havoc C2 agent. It specifically looks for HTTP POST requests to the '/login' URI, with a User-Agent header of 'Mozilla/5.0', and a data size between 101 and 499 bytes. A threshold of 10 such events within 60 seconds from the same source IP triggers the alert, indicating potential command and control communication.
This rule detects potential video stream exfiltration over HTTP POST. It specifically looks for HTTP POST requests with a large payload size (greater than 100,000 bytes) and the byte sequence '|52 49 46 46|' at the beginning of the file data, which corresponds to the 'RIFF' header commonly found in multimedia file formats like AVI and WAV. This combination suggests an attempt to upload or exfiltrate video or audio data.
Remote Service Stop via SMB
Suricata
This rule detects attempts to remotely stop a service via SMB (Server Message Block) by looking for the 'svcctl' and 'StopService' strings in TCP traffic on port 445. This activity is often associated with trojan activity or other malicious impact operations.
This Suricata rule detects C2 port hopping behavior by identifying a single source IP initiating 10 or more TCP SYN packets to different non-standard ports within a 30-second window. This pattern is indicative of command and control (C2) communication attempting to evade detection by frequently changing ports.
This rule detects the presence of a common China Chopper web shell pattern in HTTP client body content. Specifically, it looks for the string "eval(base64_decode(" (case-insensitive) within HTTP requests flowing to the server. This pattern is characteristic of how China Chopper web shells execute commands on compromised web servers.
This rule detects HTTP traffic where the URI contains ".sct" (scriptlet) in a case-insensitive manner. This is indicative of an attempt to download a scriptlet, which can be used by MSHTA (Microsoft HTML Application host) for defense evasion, often to execute malicious code.
This rule detects the presence of a large Base64 encoded string (at least 100 characters) within the HTTP client body of network traffic. This pattern is often used by attackers to obfuscate malicious payloads, aligning with the MITRE ATT&CK technique T1027 for Defense Evasion.
This rule detects DNS queries for 'pastebin.com'. This activity is often associated with Command and Control (C2) communication, where attackers use services like Pastebin to host malicious code, configuration data, or receive commands. The rule triggers if 10 such queries are observed from the same source IP within a 300-second (5-minute) window, indicating potential C2 activity or data exfiltration attempts.
This rule detects TCP connections to port 8888, which is commonly used by Remote Access Trojans (RATs) for Command and Control (C2) communications. The rule specifically looks for the SYN flag in the TCP handshake, indicating the initiation of a new connection from the internal network ($HOME_NET) to any external destination.
This rule detects network connections to TCP port 4444, which is a commonly used default handler port for Metasploit, a popular penetration testing framework. The rule specifically looks for the initial SYN packet (flags:S) of a TCP connection from any source to any destination on port 4444 within the home network. This activity is often associated with command and control (C2) communication or reverse shells established by attackers using Metasploit.
Page 88 of 93