Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
18,128 detections
Filters
Last updated
All Time
Detection languages
6,549
6,208
1,473
1,005
661
Contributors
3,555
2,652
2,153
2,087
1,515
Categories
7,572
3,901
1,465
1,393
1,330
Platforms
13,733
1,392
1,319
824
738
Products / Services
3,828
3,137
2,448
912
908
MITRE Techniques
18,128
15,651
12,599
8,410
6,235
CVEs
19
18
17
16
14
IDS Classtypes
305
51
24
23
22
IDS Protocols
308
136
13
10
10
Detects exclusive file locks used to prevent security tools from accessing files
Detects malicious MSI package execution via msiexec for LOLBin abuse
Detects disabling of hardware crypto acceleration on network devices
Detects creation of hidden files and directories via remote SSH for artifact hiding
Detects JamPlus build automation tool abused for malicious proxy execution
Detects XOR-encrypted payload delivery used to evade signature detection
Detects OAuth bearer tokens being reused from unexpected IP addresses
Detects TFTP transfers used to deliver bootkit or firmware persistence payloads
Detects DLL files dropped to network shares for search order hijacking
Detects stripped executable payloads with debug information removed for evasion
This rule detects the creation of a specific mutex pattern associated with the Grixba ransomware. The mutex name starts with 'CPFATE_' and contains the .NET framework version string 'v4.0.30319', which is a unique artifact used by Grixba to ensure only one instance of itself is running.
This rule detects potential HTML smuggling attempts where a malicious payload is delivered via a Blob URL. It specifically looks for HTTP responses (flow:to_client) that contain both 'URL.createObjectURL' and 'Blob(' (case-insensitive) in the file data. This combination is indicative of JavaScript code creating a Blob object and then generating a URL for it, which can be used to deliver files directly to the client's browser, bypassing traditional network security controls.
This rule detects the delivery of a stripped binary, specifically an executable (indicated by 'MZ' header) that has been packed or compressed using UPX (indicated by 'UPX' string). The rule triggers on HTTP traffic flowing to the client, suggesting a download or delivery of such a file. The 'Stripped Binary Delivered with Debug Info Removed' message implies an attempt to evade detection or analysis by removing debugging information, often associated with malware or unwanted applications.
This rule detects HTTP traffic where the host header contains specific cloud region identifiers that are considered rarely used. The rule is triggered if 10 such events occur within 60 seconds from the same source IP address. The identified regions are 'ap-east-1', 'me-south-1', 'af-south-1', and 'eu-south-1'. This could indicate an attempt to evade detection by using less common cloud infrastructure or an unauthorized API call from an unusual geographic location.
This rule detects the delivery of a kernel rootkit module, specifically a Linux Kernel Module (LKM) or a Windows system file, over HTTP. It looks for HTTP responses where the URI ends with '.ko' (Kernel Object for Linux) or '.sys' (system file for Windows) and the file data contains the 'ELF' magic bytes, indicating an Executable and Linkable Format file, which is common for Linux executables and modules. This combination suggests an attempt to deliver a malicious kernel module.
This rule detects HTTP C2 traffic attempting to store a fileless payload in the Windows Registry. It specifically looks for HTTP responses (flow:to_client) containing the strings 'HKCU' (likely indicating a registry key path), 'powershell', and 'IEX' (Invoke-Expression), which are common indicators of PowerShell-based fileless malware using the registry for persistence or execution.
This rule detects potential steganography where a payload is embedded within an image file, specifically a JPEG. It triggers when an HTTP response contains JPEG magic bytes (`FF D8 FF`) within the first 3 bytes, and the file size is unusually large (over 1MB), suggesting additional data might be hidden within the image. The rule also includes a threshold to prevent excessive alerts from legitimate large images.
This rule detects the potential use of a stolen web session cookie from a new location. It specifically looks for HTTP traffic containing common session-related keywords like 'session', 'auth', or 'token' within the HTTP cookie header. A threshold of 10 occurrences within 5 seconds, tracked by destination IP, is used to trigger the alert, indicating a potential high-frequency attempt to use a session cookie.
This rule detects network traffic, specifically HTTP responses (flow:to_client), that contain the strings "GetProcAddress" and "LoadLibraryA" (case-insensitive). These strings are commonly associated with dynamic API resolution techniques used by malware to load functions at runtime, often to evade static analysis. The rule is classified as detecting trojan activity.
This rule detects the presence of a Right-to-Left Override (RLO) character (Unicode E2 80 AE) in HTTP response content, specifically within file data. This character can be used in filenames to visually reverse the order of characters, making a file appear to have a different extension or name than it actually does, a common technique for defense evasion and tricking users into executing malicious files.
This rule detects attempts to delete a cloud security group rule via the AWS EC2 API. Specifically, it looks for HTTP traffic to 'ec2.amazonaws.com' with the URI containing 'RevokeSecurityGroupIngress', which is the API call used to remove an inbound rule from a security group.
Page 459 of 864