Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,431 detections
Filters
Last updated
All Time
Detection languages
2,428
3
Contributors
747
554
405
315
183
Categories
1,914
1,291
689
671
449
Platforms
2,202
183
149
62
49
Products / Services
2,366
1,378
38
37
25
MITRE Techniques
537
454
342
308
301
CVEs
17
10
9
9
9
IDS Classtypes
1,098
452
204
154
102
IDS Protocols
2,431
868
408
324
97
Detects outbound HTTP POST requests characterized by a specific URL pattern consisting of two segments of 4-16 alphanumeric characters, typically observed in Emotet C2 traffic. The rule specifically matches requests with a Content-Type header set to application/octet-stream, which is indicative of malicious binary payload transfer or communication.
This rule detects network traffic originating from internal hosts to external destinations consistent with default Cobalt Strike HTTP Beacon communication patterns. It specifically looks for GET requests containing URI paths commonly associated with default Cobalt Strike profiles (ca, submit.php, updates.rss) combined with a specific, hardcoded User-Agent string associated with Cobalt Strike's default configuration.
This rule detects suspicious HTTP request bodies containing the 'LD_PRELOAD' environment variable assignment, targeting common temporary or writable directories. This behavior is indicative of an attempt to perform dynamic linker hijacking on a Linux system to inject malicious shared libraries into target processes.
This rule detects the use of the 'msiexec.exe' utility to fetch and potentially execute an '.msi' installer package directly from a remote source via HTTP. This behavior is a known technique for bypassing application control by abusing a signed system binary to download and install malicious packages.
This rule detects POST requests to the URI '/api/device/start' which is indicative of the EvilTokens phishing kit attempting to initiate a Microsoft OAuth Device Code flow. This technique is often used in phishing campaigns to gain unauthorized access to user accounts by tricking them into authenticating through a device code.
This rule detects network traffic indicative of the 'EvilTokens' phishing kit, specifically targeting Microsoft OAuth Device Code flow. It looks for HTTP POST requests to the '/api/device/start' URI on domains hosted on Cloudflare Workers ('.workers.dev'). This pattern suggests an attempt to initiate a device code phishing attack, where adversaries trick users into entering credentials or codes to grant access to malicious applications.
Detects outbound HTTP requests exhibiting a User-Agent string hardcoded to mimic Firefox 20.0 (Mozilla/5.0 (Windows NT 6.2; rv:20.0) Gecko/20121202 Firefox/20.0), which is characteristic of the Adaptix C2 framework. This pattern is commonly used by adversaries for command-and-control communication.
This rule detects a specific typosquatting pattern used by the EvilTokens phishing kit. It looks for HTTP traffic where the host contains 'workers.dev' and matches a regular expression for 'viewdoc[a-z0-9\-]+\.workers\.dev'. This indicates an attempt to mimic legitimate Cloudflare Workers domains for phishing purposes, specifically targeting the 'viewdoc' pattern often seen in document-sharing lures.
This rule detects network activity associated with the Hashtopolis agent. Specifically, it looks for the string "hashtopolis" within the HTTP User-Agent header of traffic flowing from a client to a server. This activity is linked to the 'FortiBleed campaign', which involves distributed offline cracking of SHA-256 FortiGate administrator credential hashes.
This rule detects POST requests to the URI '/api/device/start' which is indicative of the EvilTokens phishing kit attempting to initiate a Microsoft OAuth Device Code flow. This technique is often used in phishing campaigns to gain unauthorized access to user accounts by tricking them into authenticating through a device code.
This rule detects a high volume of HTTP requests to Salesforce API endpoints associated with bulk data queries. Specifically, it looks for 20 or more requests within a 60-second window from a single source IP to 'salesforce.com' with URI paths containing both '/services/data/' and '/query/'. This pattern suggests a potential bulk download of customer records or other data via the Salesforce API.
This rule detects potential domain fronting activity used to hide Command and Control (C2) servers. It specifically looks for HTTP traffic where the TLS Server Name Indication (SNI) or HTTP Host header contains known domain fronting providers like cloudfront.net or azureedge.net, combined with a suspicious pattern in the HTTP Host header that includes an 8 or more character alphanumeric string followed by a top-level domain commonly associated with malicious activity (xyz, top, club, icu). This combination suggests an attempt to disguise C2 communications by routing them through legitimate content delivery networks.
This rule detects HTTP traffic to specific Visual Studio Code (VS Code) remote tunnel domains, specifically 'tunnels.api.visualstudio.com' or 'vscode.dev'. A high frequency of such connections (10 times within 60 seconds from the same source) is flagged as potential command and control (C2) activity, indicating the use of VS Code Remote Tunnels as a C2 channel.
This rule detects HTTP traffic where the client body contains a long string (100 or more characters) composed exclusively of uppercase letters and digits 2-7, potentially followed by padding characters. This pattern is indicative of custom alphabet base encoding, often used in Command and Control (C2) communications to obfuscate data.
This rule detects the delivery of a payload associated with the 'Incognito Token Theft Tool'. It specifically looks for the case-insensitive string 'list_tokens' within HTTP response body content flowing from a server to a client. This string is indicative of the tool's functionality, which often involves listing tokens for exfiltration or further abuse, suggesting an attempt at privilege escalation or credential access.
This rule detects when an OAuth application is granted tenant-wide administrative permissions within a Microsoft 365 environment. It specifically looks for HTTP POST requests to 'graph.microsoft.com' with the URI containing 'oauth2PermissionGrants'. This activity is indicative of a malicious OAuth app attempting to gain broad access to an organization's data and resources, often as a persistence mechanism.
This rule detects a high volume of HTTP POST requests to known SMS API providers (Twilio, Nexmo, Vonage) from a single source IP address within a short timeframe. This pattern is indicative of a 'pumping attack' or SMS fraud, where an attacker attempts to generate a large number of SMS messages, often to premium rate numbers, to incur charges or exploit vulnerabilities in billing systems. The threshold is set to 20 requests within 60 seconds from the same source.
This rule detects attempts to disable AWS CloudTrail logging via the AWS API. It specifically looks for HTTP requests to 'cloudtrail.amazonaws.com' with 'StopLogging' in the URI, indicating an attempt to stop CloudTrail from recording API activity.
This rule detects the delivery of a malicious XSL (Extensible Stylesheet Language) script via HTTP to a client. The detection is based on the HTTP URI containing ".xsl" (case-insensitive) and the file data containing "<msxsl:script" (case-insensitive). This pattern is indicative of an attempt to use XSLT for proxy execution, often associated with techniques like WMIC (Windows Management Instrumentation Command-line) for defense evasion.
This rule detects attempts to bypass macOS Gatekeeper by removing the 'com.apple.quarantine' extended attribute from downloaded files. It specifically looks for HTTP responses containing the string 'com.apple.quarantine' in the file data, indicating a potential attempt to modify or remove this attribute during or after a download.
This rule detects HTTP traffic containing the string "KerberosRequestorSecurityToken" in the file data, indicating a potential Kerberos exploit for credential theft delivery. The detection is focused on traffic flowing from the server to the client.
Page 71 of 116