Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
18,128 detections
Filters
Last updated
All Time
Detection languages
6,549
6,208
1,473
1,005
661
Contributors
3,555
2,652
2,153
2,087
1,515
Categories
7,572
3,901
1,465
1,393
1,330
Platforms
13,733
1,392
1,319
824
738
Products / Services
3,828
3,137
2,448
912
908
MITRE Techniques
18,128
15,653
12,600
8,411
6,235
CVEs
19
18
17
16
14
IDS Classtypes
305
51
24
23
22
IDS Protocols
308
136
13
10
10
This rule detects HTTP responses from a server to a client that contain specific strings ('ComputerName', 'UserName', and 'MZ') within the file data. The presence of 'MZ' at the beginning (depth:2) suggests an executable file. The combination of these strings indicates a potential 'guardrail' payload checking the environment (computer name and user name) before executing, which is a common technique used by malware to evade analysis environments or target specific systems. The rule is designed to identify trojan activity related to defense evasion.
This rule detects character substitution obfuscation in web requests, specifically looking for three or more consecutive occurrences of URL-encoded characters that represent common path or null byte characters (e.g., '%5C' for '\', '%2F' for '/', '%00' for null, '%0A' for newline, '%0D' for carriage return). This pattern is often used by attackers to bypass security filters or to obscure malicious payloads in HTTP URIs.
This rule detects the installation of a root certificate via an HTTP response. It specifically looks for HTTP traffic flowing from the server to the client (to_client, established) where the URI contains ".cer" (case-insensitive) and the file data contains the string "-----BEGIN CERTIFICATE-----". This combination suggests a certificate file being delivered over HTTP, which could be indicative of a malicious root certificate installation attempt, often used in man-in-the-middle attacks or to establish persistence for malware.
This rule detects the use of SVG files for HTML smuggling payloads. Specifically, it looks for HTTP responses containing an SVG file ('.svg' in the URI) that also contain '<script' and 'Blob(' within its data. This combination is indicative of an HTML smuggling technique where malicious content is hidden within a seemingly innocuous SVG file and then processed by JavaScript to construct a malicious payload, often a file download.
This rule detects potential malware payloads encrypted with RC4. It specifically looks for HTTP responses (flow:to_client,established) containing the string "RC4" (case-insensitive) and a long base64-like string (at least 100 characters, optionally ending with padding) within the file data. This combination suggests an RC4-encrypted payload being delivered to a client.
This rule detects network traffic (TCP on port 445, typically SMB) containing the strings 'CodeIntegrity' and 'Disabled' (case-insensitive). This pattern suggests an attempt to disable code signing policies, potentially via a registry modification, which is a common defense evasion technique used by malware.
This rule detects network traffic on port 445 (SMB) containing the strings "Network Providers" and "ProviderPath" (case-insensitive). This pattern is indicative of an attempt to register a malicious Network Provider DLL for credential capture, a technique used by adversaries to persist and steal credentials.
This rule detects network traffic containing the string "/etc/pam.d/" over TCP port 22 (SSH). This could indicate an attempt to modify Pluggable Authentication Modules (PAM) configuration files, potentially for authentication bypass or persistence on a Linux system. The detection is focused on traffic originating from the home network to the home network, suggesting internal activity or a compromised host communicating within the network.
This rule detects when a bootloader file is delivered via HTTP. It specifically looks for HTTP responses (flow:to_client) where the URI contains keywords like 'bootloader', 'grub', 'bootmgr', or 'mbr' (case-insensitive) and the file data contains the magic bytes '|55 AA|', which often indicate the end of a boot sector or a master boot record.
This rule detects HTTP requests that contain 'schtasks' and '/create' in the URI, indicating an attempt to create a scheduled task. This activity is often associated with adversaries establishing persistence or executing commands on a compromised system, potentially breaking the process tree for forensic analysis. The rule specifically looks for these keywords in a case-insensitive manner within the HTTP URI.
This rule detects attempts to masquerade an executable file as a PDF document during an HTTP download. It specifically looks for HTTP responses where the 'Content-Type' header is set to 'application/pdf', but the actual file data begins with the 'MZ' magic bytes, indicating it is a Windows executable.
This rule detects attempts to flush auditd rules by looking for the command 'auditctl -D' within TCP traffic on port 22 (SSH). This action is often performed by attackers to remove monitoring and evade detection after gaining access to a system.
This rule detects when Azure Monitor Diagnostic Settings are deleted. It specifically looks for HTTP DELETE requests to 'management.azure.com' with 'diagnosticSettings' in the URI. This activity could indicate an attacker attempting to evade detection by removing logging configurations.
This rule detects network traffic containing the string "signal(SIGTERM, SIG_IGN)" case-insensitively, indicating a process attempting to ignore the SIGTERM signal. This behavior can be used by malware or adversaries to achieve persistence on Linux systems by making a process harder to terminate gracefully.
This rule detects attempts to clear Windows network connection history remotely over SMB (port 445). It specifically looks for traffic containing the strings "NetworkList" and "delete" (case-insensitive) within TCP sessions directed to the HOME_NET on port 445. This activity could indicate an attacker attempting to remove forensic evidence of their network presence.
This rule detects attempts to spoof process arguments to evade detection by looking for specific strings in HTTP traffic. It specifically looks for the strings "NtQueryInformationProcess" and "ProcessCommandLineInformation" (case-insensitive) in file data within established HTTP client-to-server flows. This behavior is often associated with malware or advanced persistent threats trying to hide their true command-line arguments from security tools.
This rule detects the delivery of a VBA stomped Office document via HTTP. It looks for specific content within the HTTP response body, indicating a Microsoft Office document that has been manipulated to hide malicious VBA macros. The rule specifically checks for the presence of "[Content_Types].xml", "vbaProject", and "PerformanceCache" within the file data, which are characteristic of Office documents containing VBA macros, with "PerformanceCache" being a potential indicator of VBA stomping.
This rule detects attempts to clear system log files, specifically '/var/log/', via a remote SSH connection. It looks for the string "> /var/log/" within TCP traffic on port 22 (SSH) flowing from a client to a server, ignoring case. This activity is often associated with an attacker trying to cover their tracks by removing evidence of their presence.
This rule detects the use of the JamPlus build tool for potentially malicious execution. It specifically looks for HTTP traffic where the URI contains 'jamplus' or 'jam.exe' and the file data starts with 'MZ', indicating an executable file download. This combination suggests an attempt to deliver or execute a malicious JamPlus-compiled executable.
This rule detects the delivery of a Compiled HTML Help (CHM) file via HTTP that contains the string "ITSF" within its file data. CHM files can be used to deliver malicious content, and the presence of "ITSF" (likely indicating an InfoTech Storage Format header) combined with HTTP delivery suggests a potential attempt to bypass security controls or execute malicious code. This is often associated with T1218.001 (Signed Binary Proxy Execution: Compiled HTML Help) from the MITRE ATT&CK framework.
This rule detects HTTP requests containing 'verclsid' and '/S' in the URI, which is indicative of the Verclsid COM Object Proxy Execution technique (T1218.012). This technique is often used by attackers for defense evasion by executing arbitrary commands or binaries through a COM object.
Page 447 of 864