Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,431 detections
Filters
Last updated
All Time
Detection languages
2,428
3
Contributors
747
554
405
315
183
Categories
1,914
1,291
689
671
449
Platforms
2,202
183
149
62
49
Products / Services
2,366
1,378
38
37
25
MITRE Techniques
537
454
342
308
301
CVEs
17
10
9
9
9
IDS Classtypes
1,098
452
204
154
102
IDS Protocols
2,431
868
408
324
97
This rule detects HTTP requests to the Google Cloud Asset Inventory API, specifically targeting the '/assets' endpoint. This activity could indicate an attempt to enumerate cloud resources within a Google Cloud Platform environment.
This rule detects attempts to enumerate AWS S3 buckets by making HTTP requests to s3.amazonaws.com with the '?list-type=2' parameter in the URI. This type of request is commonly used to list the contents of an S3 bucket.
This rule detects attempts to enumerate AWS EC2 instances via the DescribeInstances API call. It specifically looks for HTTP traffic destined for 'ec2.amazonaws.com' with 'DescribeInstances' in the URI, indicating a potential reconnaissance activity against AWS EC2 infrastructure.
This rule detects attempts to query the list of installed AntiVirus (AV) and Endpoint Detection and Response (EDR) products via a web shell. It specifically looks for HTTP requests containing 'wmic' and 'AntiVirus' in the URI, indicating an attempt to use Windows Management Instrumentation Command-line (WMIC) to enumerate security software.
This rule detects attempts to query software inventory using 'wmic product' via a web shell. It specifically looks for HTTP requests where the URI contains the string 'wmic product', indicating a potential command execution to enumerate installed software on a compromised system.
This rule detects attempts to enumerate objects within a Google Cloud Storage (GCS) bucket. It triggers when HTTP requests are made to 'storage.googleapis.com' with a URI containing '/b/', indicating an attempt to access or list buckets or their contents. The thresholding mechanism (10 events within 30 seconds from the same source IP) aims to identify rapid, potentially automated, enumeration activities.
This rule detects attempts to enumerate Azure Blob Storage containers. It specifically looks for HTTP requests targeting Azure Blob storage hosts (ending with '.blob.core.windows.net') and containing the query parameter '?comp=list', which is used to list containers within a storage account. This activity is indicative of reconnaissance or discovery against Azure cloud resources.
This rule detects HTTP traffic containing the strings "LogonUserA" and "ImpersonateLoggedOnUser" (case-insensitive) in the file data. This combination of strings suggests an attempt to create a token for impersonation, which is a technique used for privilege escalation, specifically related to the MITRE ATT&CK technique T1134.003 (Token Impersonation/Theft: Impersonation). The rule is designed to identify shellcode or malicious code attempting to leverage these Windows API functions for privilege escalation.
This rule detects HTTP POST requests to graph.microsoft.com with the URI containing 'roleAssignmentScheduleRequests'. This pattern is indicative of an Azure PIM (Privileged Identity Management) Just-in-Time role activation request, which is a mechanism for users to temporarily elevate their privileges within Azure AD. While a legitimate administrative action, it can also be used by attackers for privilege escalation.
This rule detects the delivery of a payload containing the strings "Office Test" and "HKCU" over HTTP, indicating an attempt to modify the registry for persistence, potentially related to Office applications. The detection is based on inspecting file data within HTTP traffic flowing to the client.
This rule detects the creation of a new cloud account (user) in Amazon Web Services (AWS) via the Identity and Access Management (IAM) API. It specifically looks for HTTP traffic to 'iam.amazonaws.com' with 'CreateUser' in the URI, indicating an attempt to create a new IAM user.
This rule detects the upload of virtual machine disk images (VMDK, OVA, OVF, QCOW2, VHD) to cloud storage via HTTP PUT requests. The rule specifically looks for HTTP PUT methods, URIs ending with common VM image file extensions, and a minimum file size of 1MB, indicating a substantial file transfer. This activity could signify an attacker attempting to upload a backdoored or malicious VM image for persistence or to establish a foothold in a cloud environment.
This rule detects attempts to inject a malicious URL into the Outlook Home Page setting for persistence. It specifically looks for HTTP traffic (flow:to_client,established) containing the strings "HomePageURL" and "http" (case-insensitive) in the file data, indicating a potential attempt to modify Outlook's home page setting to point to an attacker-controlled URL.
This rule detects HTTP POST requests to Amazon Web Services (AWS) endpoints that are associated with non-standard or less common cloud regions. Specifically, it looks for 'amazonaws.com' in the HTTP host and then checks the HTTP URI for region codes 'ap-east' (Asia Pacific - Hong Kong), 'me-south' (Middle East - Bahrain), or 'af-south' (Africa - Cape Town). The detection is triggered when a resource creation (indicated by HTTP POST) is attempted in one of these regions, which might be unusual for an organization primarily operating in other regions, potentially indicating unauthorized activity or misconfiguration.
This rule detects the delivery of a potential rootkit payload via HTTP download. It specifically looks for HTTP responses (flow:to_client) where the URI contains keywords like 'rootkit', 'rkill', 'kernel.module', or 'lkm' (case-insensitive) and the file data starts with 'MZ', indicating a Windows executable.
This rule detects HTTP responses (flow:to_client) that contain specific strings indicative of an environment-keyed payload checking the domain before execution. Specifically, it looks for the case-insensitive strings "GetComputerNameEx" and "NetworkDomain" within the file data of the HTTP response. This behavior is often associated with malware attempting to determine its execution environment to evade analysis or target specific systems.
This rule detects HTTP responses from a server to a client that contain specific strings ('ComputerName', 'UserName', and 'MZ') within the file data. The presence of 'MZ' at the beginning (depth:2) suggests an executable file. The combination of these strings indicates a potential 'guardrail' payload checking the environment (computer name and user name) before executing, which is a common technique used by malware to evade analysis environments or target specific systems. The rule is designed to identify trojan activity related to defense evasion.
This rule detects character substitution obfuscation in web requests, specifically looking for three or more consecutive occurrences of URL-encoded characters that represent common path or null byte characters (e.g., '%5C' for '\', '%2F' for '/', '%00' for null, '%0A' for newline, '%0D' for carriage return). This pattern is often used by attackers to bypass security filters or to obscure malicious payloads in HTTP URIs.
This rule detects the installation of a root certificate via an HTTP response. It specifically looks for HTTP traffic flowing from the server to the client (to_client, established) where the URI contains ".cer" (case-insensitive) and the file data contains the string "-----BEGIN CERTIFICATE-----". This combination suggests a certificate file being delivered over HTTP, which could be indicative of a malicious root certificate installation attempt, often used in man-in-the-middle attacks or to establish persistence for malware.
This rule detects attempts to replace system binaries via malicious updates by inspecting HTTP responses. It specifically looks for HTTP traffic directed to the client, containing a file with the 'MZ' header (indicating a Windows executable) and a URI path that suggests a system binary location (e.g., /bin/, /sbin/, /usr/bin/). This combination indicates a potential malicious update delivering an executable to a critical system directory.
This rule detects the use of SVG files for HTML smuggling payloads. Specifically, it looks for HTTP responses containing an SVG file ('.svg' in the URI) that also contain '<script' and 'Blob(' within its data. This combination is indicative of an HTML smuggling technique where malicious content is hidden within a seemingly innocuous SVG file and then processed by JavaScript to construct a malicious payload, often a file download.
Page 79 of 116