Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,431 detections
Filters
Last updated
All Time
Detection languages
2,428
3
Contributors
747
554
405
315
183
Categories
1,914
1,291
689
671
449
Platforms
2,202
183
149
62
49
Products / Services
2,366
1,378
38
37
25
MITRE Techniques
537
454
342
308
301
CVEs
17
10
9
9
9
IDS Classtypes
1,098
452
204
154
102
IDS Protocols
2,431
868
408
324
97
This rule detects HTTP POST requests to cloud compute infrastructure management endpoints, specifically Amazon EC2, Google Cloud Compute, and Azure Management. The rule is triggered if 20 such requests are observed from a single source IP within 60 seconds, indicating potential automated activity to modify cloud infrastructure for evasion purposes.
This rule detects the delivery of a malicious Control Panel (.cpl) file over HTTP. It specifically looks for HTTP responses containing a URI ending with ".cpl" (case-insensitive) and the "MZ" magic bytes at the beginning of the file data, indicating an executable file. This technique is often used for defense evasion and to execute malicious code.
This rule detects HTTP requests where the URI contains specific system script names like 'pubprn', 'syncappvpublishingserver', or 'winrm'. These scripts are known to be abused by attackers to proxy code execution, often as a defense evasion technique. The rule specifically looks for these patterns in HTTP URIs in traffic flowing to the server.
This rule detects attempts to execute commands indirectly via 'bash.exe' on Windows systems, specifically looking for HTTP requests where the URI contains both 'bash.exe' and the '-c' argument, which is commonly used to pass commands to a shell. This behavior is indicative of an attacker using Bash on Windows (e.g., Windows Subsystem for Linux or Git Bash) to execute arbitrary commands, potentially as part of a defense evasion or command and control tactic.
This rule detects attempts to leverage Regsvr32 for COM scriptlet remote execution. It specifically looks for HTTP traffic where the URI contains '.sct' (indicating a scriptlet file) and the file data contains XML content with the word 'registration', which are common characteristics of COM scriptlets used in Regsvr32 attacks.
This rule detects the delivery of a payload that uses InstallUtil for proxy execution. It specifically looks for HTTP traffic (flow:to_client,established) containing the strings "System.Configuration.Install" and "Installer" (case-insensitive) within the file data. This pattern is indicative of malicious use of InstallUtil, a legitimate Microsoft utility, to execute code, often for defense evasion.
This rule detects attempts to inject remote office templates via HTTP. It specifically looks for HTTP traffic flowing to the client that contains both 'attachedTemplate' and 'http' (case-insensitive) in the file data, indicating a potential attempt to load a remote template.
This rule detects HTTP responses containing XSL Transform with embedded JScript payloads. It specifically looks for the presence of 'language="JScript"' and 'WScript.Shell' within the file data of an HTTP response flowing to the client. This combination indicates an attempt to execute JScript code, potentially for malicious purposes, often associated with defense evasion or initial access techniques.
This rule detects a credential stuffing attack characterized by a high volume of HTTP POST requests to a 'login' URI from a single source IP address within a short timeframe. It specifically looks for HTTP traffic where the method is POST and the URI contains 'login' (case-insensitive). A threshold of 100 such attempts within 60 seconds from the same destination IP address triggers the alert.
This rule detects attempts to read the '/etc/shadow' file via a web shell or similar web-based attack. The rule specifically looks for the string '/etc/shadow' within the HTTP URI, indicating an attempt to access this sensitive file through a web request. This is a common technique used by attackers to exfiltrate credentials after gaining initial access to a web server.
This rule detects attempts to harvest credentials from process memory on Linux systems. It specifically looks for HTTP traffic (flow:to_client,established) containing both the string "/proc/self/mem" and "password" (case-insensitive) within the file data. This combination suggests a tool or script is attempting to read memory for credential extraction, often associated with techniques like credential dumping.
This rule detects attempts to dump NTDS.dit via the Volume Shadow Copy technique over HTTP. It specifically looks for HTTP URIs containing both 'vssadmin' and 'ntds.dit' (case-insensitive). This combination suggests an attacker is trying to exfiltrate the NTDS.dit file, which contains Active Directory database information, using the vssadmin utility to create a shadow copy and then access the file.
This rule detects attempts to steal OAuth access tokens by abusing redirect URIs. It specifically looks for HTTP requests containing both 'access_token=' and 'redirect_uri=' in the URI, which could indicate an attacker trying to capture a legitimate access token by redirecting it to a controlled URI.
This rule detects attempts to gain credential access through web application exploits, specifically looking for HTTP URI requests that contain both 'UNION SELECT' (indicative of SQL injection) and 'password' (suggesting an attempt to extract credential-related information). The detection is case-insensitive.
This rule detects attempts to access secrets stored in Azure Key Vault via its API. It specifically looks for HTTP traffic where the host matches the Azure Key Vault domain pattern '*.vault.azure.net' and the URI contains '/secrets/'. This indicates a potential attempt to retrieve sensitive information.
This rule detects attempts to exfiltrate browser password databases over HTTP. It specifically looks for HTTP POST requests containing the string "Login Data" in the client body, which is a common indicator of browser credential theft.
This rule detects the delivery of a macOS Keychain Access tool via HTTP. It specifically looks for the string "SecKeychainFindInternetPassword" within the file data of HTTP traffic flowing from the server to the client. This string is indicative of an application attempting to access or manipulate macOS Keychain passwords, suggesting the presence of malware or a malicious utility designed to extract credentials.
This rule detects the exfiltration of a password store database over HTTP POST. It specifically looks for HTTP POST requests where the URI or content contains the string "passwords" (case-insensitive) and the data size is greater than 1000 bytes. This combination suggests a large file, potentially a database, containing passwords being sent out of the network.
This rule detects automated multi-factor authentication (MFA) push bombing attempts targeting Duo Security's API. It specifically looks for HTTP POST requests to 'api.duosecurity.com' and triggers an alert if 10 such requests are observed from the same source IP within a 30-second window. This behavior is indicative of an attacker repeatedly sending MFA push notifications to a user's device in an attempt to overwhelm them or trick them into approving a fraudulent login.
This rule detects a potential MFA fatigue attack by monitoring repeated HTTP requests to known MFA provider domains (duo.com, okta.com, microsoft.com) containing the string "auth" in the URI. A threshold of 20 requests within 60 seconds from the same destination IP address triggers the alert, indicating an attacker might be repeatedly sending push notifications to a user's device to overwhelm them into accepting an authentication request.
This rule detects network traffic indicative of AnyDesk remote desktop software being used as a command and control (C2) channel. It specifically looks for HTTP requests to 'anydesk.com' or 'relay.anydesk.com' domains. A threshold of 5 connections within 60 seconds from the same source IP is set to reduce false positives.
Page 87 of 116