Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
36 detections
Filters
Last updated
All Time
Detection languages
15
9
5
5
1
Contributors
13
5
3
2
2
Categories
10
9
8
8
5
Platforms
20
8
7
7
5
Products / Services
10
6
5
4
3
MITRE Techniques
18,114
15,633
12,576
8,388
6,215
IDS Classtypes
5
IDS Protocols
5
This rule detects HTML smuggling attempts by identifying the 'msSaveOrOpenBlob' API call within HTTP response bodies. This API is often used by attackers to deliver malicious files directly to a user's browser, bypassing traditional network security controls. The rule specifically looks for the case-insensitive string 'msSaveOrOpenBlob' in the file data of HTTP responses flowing from the server to the client.
This rule detects potential HTML smuggling attempts where a malicious payload is delivered via a Blob URL. It specifically looks for HTTP responses (flow:to_client) that contain both 'URL.createObjectURL' and 'Blob(' (case-insensitive) in the file data. This combination is indicative of JavaScript code creating a Blob object and then generating a URL for it, which can be used to deliver files directly to the client's browser, bypassing traditional network security controls.
Detects LOLBins (cmd.exe, powershell.exe, rundll32.exe, mshta.exe, etc.) spawned
directly by a web browser, indicative of FileFix or ClickFix-style social engineering
execution.
In these attacks, a malicious webpage silently copies a disguised command
to the user's clipboard; the user is then instructed to paste it into the Windows File
Explorer address bar or Run dialog, resulting in LOLBin execution under the browser's
process context.
Observed delivering loaders, RATs, and ransomware precursors in the
wild since July 2025.
Exclusions applied for Chrome Native Messaging IPC, ClickOnce
application launchers, and OAuth2/OIDC SSO token redirect fragments.
directly by a web browser, indicative of FileFix or ClickFix-style social engineering
execution.
In these attacks, a malicious webpage silently copies a disguised command
to the user's clipboard; the user is then instructed to paste it into the Windows File
Explorer address bar or Run dialog, resulting in LOLBin execution under the browser's
process context.
Observed delivering loaders, RATs, and ransomware precursors in the
wild since July 2025.
Exclusions applied for Chrome Native Messaging IPC, ClickOnce
application launchers, and OAuth2/OIDC SSO token redirect fragments.
Identifies file downloads (archives, shortcuts) originating from a legitimate OAuth provider URL that contains error parameters. This pattern is indicative of an attacker abusing OAuth error redirection to deliver a malicious payload.
Identifies file downloads (archives, shortcuts) originating from a legitimate OAuth provider URL that contains error parameters. This pattern is indicative of an attacker abusing OAuth error redirection to deliver a malicious payload.
Detects files associated with the ClipXDaemon malware campaign based on their SHA256 hashes.
Detects when a web browser process creates a high-risk file type (e.g., ISO, ZIP, EXE). This behavior is a strong indicator of HTML smuggling (T1027.006), where a malicious payload is decoded from an HTML file and written to disk by the browser itself to evade network security.
This rule detects the multi-stage delivery of PlugX malware, attributed to Mustang Panda, leveraging HTML smuggling, DLL side-loading, and persistence via registry run keys. The detection chain starts with a browser dropping an MSI file (HTML smuggling), followed by msiexec.exe executing a known sideloading executable (gup.exe or robotaskbaricon.exe). Subsequently, a malicious DLL (libcurl.dll or RoboForm.dll) is side-loaded by the executable from the same path, and finally, persistence is established through a registry run key by the same sideloading executable.
ET ATTACK_RESPONSE HTML Smuggling Powershell Payload In href
ET ATTACK_RESPONSE HTML Smuggling Powershell Payload In iframe
KQL Query from file: Detecting Mamba 2FA phishing-as-a-service
KQL Query
Detects potential malicious JavaScript obfuscated using the JSFireTruck technique, characterized by the repeated use of characters like [], (), !, and +. This rule looks for the presence of multiple distinct characters from the core JSFireTruck set within web response bodies.
Detects potential malicious JavaScript obfuscated using the JSFireTruck technique, specifically looking for the combination of core JSFireTruck characters and checks for document.referrer, often used to target traffic from search engines.
Detects potential malicious JavaScript obfuscated using the JSFireTruck technique, specifically looking for the combination of core JSFireTruck characters and checks for document.referrer, often used to target traffic from search engines.
Page 2 of 2