Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,431 detections
Filters
Last updated
All Time
Detection languages
2,428
3
Contributors
747
554
405
315
183
Categories
1,914
1,291
689
671
449
Platforms
2,202
183
149
62
49
Products / Services
2,366
1,378
38
37
25
MITRE Techniques
537
454
342
308
301
CVEs
17
10
9
9
9
IDS Classtypes
1,098
452
204
154
102
IDS Protocols
2,431
868
408
324
97
This rule detects network traffic (specifically HTTP responses) that contains strings indicative of malware attempting to detect the presence of a hypervisor. It looks for the string "GetSystemFirmwareTable" and "VBOX" (case-insensitive) within the file data of the HTTP response. This combination suggests a malware payload checking if it's running in a virtualized environment, specifically VirtualBox, which is a common anti-analysis technique.
This rule detects attempts to enumerate device drivers on a system via a web shell. It specifically looks for HTTP requests containing the string "driverquery" in the URI, which is a command-line utility on Windows systems used to display a list of installed device drivers and their properties. The detection is case-insensitive and targets established HTTP connections to the server.
This rule detects attempts to enumerate AWS S3 object lists, which could indicate data discovery activities. It specifically looks for HTTP requests to s3.amazonaws.com or .s3-website domains containing the string 'list' in the URI, with a threshold of 10 occurrences within 30 seconds from the same source.
This rule detects attempts to query system language and locale information via a web shell. It specifically looks for HTTP requests where the URI contains the case-insensitive string "systeminfo". This activity is indicative of an attacker using a web shell to gather reconnaissance about the compromised system's configuration.
This rule detects attempts to query system geographic location information by monitoring HTTP requests to known IP lookup services such as ip-api.com, ipinfo.io, and freegeoip. The rule triggers an alert if five or more such requests are observed from the same source within a 30-second window, indicating potential reconnaissance or network scanning activity.
This rule detects attempts to enumerate Kubernetes namespaces by looking for HTTP requests to the '/api/v1/namespaces' endpoint on port 8080. This activity could indicate an attacker attempting to discover available namespaces within a Kubernetes cluster.
This rule detects potential HTML smuggling attempts where a malicious payload is delivered via a Blob URL. It specifically looks for HTTP responses (flow:to_client) that contain both 'URL.createObjectURL' and 'Blob(' (case-insensitive) in the file data. This combination is indicative of JavaScript code creating a Blob object and then generating a URL for it, which can be used to deliver files directly to the client's browser, bypassing traditional network security controls.
This rule detects the delivery of a stripped binary, specifically an executable (indicated by 'MZ' header) that has been packed or compressed using UPX (indicated by 'UPX' string). The rule triggers on HTTP traffic flowing to the client, suggesting a download or delivery of such a file. The 'Stripped Binary Delivered with Debug Info Removed' message implies an attempt to evade detection or analysis by removing debugging information, often associated with malware or unwanted applications.
This rule detects HTTP traffic where the host header contains specific cloud region identifiers that are considered rarely used. The rule is triggered if 10 such events occur within 60 seconds from the same source IP address. The identified regions are 'ap-east-1', 'me-south-1', 'af-south-1', and 'eu-south-1'. This could indicate an attempt to evade detection by using less common cloud infrastructure or an unauthorized API call from an unusual geographic location.
This rule detects the delivery of a kernel rootkit module, specifically a Linux Kernel Module (LKM) or a Windows system file, over HTTP. It looks for HTTP responses where the URI ends with '.ko' (Kernel Object for Linux) or '.sys' (system file for Windows) and the file data contains the 'ELF' magic bytes, indicating an Executable and Linkable Format file, which is common for Linux executables and modules. This combination suggests an attempt to deliver a malicious kernel module.
This rule detects HTTP C2 traffic attempting to store a fileless payload in the Windows Registry. It specifically looks for HTTP responses (flow:to_client) containing the strings 'HKCU' (likely indicating a registry key path), 'powershell', and 'IEX' (Invoke-Expression), which are common indicators of PowerShell-based fileless malware using the registry for persistence or execution.
This rule detects the potential use of a stolen web session cookie from a new location. It specifically looks for HTTP traffic containing common session-related keywords like 'session', 'auth', or 'token' within the HTTP cookie header. A threshold of 10 occurrences within 5 seconds, tracked by destination IP, is used to trigger the alert, indicating a potential high-frequency attempt to use a session cookie.
This rule detects network traffic, specifically HTTP responses (flow:to_client), that contain the strings "GetProcAddress" and "LoadLibraryA" (case-insensitive). These strings are commonly associated with dynamic API resolution techniques used by malware to load functions at runtime, often to evade static analysis. The rule is classified as detecting trojan activity.
This rule detects the presence of a Right-to-Left Override (RLO) character (Unicode E2 80 AE) in HTTP response content, specifically within file data. This character can be used in filenames to visually reverse the order of characters, making a file appear to have a different extension or name than it actually does, a common technique for defense evasion and tricking users into executing malicious files.
This rule detects attempts to delete a cloud security group rule via the AWS EC2 API. Specifically, it looks for HTTP traffic to 'ec2.amazonaws.com' with the URI containing 'RevokeSecurityGroupIngress', which is the API call used to remove an inbound rule from a security group.
This rule detects attempts to disable Windows Defender via a registry modification, specifically looking for the string "DisableAntiSpyware" in HTTP client body traffic. This activity is often associated with malware or adversary actions to evade defense mechanisms.
This rule detects a TLS downgrade attack where a client attempts to establish a connection using a weaker TLS protocol version, specifically TLS 1.0. This could indicate an attacker forcing a less secure communication channel to exploit vulnerabilities in older TLS versions.
This rule detects HTTP traffic indicating an Amazon EC2 instance is being reverted to a snapshot. Specifically, it looks for HTTP requests to 'ec2.amazonaws.com' with the URI containing 'RestoreSnapshotTier'. This activity could be part of a cleanup process or an attempt to restore a compromised instance to a known good state, but could also be used by an attacker for defense evasion by reverting changes.
This rule detects attempts to create new cloud instances, specifically targeting AWS EC2, by monitoring HTTP traffic for requests to 'ec2.amazonaws.com' with the 'RunInstances' URI. The rule is designed to identify suspicious activity related to the provisioning of new virtual machines in a cloud environment, potentially indicating unauthorized resource creation or evasion tactics.
This rule detects the presence of an MSBuild inline task payload within HTTP traffic. It specifically looks for the combination of the strings "<UsingTask", "TaskFactory", and "Code" (case-insensitive) within the file data of an HTTP response. This pattern is indicative of an MSBuild inline task, which can be used by attackers for proxy execution, often as a defense evasion technique.
This rule detects HTTP requests where the URI contains common developer utility executables (msbuild, csc, vbc, jsc) being used as a proxy for code execution. This behavior is often associated with defense evasion techniques where legitimate tools are leveraged for malicious purposes.
Page 92 of 116