Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,431 detections
Filters
Last updated
All Time
Detection languages
2,428
3
Contributors
747
554
405
315
183
Categories
1,914
1,291
689
671
449
Platforms
2,202
183
149
62
49
Products / Services
2,366
1,378
38
37
25
MITRE Techniques
537
454
342
308
301
CVEs
17
10
9
9
9
IDS Classtypes
1,098
452
204
154
102
IDS Protocols
2,431
868
408
324
97
This rule detects the creation of a new service account key within Google Cloud Platform (GCP) via the 'iam.googleapis.com' API. Specifically, it looks for HTTP POST requests to URIs containing 'serviceAccounts' and 'keys'. This activity can be indicative of privilege escalation, where an attacker creates a new key for an existing service account to gain persistent access or elevate their privileges.
This rule detects potential thread hijacking attempts by looking for the presence of specific Windows API calls, 'SuspendThread' and 'SetThreadContext', within HTTP client-to-server traffic. These API calls are commonly used in thread hijacking techniques to manipulate the execution flow of a legitimate process, often to inject and execute malicious code. The rule specifically looks for these strings within file data transmitted over HTTP, suggesting an attempt to deliver a payload that utilizes these functions.
This rule detects potential command and control (C2) communication where data is hidden within image files using steganography. It specifically looks for HTTP responses (flow:to_client) containing JPEG image headers ('FF D8 FF') within the first 3 bytes, with a file size greater than 500,000 bytes. A threshold is applied to trigger an alert if 5 such events occur from the same destination within 60 seconds, indicating a potential high volume of large steganographic image transfers.
This rule detects attempts to bypass the Mark-of-the-Web (MOTW) security feature by removing or altering the Zone.Identifier stream from downloaded files. Specifically, it looks for HTTP traffic (flow:to_client,established) containing both 'Zone.Identifier' and 'ZoneId=3' (which typically indicates an internet zone download) in the file data, suggesting an attempt to strip this metadata during transit to prevent security warnings or restrictions on the client side. This technique is often used by attackers to make malicious files appear less suspicious.
This rule detects attempts to obfuscate PowerShell commands by looking for the 'IEX' (Invoke-Expression) command combined with '(New-Object' within the HTTP URI. This combination is often used by attackers to execute malicious PowerShell scripts downloaded from a remote source, while attempting to evade detection through obfuscation.
This rule detects the delivery of a payload via HTTP that contains junk code padding and appears to be an executable file. Specifically, it looks for the byte sequence '90 90 90 90 90 90 90 90 90 90' (often used as NOPs for padding or obfuscation) followed by the 'MZ' magic bytes at the beginning of a file (indicating a Windows executable). The detection is triggered on HTTP responses flowing to the client.
This rule detects the delivery of a polymorphic engine payload via HTTP. It looks for specific content within the HTTP response body, including the strings "mutate" and "engine" (case-insensitive), and the "MZ" magic bytes at the beginning of the file data, indicating a Windows executable. This combination suggests the download of a polymorphic malware component designed to evade detection.
This rule detects HTTP traffic where the client body contains a long string of hexadecimal characters, which could indicate the use of non-standard encoding for Command and Control (C2) communication. The rule specifically looks for a hexadecimal string of at least 200 characters in the HTTP client body.
This rule detects the download of a multi-stage Command and Control (C2) stage two payload. It specifically looks for HTTP traffic where the referer header contains 'pastebin', 'github', 'discord', or 'telegram' (case-insensitive) and the file data starts with 'MZ', indicating a Windows executable. This combination suggests a potential malicious download from common code/file sharing platforms often used by attackers for C2 infrastructure.
This rule detects HTTP traffic where the host is 'gist.github.com' and the URI contains '/raw/', indicating a potential Dead Drop Resolver using GitHub Gist for Command and Control (C2) activities. It triggers an alert if five such connections are observed from the same source IP within 300 seconds.
This rule detects attempts to deploy a malicious pod via the Kubernetes API. It specifically looks for HTTP POST requests to the '/api/v1/namespaces/' endpoint followed by '/pods', indicating an attempt to create a new pod within a Kubernetes namespace.
FOFA Internet Asset Search Query
Suricata
This rule detects HTTP requests where the host header contains 'fofa.info'. FOFA is an internet asset search engine, similar to Shodan. This detection indicates that a system within the HOME_NET is making queries to FOFA, which could be part of reconnaissance activities to gather information about internet-facing assets.
This rule detects a potential HTTP POST flood Distributed Denial of Service (DDoS) attack. It triggers an alert when a single source IP address sends 100 or more HTTP POST requests to the server within a 10-second window. This behavior is indicative of an attempt to overwhelm the server with requests, consuming resources and potentially leading to service disruption.
This rule detects potential command and control (C2) activity where commands are hidden within PNG image files. It specifically looks for HTTP traffic flowing from the server to the client (to_client) that contains the PNG file signature (89 50 4E 47) within the first 4 bytes of the file data, and where the file size is greater than 100,000 bytes. A threshold is applied to trigger an alert if 10 such events occur within 60 seconds from the same destination IP address, indicating a potential high volume of C2 communication disguised as image downloads.
This rule detects HTTP POST requests where the client body contains a large string (over 200 characters) that appears to be Base64 encoded. The `pcre` (Perl Compatible Regular Expression) `/^[A-Za-z0-9+\/]{200,}={0,2}$/` specifically looks for strings composed of Base64 characters (alphanumeric, '+', '/', and optional '==') with a minimum length of 200 characters. This pattern is often used by malware for command and control (C2) communication to obfuscate data within HTTP traffic.
This rule detects attempts to inject OLE (Object Linking and Embedding) objects into web requests, specifically looking for the keywords 'CLSID' and 'ProgID' within the HTTP client body. This technique can be used for inter-process communication and potentially lead to arbitrary code execution or other forms of attack.
This rule detects an HTML file being served to a client that contains an embedded Base64 encoded executable payload. It specifically looks for the HTML download attribute (<a download=), the 'base64,' string, and the 'TVQAA' string, which is a common signature for the beginning of a Base64 encoded Windows executable (MZ header). The detection is performed on HTTP traffic flowing to the client.
This rule detects the delivery of a malicious LNK file via HTTP that utilizes icon smuggling. It specifically looks for HTTP responses containing a URI with ".lnk" and the byte sequence "|4C 00 00 00|" at the beginning of the file data, which is characteristic of LNK files. Icon smuggling is a defense evasion technique where a malicious file disguises itself with a legitimate icon to trick users into executing it.
This rule detects the download of a ClickOnce application manifest that contains specific content indicating it might be malicious. It looks for HTTP responses (flow:to_client,established) where the URI contains ".application" (case-insensitive) and the file data contains "asmv1:assembly" (case-insensitive). This combination suggests a ClickOnce deployment, which can be abused to deliver malware.
This rule detects the presence of the string "ReflectiveLoader" in HTTP response bodies, which is indicative of a Reflective DLL Loading payload. Reflective DLL loading is a technique used by attackers to load a DLL into a process without the need for the DLL to be present on disk, often used for defense evasion.
This rule detects HTTP traffic where the URI contains both "pcalua" and "-a" (case-insensitive). This pattern is indicative of indirect execution via pcalua.exe, a legitimate Windows utility that can be abused by attackers to proxy execution of other programs, often for defense evasion. The rule specifically looks for this behavior in HTTP requests, suggesting an attempt to download or execute a payload indirectly.
Page 72 of 116