Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,431 detections
Filters
Last updated
All Time
Detection languages
2,428
3
Contributors
747
554
405
315
183
Categories
1,914
1,291
689
671
449
Platforms
2,202
183
149
62
49
Products / Services
2,366
1,378
38
37
25
MITRE Techniques
537
454
342
308
301
CVEs
17
10
9
9
9
IDS Classtypes
1,098
452
204
154
102
IDS Protocols
2,431
868
408
324
97
This rule detects a PowerShell Empire C2 beacon pattern over HTTP. Specifically, it looks for HTTP POST requests to '/index.jsp' where the client body contains a base64-like encoded string of at least 200 characters, indicated by the PCRE pattern. This pattern is characteristic of how PowerShell Empire agents communicate with their command and control server.
This rule detects default beacon check-ins from Cobalt Strike. It specifically looks for HTTP POST requests to the URI '/submit.php' with a User-Agent string matching the pattern 'Mozilla/5.0 (compatible; MSIE [0-9]/'. This combination of indicators is characteristic of the default configuration of Cobalt Strike's beacon communication.
This rule detects attempts to exploit a Local File Inclusion (LFI) vulnerability to read the Windows Security Account Manager (SAM) database. It specifically looks for HTTP requests containing the string "\windows\system32\config\sam" in the URI, which is a common path for the SAM file on Windows systems. Successful exploitation of such a vulnerability could lead to the disclosure of hashed user credentials.
Detects unusually large HTTP POST requests which may indicate data exfiltration activity over web protocols. The rule specifically looks for HTTP POST methods and is designed for Suricata, a network intrusion detection system.
This rule detects HTTP requests made to the Shodan API (api.shodan.io). This activity is often associated with reconnaissance, where an attacker or security researcher uses Shodan to gather information about internet-connected devices and services. The rule specifically looks for the 'api.shodan.io' string within the HTTP host header, indicating an attempt to query the Shodan service.
This rule detects attempts to upload a web shell, specifically targeting PHP files, by looking for HTTP POST requests to a .php URI that contain the string "eval(" in the file data. This combination suggests an attacker is trying to upload or execute malicious PHP code, often used for persistence or further compromise.
This rule detects the delivery of a malicious document exploiting CVE-2021-40444, an MSHTML remote code execution vulnerability. It specifically looks for HTTP traffic containing a Word document (word/document.xml) with embedded relationships that include an HTTP reference, indicating an attempt to fetch remote content, which is characteristic of the exploit delivery mechanism.
This rule detects HTTP web requests where the URI contains the string "/bin/sh" (case-insensitive). This pattern is often indicative of an attempt to execute a Unix shell command via a web application, which could be part of a command injection attack (ATT&CK T1059.004).
This rule detects HTTP requests where the URI contains the string "/var/log/" (case-insensitive). This pattern is indicative of an attempt to access system log files directly via a web server, which could be part of an information gathering or defense evasion tactic.
This rule detects HTTP requests where the User-Agent header appears to be faked or malformed. Specifically, it looks for a User-Agent string that starts with 'Mozilla/5.0' followed by an opening parenthesis, and then contains at least 200 characters before a closing parenthesis. This pattern is often used by malicious actors to evade detection by making their User-Agent string unusually long and potentially obfuscated, while still mimicking a common browser prefix.
This rule detects potential keylogger data exfiltration over HTTP POST requests. It specifically looks for HTTP POST requests with a URI containing "keys" (case-insensitive) and a data size greater than 500 bytes. This combination suggests a large amount of data, possibly keystrokes, being sent to a server.
This rule detects potential data exfiltration to Google Drive by monitoring HTTP POST requests to 'www.googleapis.com' with a data size greater than 5000 bytes. This pattern is indicative of large data uploads to Google's API services, which could be used for exfiltration.
This rule detects HTTP PUT requests to a web server where the URI path ends with common web file extensions such as .html, .htm, .php, .asp, or .aspx. This behavior is suspicious as it could indicate an attempt at web defacement (T1491) by an attacker trying to modify web content directly on the server.
This rule detects a 'ListPlanting Injection' attack via the SendMessage API payload within HTTP traffic. It specifically looks for the strings 'LVM_SORTITEMS' and 'SendMessage' (case-insensitive) in the file data of an HTTP response flowing to the client. This type of injection is often associated with shellcode or code injection techniques.
This rule detects the delivery of a Linux VDSO (Virtual Dynamic Shared Object) hijack tool via HTTP. It specifically looks for HTTP traffic to a client containing the strings "[vdso]" and "mprotect" (case-insensitive) within the file data. This combination of strings suggests the presence of code designed to manipulate the VDSO, a technique often used for privilege escalation or evasion on Linux systems.
This rule detects potential DLL injection attempts over HTTP by looking for the presence of both 'LoadLibraryA' and 'VirtualAllocEx' within the file data of an HTTP response. These functions are commonly used in conjunction during DLL injection techniques, where 'VirtualAllocEx' allocates memory in a remote process and 'LoadLibraryA' loads a DLL into that allocated memory. The 'flow:to_client,established' indicates that the detection is looking for these patterns in data flowing from the server to the client over an established HTTP connection.
This rule detects potential process injection shellcode payloads within HTTP responses. It specifically looks for the presence of the strings "OpenProcess" and "CreateRemoteThread" (case-insensitive) in the file data of HTTP responses flowing from the server to the client. These API calls are commonly used in process injection techniques to gain control over another process and execute malicious code.
This rule detects attempts to bypass Windows User Account Control (UAC) elevation prompts by leveraging specific COM objects. It looks for HTTP traffic containing the strings "ICMLuaUtil" and "ShellExec" (case-insensitive) in the file data, which are indicative of this technique. This method is often used by malware to gain elevated privileges without user interaction.
This rule detects HTTP network connections to TeamViewer domains, specifically 'teamviewer.com' or 'router.teamviewer.com'. It triggers an alert if five such connections are observed from the same source IP within a 60-second window. This behavior is indicative of TeamViewer being used for persistent command and control (C2) activities, often associated with trojan activity.
This rule detects attempts to retrieve C2 configuration from Pastebin, specifically looking for HTTP requests to 'pastebin.com' that include '/raw/' in the URI. It uses a threshold of 5 occurrences within 300 seconds from the same source to reduce false positives.
This rule detects when a global administrator role is assigned in Azure via the Graph API. It specifically looks for HTTP POST requests to 'graph.microsoft.com' with 'assignLicense' in the URI.
Page 95 of 116