Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,431 detections
Filters
Last updated
All Time
Detection languages
2,428
3
Contributors
747
554
405
315
183
Categories
1,914
1,291
689
671
449
Platforms
2,202
183
149
62
49
Products / Services
2,366
1,378
38
37
25
MITRE Techniques
537
454
342
308
301
CVEs
17
10
9
9
9
IDS Classtypes
1,098
452
204
154
102
IDS Protocols
2,431
868
408
324
97
This rule detects HTTP traffic where the User-Agent header contains "MSHTML", indicating potential remote script execution via Mshta. Mshta.exe is a Microsoft utility that can execute HTML Application (HTA) files, which can contain scripts. Attackers often abuse Mshta to execute malicious scripts, bypassing traditional execution policies. The rule specifically looks for outbound HTTP connections from the internal network ($HOME_NET) to any external destination, where the User-Agent string includes "MSHTML" (case-insensitive). This behavior is commonly associated with trojan activity and defense evasion tactics.
This rule detects the string "CheckRemoteDebuggerPresent" within HTTP response payloads. This string is associated with an anti-debugging technique used by malware to detect if it's being analyzed in a debugger environment. The rule specifically looks for this content in data flowing from the server to the client (flow:to_client,established; file.data;). The detection is case-insensitive (nocase).
This rule detects the delivery of an HTA (HTML Application) file via HTTP. It specifically looks for HTTP responses containing a URI with the '.hta' extension (case-insensitive) and the content '<HTA:APPLICATION' (case-insensitive) within the file data, indicating an HTA application being served to a client. This technique is often used by attackers for defense evasion and initial access.
This rule detects the delivery of a tool capable of dumping LSASS memory over HTTP. It specifically looks for the string "MiniDumpWriteDump" within HTTP response data, which is a function commonly used by tools to extract credentials from the LSASS process.
This rule detects attempts to modify an Azure Management Group, specifically when a PUT request is made to 'management.azure.com' with 'managementGroups' in the URI. This activity could indicate an attempt to evade defenses by altering management group configurations.
This rule detects the delivery of a payload containing the strings "SpAcceptCredentials" and "hook" within HTTP response body data. This pattern is indicative of an SSPI credential hooking attempt, where an attacker tries to intercept or steal credentials by injecting malicious code into the Security Support Provider Interface (SSPI) process. The detection is focused on traffic flowing from the server to the client.
This rule detects the presence of an API hooking payload within HTTP response data, specifically looking for the strings "SetWindowsHookEx" and "WH_KEYBOARD" (case-insensitive). This combination suggests an attempt to intercept keyboard input, which is a common technique used by malware for credential interception.
This rule detects potential keylogger data exfiltration over HTTP POST requests. It specifically looks for HTTP POST requests where the URI contains the string 'keys' (case-insensitive) and the data size is greater than 200 bytes. This combination suggests that a keylogger might be sending captured keystrokes or other sensitive data to a remote server.
This rule detects attempts to access SSH private key files (id_rsa, id_dsa, id_ecdsa, or .pem files) via HTTP. It specifically looks for these file extensions or names in the HTTP URI, indicating a potential exposure of sensitive SSH credentials on a web server.
This rule detects HTTP requests for the '.env' file, which often contains sensitive environment variables and credentials. An attacker successfully retrieving this file could gain access to critical system information, API keys, database credentials, and other secrets, leading to further compromise. The rule specifically looks for the string '/.env' in the HTTP URI, indicating an attempt to access this configuration file.
This rule detects the exfiltration of AWS temporary credential tokens over HTTP. It specifically looks for HTTP client body content containing both "ASIA" (which is a common prefix for AWS temporary access keys) and "aws_session_token" (the parameter name for the session token). The detection is case-insensitive and targets established HTTP connections where data is flowing from the client to the server.
This rule detects the exfiltration of a GitHub Personal Access Token (PAT) over HTTP. It specifically looks for the string "ghp_" in the client body of HTTP traffic, which is a common prefix for GitHub PATs. The rule is designed to identify instances where a PAT might be sent from an internal network to an external server, indicating potential credential compromise or data exfiltration.
This rule detects potential EWM (Event-Window-Message) injection attempts via the SetWindowLong API by looking for the presence of both "SetWindowLongPtr" and "GetWindowLongPtr" strings in HTTP client-bound file data. This technique is often used for privilege escalation or code injection.
Detects HTTP requests with known scanner or automation user-agents commonly used by reconnaissance tools like Nikto, sqlmap, or curl-based scripts. This rule specifically looks for 'sqlmap', 'nikto', 'curl', and 'python-requests' within the HTTP User-Agent header.
This rule detects the creation of a cluster role binding in a Kubernetes environment, specifically looking for HTTP POST requests to the Kubernetes API server's rbac.authorization.k8s.io endpoint for 'rolebindings'. This activity can indicate an attempt to establish persistence within the cluster by granting specific permissions to an identity.
This rule detects when an AWS IAM user policy is attached, specifically looking for the 'AttachUserPolicy' action on 'iam.amazonaws.com'. This could indicate an attempt to escalate privileges or grant new permissions to a compromised account.
This rule detects when a credential (password) is added to an Azure Service Principal. This activity is identified by monitoring HTTP traffic for requests to 'graph.microsoft.com' containing 'addPassword' in the URI. This could indicate an attacker establishing persistence by adding new credentials to an existing service principal.
This rule detects the delivery of a macOS Startup Item Property List (.plist) file via HTTP that contains the string "StartupParameters". This could indicate an attempt to establish persistence on a macOS system by creating or modifying a startup item.
This rule detects the download of installer packages (MSI, PKG, DEB, RPM) over HTTP that contain the string 'CustomAction'. This combination is often used by malicious installers to establish persistence on a system by creating custom actions that execute at specific events.
This rule detects the delivery of a payload associated with a COR_PROFILER DLL hijacking technique. It specifically looks for HTTP traffic flowing to the client that contains both the string "COR_PROFILER" and the file extension ".dll" (case-insensitive) within the file data. This indicates an attempt to deliver a malicious DLL that could be used for persistence or privilege escalation by exploiting the COR_PROFILER environment variable.
This rule detects attempts to disable Conditional Access Policies in Microsoft 365 via the Microsoft Graph API. It specifically looks for HTTP PATCH requests to 'graph.microsoft.com' targeting the 'conditionalAccess/policies' endpoint. Such activity could indicate an attacker attempting to bypass security controls for persistence or privilege escalation.
Page 102 of 116