Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
18,128 detections
Filters
Last updated
All Time
Detection languages
6,549
6,208
1,473
1,005
661
Contributors
3,555
2,652
2,153
2,087
1,515
Categories
7,572
3,901
1,465
1,393
1,330
Platforms
13,733
1,392
1,319
824
738
Products / Services
3,828
3,137
2,448
912
908
MITRE Techniques
18,128
15,651
12,599
8,410
6,235
CVEs
19
18
17
16
14
IDS Classtypes
305
51
24
23
22
IDS Protocols
308
136
13
10
10
This rule detects suspicious background downloads initiated via BITS (Background Intelligent Transfer Service) where the HTTP User-Agent contains "Microsoft BITS" and the requested URI ends with common executable or script file extensions (.exe, .dll, .ps1, .bat). This behavior can indicate an adversary using BITS for ingress tool transfer or to download malicious payloads.
This rule detects HTTP downloads where a file is disguised as a PDF but is actually an executable. It specifically looks for the 'MZ' magic bytes (indicating a Windows executable) within the first two bytes of the file data, combined with a '.pdf' extension in the HTTP URI. This is a common technique used by attackers to bypass security filters and trick users into executing malicious code.
Obfuscated VBScript Download
Suricata
This rule detects the download of potentially obfuscated VBScript files over HTTP. It specifically looks for the string 'Chr(' repeated multiple times within the first 200 bytes of the file data, which is a common obfuscation technique used in malicious VBScripts to hide their true content.
This rule detects TFTP (Trivial File Transfer Protocol) requests for bootloader files. Specifically, it looks for UDP traffic on port 69 (the standard TFTP port) where the packet content starts with the byte sequence "00 01". This pattern is characteristic of a TFTP read request for a file, often used in network booting scenarios to retrieve bootloader files. The rule flags this activity as a "Possible Pre-OS Persistence" mechanism, suggesting an adversary might be attempting to establish persistence before the operating system fully loads, potentially through techniques like bootkits or modifying boot records.
This rule detects the delivery of a payload that attempts to perform process hollowing using the Runpe technique. It specifically looks for the presence of the Windows API functions 'ZwUnmapViewOfSection' and 'WriteProcessMemory' within HTTP file data being sent to a client. These functions are commonly used in process hollowing to unmap a legitimate process's memory and write malicious code into it.
This rule detects the delivery of a payload containing the string "/proc/self/mem" over HTTP to a client. This string is often associated with process memory write injection techniques, particularly on Linux systems, where an attacker might attempt to write malicious code directly into a process's memory space by interacting with the /proc/self/mem pseudo-file. The rule specifically looks for this content within the file data of an HTTP response flowing to the client.
This rule detects potential APC (Asynchronous Procedure Call) injection attempts over HTTP by looking for the presence of both 'QueueUserAPC' and 'OpenThread' functions in the HTTP response body (flow:to_client). This combination of functions is indicative of a payload delivery mechanism often used in APC injection techniques, which can lead to privilege escalation or arbitrary code execution.
This rule detects the download of tools or files that contain 'uac' and 'bypass' in their HTTP URI. This is indicative of an attempt to download a User Account Control (UAC) bypass tool, which adversaries might use for privilege escalation on Windows systems.
This rule detects potential lateral movement activity by identifying a single user account attempting to log on to five or more distinct computers with at least ten logon attempts within a five-minute window. It specifically looks for successful logons (EventID 4624) with network, remote interactive, or remote desktop logon types (LogonType 3, 9, 10) and excludes machine accounts (TargetUserName not ending with '$'). This pattern can indicate an adversary attempting to spread across the network using compromised credentials.
This rule detects unusual logon activity for service accounts. It identifies service accounts by looking for a dollar sign ($) at the end of the username. The rule then counts logons, unique IP addresses, and unique computers for these service accounts within one-hour bins. An alert is triggered if a service account has 10 or more logons or logs in from 5 or more unique IP addresses within that hour, indicating potential abuse or compromise.
This rule detects potential abuse of Group Policy Objects (GPOs) by identifying multiple changes (3 or more) to GPO-related objects within a short timeframe. It specifically looks for Event ID 5136 (Directory Service Changes) where the ObjectClass is either 'groupPolicyContainer' or 'gPCFileSysPath'. This could indicate an adversary modifying GPOs to achieve persistence, privilege escalation, or other malicious objectives.
Detects launching shells with history disabled via environment variables (separate from deleting history files),
consistent with impairing command history logging (Defense Evasion).
consistent with impairing command history logging (Defense Evasion).
Detects the presence of specific string artifacts related to the TEASOUP JavaScript obfuscator within script blocks. TEASOUP is heavily used by the Russia-nexus threat group GREYVIBE to obfuscate initial access payloads in PhantomMail campaigns.
Suspicious MSHTA Fake Auth URL
Cortex XDR
Detects mshta.exe executing a remote URL that contains an '@' symbol, a technique used by Gamaredon (GammaPhish) to fake authentication and bypass naive URL filtering.
This rule detects C2 beaconing activity originating from a potentially injected process. It specifically looks for HTTP traffic where the User-Agent header matches a common Windows Mozilla/5.0 pattern, indicating a Windows client, and the data size is between 1 and 199 bytes. A threshold of 20 such events within 60 seconds from the same source IP triggers the alert, suggesting a beaconing behavior.
This rule detects the delivery of a process injection toolkit over HTTP by looking for the presence of specific Windows API function names, 'VirtualAllocEx' and 'WriteProcessMemory', within the HTTP response body. These functions are commonly used in process injection techniques to allocate memory in a remote process and write malicious code into it.
This rule detects attempts to modify the macOS Transparency, Consent, and Control (TCC) database over an SSH connection. The TCC database stores user privacy settings, and its modification can indicate an attempt to bypass security controls or escalate privileges. The rule specifically looks for the string "TCC.db" within TCP traffic directed to port 22 (SSH).
This rule detects when an AWS IAM role is assumed, which can be a legitimate activity for temporary elevated access within an AWS environment. The detection is based on HTTP traffic to 'sts.amazonaws.com' with 'AssumeRole' in the URI, indicating a request to the AWS Security Token Service to assume an IAM role. This activity is often associated with privilege escalation techniques.
This rule detects attempts to escalate privileges using 'sudo su -' over an SSH connection. It specifically looks for the string 'sudo su -' within TCP traffic on port 22, indicating a potential privilege escalation attempt after an SSH session has been established.
This rule detects attempts to deliver a setuid shell payload via a web shell. It specifically looks for HTTP requests containing both 'chmod' and '+s' (case-insensitive) in the URI, indicating an attempt to modify file permissions to set the setuid bit.
This rule detects the download of a payload that might be used in a User Account Control (UAC) bypass technique. It specifically looks for HTTP traffic where the URI contains keywords like 'uac.bypass', 'elevate', 'privesc', or 'bypassuac' (case-insensitive) and the file data starts with 'MZ', indicating a Windows executable.
Page 456 of 864