Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,431 detections
Filters
Last updated
All Time
Detection languages
2,428
3
Contributors
747
554
405
315
183
Categories
1,914
1,291
689
671
449
Platforms
2,202
183
149
62
49
Products / Services
2,366
1,378
38
37
25
MITRE Techniques
537
454
342
308
301
CVEs
17
10
9
9
9
IDS Classtypes
1,098
452
204
154
102
IDS Protocols
2,431
868
408
324
97
This rule detects potential malware payloads encrypted with RC4. It specifically looks for HTTP responses (flow:to_client,established) containing the string "RC4" (case-insensitive) and a long base64-like string (at least 100 characters, optionally ending with padding) within the file data. This combination suggests an RC4-encrypted payload being delivered to a client.
This rule detects when a bootloader file is delivered via HTTP. It specifically looks for HTTP responses (flow:to_client) where the URI contains keywords like 'bootloader', 'grub', 'bootmgr', or 'mbr' (case-insensitive) and the file data contains the magic bytes '|55 AA|', which often indicate the end of a boot sector or a master boot record.
This rule detects when an Office Add-in is loaded from a remote URL, specifically targeting graph.microsoft.com. It looks for HTTP POST requests where the host is 'graph.microsoft.com' and the URI contains 'addIns'. This activity could indicate an attempt to establish persistence or execute malicious code via Office Add-ins.
This rule detects attempts to register a new OAuth application within Azure Active Directory by monitoring HTTP POST requests to the Microsoft Graph API endpoint '/applications' on 'graph.microsoft.com'. This activity can be indicative of an attacker establishing persistence or gaining unauthorized access to cloud resources by creating a malicious application.
This rule detects HTTP requests that contain 'schtasks' and '/create' in the URI, indicating an attempt to create a scheduled task. This activity is often associated with adversaries establishing persistence or executing commands on a compromised system, potentially breaking the process tree for forensic analysis. The rule specifically looks for these keywords in a case-insensitive manner within the HTTP URI.
This rule detects network connections to known command and control (C2) infrastructure associated with OMG Cable or Hak5 devices. It specifically looks for HTTP requests where the host header matches 'c2.hak5.org' or 'wifi-pineapple.com'. This indicates potential malicious activity where an attacker might be using these devices for command and control.
This rule detects the delivery of a payload via HTTP that contains the string "SetWindowsHookEx" (case-insensitive). This string is associated with a Windows API function used to install a hook procedure that monitors system events. Attackers often use this technique for persistence or to inject malicious code into other processes.
This rule detects HTTP PUT requests to Amazon S3 or Azure Blob Storage (cloud storage services) where the request body size is between 100 and 2000 bytes. This pattern is often indicative of one-way command and control (C2) communication, where an attacker might be exfiltrating small chunks of data or sending commands to a compromised host via cloud storage. The thresholding mechanism (20 events within 300 seconds from the same source) aims to reduce alerts from legitimate, infrequent cloud storage interactions.
This rule detects bidirectional Command and Control (C2) communication utilizing the Telegram Bot API. It specifically looks for HTTP traffic where the host is 'api.telegram.org' and the URI contains '/bot'. A threshold of 10 occurrences within 60 seconds from the same source IP is set to reduce false positives.
This rule detects when Azure Monitor Diagnostic Settings are deleted. It specifically looks for HTTP DELETE requests to 'management.azure.com' with 'diagnosticSettings' in the URI. This activity could indicate an attacker attempting to evade detection by removing logging configurations.
This rule detects attempts to spoof process arguments to evade detection by looking for specific strings in HTTP traffic. It specifically looks for the strings "NtQueryInformationProcess" and "ProcessCommandLineInformation" (case-insensitive) in file data within established HTTP client-to-server flows. This behavior is often associated with malware or advanced persistent threats trying to hide their true command-line arguments from security tools.
This rule detects potential process argument spoofing attempts by looking for specific strings within HTTP traffic. It specifically searches for 'CreateProcessW' and 'lpCommandLine' in the file data of HTTP responses, indicating that a client might be receiving a payload designed to create a process with spoofed command-line arguments. This technique is often used by malware to hide its true intentions or evade detection.
This rule detects the use of the JamPlus build tool for potentially malicious execution. It specifically looks for HTTP traffic where the URI contains 'jamplus' or 'jam.exe' and the file data starts with 'MZ', indicating an executable file download. This combination suggests an attempt to deliver or execute a malicious JamPlus-compiled executable.
This rule detects the delivery of a Compiled HTML Help (CHM) file via HTTP that contains the string "ITSF" within its file data. CHM files can be used to deliver malicious content, and the presence of "ITSF" (likely indicating an InfoTech Storage Format header) combined with HTTP delivery suggests a potential attempt to bypass security controls or execute malicious code. This is often associated with T1218.001 (Signed Binary Proxy Execution: Compiled HTML Help) from the MITRE ATT&CK framework.
This rule detects HTTP requests containing 'verclsid' and '/S' in the URI, which is indicative of the Verclsid COM Object Proxy Execution technique (T1218.012). This technique is often used by attackers for defense evasion by executing arbitrary commands or binaries through a COM object.
This rule detects attempts to download files that appear to be password hash lists or wordlists, often used for offline credential cracking. It specifically looks for HTTP URIs containing keywords like 'rockyou', 'passwords', 'wordlist', or 'hashlist' followed by '.txt', and only triggers if the downloaded file size is greater than 10,000 bytes. This activity is indicative of an attacker attempting to exfiltrate or acquire data for credential access.
This rule detects attempts to dump the Security Account Manager (SAM) hive using the 'reg save' command over HTTP. Specifically, it looks for HTTP requests containing 'reg save' and 'HKLM\SAM' in the URI, indicating an attempt to extract credential information from a Windows system.
This rule detects attempts to harvest private key files (with extensions like .key, .pem, .p12, .pfx, .pkcs12) via HTTP requests, often indicative of a web shell being used to exfiltrate sensitive cryptographic material from a compromised server. The detection is based on the URI of the HTTP request.
This rule detects attempts to access secrets stored in Google Cloud Platform (GCP) Secret Manager via its API. It specifically looks for HTTP traffic directed to 'secretmanager.googleapis.com' with a URI path containing '/versions/' and ':access', indicating an attempt to access a specific secret version.
This rule detects attempts to retrieve secret values from AWS Secrets Manager. It specifically looks for HTTP requests to 'secretsmanager.amazonaws.com' containing 'GetSecretValue' in the URI. This activity could indicate an attacker attempting to access sensitive credentials.
This rule detects the delivery of a Windows Credential Manager dump tool over HTTP. It specifically looks for the case-insensitive string "CredEnumerate" within the file data of an HTTP response flowing to the client. This string is indicative of tools designed to interact with or dump credentials from the Windows Credential Manager.
Page 80 of 116