Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,431 detections
Filters
Last updated
All Time
Detection languages
2,428
3
Contributors
747
554
405
315
183
Categories
1,914
1,291
689
671
449
Platforms
2,202
183
149
62
49
Products / Services
2,366
1,378
38
37
25
MITRE Techniques
537
454
342
308
301
CVEs
17
10
9
9
9
IDS Classtypes
1,098
452
204
154
102
IDS Protocols
2,431
868
408
324
97
This rule detects potential adversary-in-the-middle (AiTM) phishing attempts, specifically those leveraging tools like Evilginx. It triggers on HTTP requests where the URI contains the keywords "verify", "session", and "token" (case-insensitive). This combination of keywords in the URI is indicative of phishing pages designed to capture session tokens or verification codes.
This rule detects HTTP responses containing a PDF file that also includes the string "/URI" and "login" (case-insensitive). This combination is indicative of a malicious PDF credential phishing page being served to a client. The rule specifically looks for the PDF magic bytes at the beginning of the file data.
This rule detects suspicious HTTP traffic indicating a LinkedIn message that contains an external link. It specifically looks for HTTP requests to 'linkedin.com' with a URI containing '/messaging/' and triggers if 10 such events occur within 60 seconds from the same source IP address. This pattern is often associated with social engineering attempts where attackers use LinkedIn messaging to direct users to malicious external sites.
This rule detects potential organization information harvesting via web scraping. It triggers when a client makes 25 or more HTTP GET requests to URIs containing the string "about" (case-insensitive) within a 20-second window. This behavior could indicate an automated script or tool attempting to gather information from a website's 'about us' or similar pages.
This rule detects the delivery of a JavaScript payload that has been hex encoded. It specifically looks for the hex representation of the string "script" (\x73\x63\x72\x69\x70\x74) within HTTP response data flowing to the client. This technique is often used by attackers to obfuscate malicious JavaScript code and evade signature-based detection.
This rule detects attempts to delete files or directories using the 'rm -rf' command within a web request URI. This often indicates an attacker attempting to clean up traces of their activity or cause denial of service by removing critical files on a compromised web server.
This rule detects attempts to delete files on a web server using a web shell. It specifically looks for the 'unlink' command within HTTP URI requests, indicating a potential file deletion operation initiated through a compromised web application.
This rule detects attempts to enumerate USB devices on a system via a web shell. It specifically looks for HTTP URI requests containing 'wmic' and 'path Win32_USBHub', which are commands used to query USB device information using Windows Management Instrumentation (WMI). The 'nocase' modifier indicates that the content matching is case-insensitive.
This rule detects HTTP requests to a server that contain both 'password' and 'username' in the URI, case-insensitively. This pattern is indicative of a potential credential harvesting attempt where an attacker is trying to collect user credentials via a crafted web page or phishing site. The rule specifically looks for these keywords in the URI of an established HTTP connection flowing to the server.
This rule detects the delivery of a kernel exploit via HTTP. It specifically looks for HTTP responses (flow:to_client) containing a file with the 'MZ' header (indicating a Windows executable) and the string 'exploit' (case-insensitive) in the HTTP URI. This combination suggests an attempt to deliver a malicious executable, potentially a kernel exploit, to a client system.
This rule detects potential Process Doppelganging attempts by looking for specific Windows API calls related to Transactional NTFS (TxF) within HTTP traffic. Specifically, it looks for the presence of "NtCreateTransaction" and "NtCreateSection" in the file data of HTTP responses, indicating a payload that might be attempting to leverage TxF for process creation manipulation.
This rule detects potential process hollowing activity by looking for specific strings in HTTP client-to-server traffic. It triggers if the traffic contains both 'CREATE_SUSPENDED' and 'NtUnmapViewOfSection' (case-insensitive). These strings are indicative of a technique where a legitimate process is created in a suspended state, its memory unmapped, and then malicious code is injected and executed.
This rule detects the presence of a TLS Callback Injection payload in HTTP traffic flowing from the server to the client. It specifically looks for the case-insensitive strings "TlsCallback" and "IMAGE_TLS_DIRECTORY" within the file data of the HTTP response. This technique is often used by malware to achieve code injection and execution.
This rule detects attempts to abuse the macOS AuthorizationExecuteWithPrivileges function, which allows an application to execute a command with root privileges. The detection is based on the presence of the string "AuthorizationExecuteWithPrivileges" in HTTP response data, indicating a potential attempt by malware or an attacker to escalate privileges on a macOS system.
This rule detects potential PE injection payloads over HTTP by looking for the presence of both "NtUnmapViewOfSection" and "VirtualAllocEx" in the file data. These API calls are commonly used in process injection techniques, specifically for unmapping legitimate sections of a process and allocating new memory for malicious code.
This rule detects the delivery of a payload designed to bypass macOS Transparency, Consent, and Control (TCC) mechanisms via HTTP. Specifically, it looks for the string "kTCCServiceCamera" within HTTP response data, indicating an attempt to manipulate camera access permissions. This activity is often associated with privilege escalation techniques on macOS.
This rule detects the delivery of a tool designed to bypass User Account Control (UAC) via HTTP. It specifically looks for HTTP responses containing the strings "IsUserAnAdmin" and "ShellExecute" (case-insensitive) within the file data, indicating the presence of code commonly used in UAC bypass techniques.
This rule detects the creation of a new Azure AD user account via the Microsoft Graph API. It specifically looks for HTTP POST requests to 'graph.microsoft.com' with the URI containing '/users'. This activity could indicate an attacker establishing persistence by creating new accounts in a compromised Azure AD environment.
This rule detects attempts to register a new device for MFA bypass persistence by monitoring HTTP POST requests to graph.microsoft.com with a URI containing 'authentication/methods'. This activity could indicate an attacker attempting to register their own device as a trusted device to bypass multi-factor authentication in an Office 365 environment.
This rule detects attempts to update system firmware from an unverified source. It specifically looks for HTTP traffic (flow:to_client,established) where the URI contains the string "firmware" (case-insensitive) and the file data contains the byte sequence "AA 55". This combination suggests a potential firmware update being delivered over HTTP, which could be malicious if the source is not legitimate.
This rule detects the download of Visual Studio Code (VS Code) or other Integrated Development Environment (IDE) extensions from official marketplaces (marketplace.visualstudio.com or open-vsx.org) when the downloaded file has a .vsix or .crx extension. This could indicate an attempt to install a malicious extension.
Page 82 of 116