Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
31 detections
Filters
Last updated
All Time
Detection languages
17
4
4
3
1
Contributors
15
4
3
2
2
Categories
20
12
8
7
7
Platforms
16
13
2
2
1
Products / Services
13
8
7
6
6
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
IDS Classtypes
2
1
IDS Protocols
3
This rule detects HTTP responses that originate from search engines (Google, Bing, Yahoo) and contain a Windows executable (MZ header) in the file data. This behavior is indicative of SEO poisoning, where malicious actors manipulate search engine results to redirect users to malware downloads.
This rule detects HTTP responses that contain hidden keywords, a technique often used in SEO poisoning. It specifically looks for HTML content with 'display:none' and 'font-size:0' which are common methods to hide text from users while still being parsed by search engine crawlers.
Detects executable files with names containing PDF-related keywords (e.g., 'pdf', 'convert', 'editor') being dropped in the Downloads folder by a web browser process. This behavior is typical of users downloading potentially unwanted or malicious PDF converters, often delivered via SEO poisoning or malvertising campaigns.
This detection rule identifies potential SEO poisoning activity associated with the Operation Rewrite campaign. It looks for a high volume of web requests from a single source IP where the HTTP referrer indicates the traffic originated from a search engine. This pattern can indicate a compromised host being used for malicious purposes or a user interacting with multiple poisoned search results.
Detects files containing Command and Control (C2) domains and IP addresses associated with the 'Operation Rewrite' SEO poisoning campaign (CL-UNK-1037). These indicators are often found embedded in BadIIS malware variants or related configuration files.
Detects the managed .NET IIS module variant of BadIIS, used in the 'Operation Rewrite' campaign for SEO poisoning and traffic redirection.
Detects BadIIS malware variants associated with the 'Operation Rewrite' campaign (CL-UNK-1037). This rule identifies the native IIS module, PHP backdoors, and other related components used for SEO poisoning.
Detects the ASP.NET page handler (webshell) used in the 'Operation Rewrite' campaign for SEO poisoning and traffic redirection.
KQL Query
This query helps hunting for Inbox rule changes which forward-redirect email
Page 2 of 2