Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5 detections
Filters
Last updated
All Time
Detection languages
1
1
1
1
1
Contributors
2
1
1
1
Categories
2
2
2
2
1
Platforms
3
1
1
Products / Services
1
1
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
IDS Classtypes
1
IDS Protocols
1
This rule detects the download of executable files (EXE, DLL, BIN) over HTTP that appear to be stripped of their standard headers. It specifically looks for the 'MZ' magic bytes at the beginning of the file data, indicating a Windows executable, but then implies a lack of full header structure by the 'Stripped Executable Payload Without Headers' message. The rule also requires the file size to be greater than 10000 bytes.
Detects stripped executable payloads with debug information removed for evasion
Detects the execution of AppleScript with the presence of 'character id' in loops. This pattern is often used by malware to hide malicious AppleScript code.
This rule detects an AMOS-style macOS AppleScript loader. It identifies a combination of execution chain strings. The rule requires a specific number of these elements to be present, along with a magic byte check or the string 'osascript -e'.
This rule detects the execution of 'osacompile' with the '-x' and '-e' flags, which indicates the compilation of a run-only AppleScript. Run-only AppleScripts are compiled scripts that cannot be easily decompiled or inspected, making them a potential method for adversaries to obfuscate malicious code and evade analysis. The '-x' flag compiles the script as execute-only, and '-e' specifies the script source.
