Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,431 detections
Filters
Last updated
All Time
Detection languages
2,428
3
Contributors
747
554
405
315
183
Categories
1,914
1,291
689
671
449
Platforms
2,202
183
149
62
49
Products / Services
2,366
1,378
38
37
25
MITRE Techniques
537
454
342
308
301
CVEs
17
10
9
9
9
IDS Classtypes
1,098
452
204
154
102
IDS Protocols
2,431
868
408
324
97
This rule detects attempts to load a PowerShell assembly reflectively in memory. It specifically looks for the string "[System.Reflection.Assembly]::Load(" within HTTP response data flowing to a client. This technique is often used by malware to execute malicious code without writing it to disk, making it a common defense evasion tactic.
This rule detects attempts to build a Docker image on a compromised host via the Docker API. It specifically looks for HTTP POST requests to the '/build' endpoint on port 2375, which is the default unsecured Docker API port. This activity could indicate an attacker leveraging a compromised system to build malicious Docker images.
This rule detects HTTP requests where the URI contains "SyncAppvPublishingServer" case-insensitively. This pattern is often associated with script proxy execution, a technique used by attackers to execute malicious scripts by leveraging legitimate system utilities. The rule specifically looks for this string in the URI of established, to-server HTTP flows, indicating potential trojan activity or defense evasion.
This rule detects HTTP requests where the URI contains both 'pubprn' and '.sct' (case-insensitive). This combination is indicative of an attempt to use the 'pubprn.vbs' script for COM scriptlet execution, a technique often employed by attackers for defense evasion.
This rule detects HTTP responses from a server to a client that contain the case-insensitive strings "IT Support", "helpdesk", and "password" within the file data. This combination of keywords suggests a web page designed to impersonate IT support, potentially for phishing or credential harvesting purposes.
This rule detects the string "ComRegisterFunction" within HTTP response bodies (file.data). This string is associated with .NET assembly registration, specifically when tools like Regsvcs or Regasm are used for 'Assembly Proxy Execution'. This technique is often employed by attackers for defense evasion, as it allows them to execute malicious code via legitimate Microsoft utilities.
This rule detects network traffic (specifically HTTP responses) that contains patterns indicative of timing-based anti-debugging techniques. It looks for the presence of "__rdtsc" (Read Time-Stamp Counter) and "ExitProcess" within the file data of an HTTP response, suggesting that a program might be attempting to detect a debugger by measuring execution time and exiting if debugging is detected. This is a common technique used by malware to evade analysis.
This rule detects potential in-memory PE loading without disk write by looking for specific strings in HTTP file data. It specifically searches for the strings "Assembly.Load(" and "Invoke(" (case-insensitive) within the HTTP response body (flow:to_client,established; file.data). This combination of strings is indicative of .NET applications dynamically loading assemblies into memory and then executing methods, which can be a technique used by malware to avoid writing executables to disk.
This rule detects the string "sekurlsa" within the HTTP URI, which is commonly associated with the Mimikatz tool attempting to dump credentials from the Local Security Authority Subsystem Service (LSASS) process. The detection is case-insensitive and targets traffic flowing from the client to the server.
This rule detects attempts to use 'mavinject.exe' for DLL injection into a running process over HTTP. It specifically looks for HTTP requests containing 'mavinject' and '/INJECTRUNNING' in the URI, indicating a potential malicious use of the Mavinject utility for defense evasion.
This rule detects potential credential stuffing attacks by identifying HTTP requests to login pages that use user agents commonly associated with automated tools like 'python-requests', 'Go-http-client', or 'curl'. It triggers if 20 such requests are observed from the same source IP within 30 seconds, indicating a high volume automated attempt.
This rule detects JavaScript code being delivered to a client that attempts to capture form field data, specifically looking for 'document.querySelector', 'password', and 'fetch(' within HTTP response data. This behavior is indicative of an attempt to exfiltrate credentials from a login page.
This rule detects the presence of a web portal login page skimmer script by looking for specific JavaScript keywords within HTTP response data. It specifically searches for the combination of 'addEventListener', 'keydown', and 'XMLHttpRequest' (case-insensitive) in the data flowing from the server to the client. This combination suggests a script designed to capture user input (like keystrokes) and exfiltrate it via XMLHttpRequest, a common technique used by web skimmers to steal credentials.
This rule detects attempts to spoof a Windows login credential dialog box over HTTP. It specifically looks for the string "CredUIPromptForCredentials" (case-insensitive) within the file data of HTTP traffic flowing from the server to the client. This string is associated with the Windows Credential UI API, and its presence in unexpected contexts, especially in HTTP responses, could indicate a phishing attempt or malware trying to trick users into entering credentials.
This rule detects HTTP requests that attempt to access the '.aws/credentials' file, which typically contains AWS access keys and secret keys. This indicates an attempt to discover or exfiltrate sensitive AWS credentials from a web server, potentially exposing cloud resources.
This rule detects HTTP requests to the Docker API endpoint '/containers/*/json' which could indicate an attempt to query container environment secrets. The rule specifically looks for requests to the '/containers/' path followed by '/json' in the HTTP URI.
This rule detects a specific HTTP POST request pattern associated with the Mirai botnet's check-in mechanism. It looks for HTTP POST requests to the '/report' URI with a body size between 21 and 99 bytes. A threshold of 10 such requests from the same source within 60 seconds triggers the alert, indicating potential botnet activity.
This rule detects potential automated social media account creation attempts by monitoring HTTP traffic for requests to common social media platforms (twitter.com, x.com, facebook.com) that include 'signup' in the URI. A threshold of 5 such requests within 60 seconds from the same source IP triggers the alert, indicating a possible automated or high-volume registration process.
This rule detects the download of potential proof-of-concept (PoC) exploit code for CVEs. It specifically looks for HTTP responses containing a URI that matches the pattern 'CVE-YYYY-NNNN' (e.g., CVE-2023-1234) and also contains the word 'exploit' in the file data. This combination suggests that a client on the internal network is downloading code related to a known vulnerability, which could be for research, testing, or malicious purposes.
This rule detects potential vendor relationship page scraping activity. It triggers an alert when a client makes 20 or more HTTP requests containing the word "vendor" (case-insensitive) in the URI within a 30-second window. This behavior could indicate an attacker or automated script attempting to gather information about an organization's vendors, which is a reconnaissance technique.
This rule detects potential GitHub organization repository enumeration by monitoring HTTP traffic to api.github.com with URIs containing '/orgs/'. A threshold of 20 requests within 60 seconds from a single source IP address is used to trigger an alert, indicating a possible network scan or reconnaissance activity targeting GitHub organizations.
Page 93 of 116