Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,937 detections
Filters
Last updated
All Time
Detection languages
1,930
3
2
1
1
Contributors
592
477
360
250
124
Categories
995
927
834
546
538
Platforms
1,753
214
81
54
41
Products / Services
1,868
1,144
65
51
17
MITRE Techniques
564
412
305
201
175
CVEs
4
4
4
2
2
IDS Classtypes
1,937
503
461
381
236
IDS Protocols
1,098
362
201
171
37
This rule detects HTTP requests to archive.org for image files (png, jpg, jpeg, svg, gif, tiff) that have minimal request headers, specifically lacking both 'User-Agent' and 'Referer' headers. This behavior can be indicative of automated tools or malware attempting to retrieve content while trying to evade detection or hide their origin.
ET ATTACK_RESPONSE ClickFix Obfuscated Payload Inbound
ET MALWARE TA569 Middleware Server Domain in TLS SNI (buildtoolsrvcore .com)
ET MALWARE TA569 Middleware Server Domain in DNS Lookup (parserapiprocess .com)
ET MALWARE TA569 Middleware Server Domain in DNS Lookup (buildtoolsrvcore .com)
This rule detects suspicious WebAssembly (WASM) code in HTTP responses that indicates the allocation of Read-Write-Execute (RWX) memory pages. This pattern is a common precursor to shellcode execution within a web browser, often used by exploit kits or malicious websites to achieve arbitrary code execution. The rule specifically looks for JavaScript code that initializes a WebAssembly module with a byte array containing specific patterns indicative of RWX memory allocation, followed by instantiation and export calls.
ET MALWARE TA569 Middleware Server Domain in DNS Lookup (cronapiworkersvc .com)
ET MALWARE MEOWBACKCONN CnC Checkin
ET MALWARE TA569 Gholoader CnC Domain in TLS SNI (secure .kasindramaharaj .com)
ET MALWARE TA569 Middleware Server Domain in TLS SNI (sessionstorexint .com)
ET MALWARE TA569 Middleware Server Domain in TLS SNI (parserapiprocess .com)
ET MALWARE Observed DNS Query to Malicious Domain (significant-adopted-bearing-own .trycloudflare .com)
ET ATTACK_RESPONSE ClickFix Related Payload Inbound
ET ATTACK_RESPONSE ClickFix Webpage Inbound
ET ATTACK_RESPONSE Koi Loader/Stealer Payload Inbound
ET MALWARE TA569 Middleware Server Domain in TLS SNI (taskrunnersrvmod .com)
ET MALWARE Observed DNS Query to Malicious Domain (tamku .shoplerter .opnetorologies .net)
ET MALWARE Observed VBScript Payload Downloader Inbound
ET MALWARE MEOWBACKCONN CnC Checkin - Server Response
ET MALWARE TA569 Gholoader CnC Domain in TLS SNI (plesk .breeconsulting .net)
ET MALWARE TA569 Gholoader CnC Domain in DNS Lookup (plesk .breeconsulting .net)
Page 91 of 93