Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
189 detections
Filters
Last updated
All Time
Detection languages
82
65
21
5
5
Contributors
32
28
21
20
10
Categories
62
58
53
43
38
Platforms
104
68
17
13
9
Products / Services
80
47
41
16
8
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
CVEs
2
IDS Classtypes
43
27
4
4
1
IDS Protocols
55
13
12
This rule monitors network logs (from proxies and firewalls) for web traffic (HTTP GET requests) containing suspicious JavaScript code injection patterns in the request context or message fields. It specifically looks for common XSS indicators such as <script tags, eval(), document.write(), fromCharCode(), and atob().
Detects the creation or download of 'injection-obf.js', an obfuscated JavaScript payload associated with VVS Stealer for Discord injection. The rule captures details like source URL, referrer, and responsible process to aid in containment and scoping.
Detects the creation of potentially malicious archive files (.zip, .iso, .img, .cab) in the Downloads folder, initiated by web browsers (Chrome, Edge, Firefox), where the initiating process's command line indicates a local file access (file:///), suggesting a Blob-to-Disk dropper technique often associated with AI-obfuscated phishing campaigns.
Detects network requests to the BadBlocker (AdBlock for YouTube) infrastructure that fetch malicious scriptlet rules. These rules are designed to leverage Chrome's scripting API to execute arbitrary JavaScript in the 'MAIN' world of web pages, effectively bypassing Content Security Policy (CSP) protections to inject unauthorized content.
Detects network connections to a specific Google Drive document ID known to be associated with the 'Steam Wallpaper' attack for payload distribution.
Identifies network attempts to communicate with the vulnerable AutoGen Studio MCP WebSocket endpoint using the exploited server_params parameter, indicating potential exploitation of the AutoJack vulnerability.
Detects drive-by download via malicious advertisement networks
SniperDz VAPID Key Activity
Cortex XDR
Detects web requests or command line activity containing the specific VAPID public key associated with the SniperDz push-notification infrastructure. This key is known to be used by the SniperDz PhaaS (Phishing-as-a-Service) ecosystem.
Detects hidden iframes used for drive-by download attacks
This rule detects a suspicious chain of events starting from a web browser (Chrome, Edge, or Firefox) initiating a process like PowerShell, Cmd, Msiexec, or Rundll32. The detection is further narrowed down by looking for specific command-line arguments related to downloads or temporary directories, and crucially, by identifying that the executed payload is unsigned or has an untrusted signature. This pattern is indicative of malvertising leading to the execution of potentially malicious, unsigned software.
Detects access to underground exploit kit purchase or sales platforms
This rule detects the delivery of potentially malicious Flash (.swf) or Java (.jar, .class) files over HTTP. It specifically looks for HTTP responses where the URI ends with one of these extensions and the file data begins with 'MZ', which is the magic number for Windows executable files. This combination suggests an attempt to disguise an executable as a Flash or Java file, likely for exploit delivery.
This rule detects potential browser exploit delivery via heap spray techniques. It specifically looks for a sequence of 12 NOP (No Operation) instructions (0x90) in HTTP response data flowing to a client. This pattern is commonly used in heap spray attacks to prepare memory for shellcode execution.
This rule detects drive-by malicious iframe injection by looking for HTTP responses (flow:to_client) that contain an iframe tag, the 'display:none' style attribute, and a 'src=' attribute. This combination is often used by attackers to embed malicious content invisibly into legitimate websites, leading to drive-by downloads or other client-side attacks.
This rule detects HTTP responses containing JavaScript that attempts to redirect the user's browser to another page and executes code using 'eval()'. This combination is often used in malicious web pages to redirect users to exploit kits or phishing sites, and to obfuscate malicious JavaScript.
Detects when a web browser (Chrome, Edge, Firefox, Brave, Opera) initiates a process that is not another instance of itself. This could indicate a drive-by download, execution of malicious code, or other suspicious activity originating from a browser.
Detects execution or download activity tied to Nimbus Manticore (UNC1549) SEO
poisoning campaign delivering trojanized Oracle SQL Developer from getsqldeveloper.com and
related fake Zoom/career portal lures documented alongside Screening Serpens activity.
poisoning campaign delivering trojanized Oracle SQL Developer from getsqldeveloper.com and
related fake Zoom/career portal lures documented alongside Screening Serpens activity.
This rule detects a potential watering hole attack where a legitimate website has been injected with a script that attempts to load content from an IP address. Specifically, it looks for HTTP responses (flow:to_client) containing '<script src=' followed by a URL where the source is an IP address (e.g., 'src="http://1.2.3.4/script.js"'). This technique is often used by attackers to compromise visitors of a trusted site by redirecting them to malicious content or exploiting vulnerabilities.
This rule detects potential drive-by exploit kit landing pages by inspecting HTTP response data for the presence of both "exploit" and "shellcode" (case-insensitive). It specifically looks for these keywords in the data flowing from the server to the client over an established HTTP connection. The rule is categorized as an exploit-kit detection and is associated with MITRE ATT&CK technique T1189 (Drive-by Compromise) and tactic Initial Access.
Detects the execution of common browser executables in headless mode with command-line arguments indicative of data exfiltration, malicious rendering (dump-dom), or external requests (http/data:text/html;base64,). This activity, especially when initiated by non-standard parent processes, can be a sign of automated web scraping, vulnerability scanning, or other malicious automated browser activity.
Detects a flashplayer update from an unofficial location
Page 5 of 9