Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
18,128 detections
Filters
Last updated
All Time
Detection languages
6,549
6,208
1,473
1,005
661
Contributors
3,555
2,652
2,153
2,087
1,515
Categories
7,572
3,901
1,465
1,393
1,330
Platforms
13,733
1,392
1,319
824
738
Products / Services
3,828
3,137
2,448
912
908
MITRE Techniques
18,128
15,651
12,599
8,410
6,235
CVEs
19
18
17
16
14
IDS Classtypes
305
51
24
23
22
IDS Protocols
308
136
13
10
10
This rule detects the presence of an XOR decoding routine within a downloaded script. It specifically looks for the keywords "XOR" and "fromCharCode" (case-insensitive) in the file data of HTTP traffic flowing to the client. This combination is often used by malicious scripts to deobfuscate their payload.
This rule detects HTTP traffic indicating an attempt to terminate an EC2 instance on AWS. Specifically, it looks for HTTP requests to 'ec2.amazonaws.com' with 'TerminateInstances' in the URI, which is a common API call used to delete cloud instances. This activity could be performed by an attacker to remove evidence of their presence or to disrupt services.
This rule detects when a cloud disk snapshot is created, specifically targeting AWS EC2 'CreateSnapshot' API calls. This activity can be indicative of data exfiltration attempts, where an attacker creates a snapshot of a compromised disk to move data out of the environment.
This rule detects the string "setfattr" in TCP traffic destined for port 22 (SSH). The presence of "setfattr" in SSH traffic might indicate an attempt to use Linux extended attributes to hide data or malicious payloads, a technique often associated with defense evasion.
This rule detects the string "mount --bind" within TCP traffic on port 22 (SSH). This string indicates an attempt to create a bind mount, which can be used by attackers to obscure the true location of malicious files or to manipulate file system access. The rule specifically looks for this activity on the home network, suggesting an internal system being targeted or used for malicious purposes.
This rule detects HTTP responses that contain a Windows executable (indicated by 'MZ' header) and where the HTTP URI path contains specific Windows utility names (mshta, rundll32, regsvr32, msiexec, installutil, cmstp). This combination suggests a potential attempt to use signed binaries as proxies for malicious execution, a common defense evasion technique.
This rule detects when a network device disables hardware crypto acceleration. It specifically looks for TCP traffic on port 22 (SSH) from any source to the home network, containing the case-insensitive string "no crypto engine". This could indicate a policy violation or an attempt to degrade cryptographic performance, potentially for evasion or to facilitate other attacks.
This rule detects the negotiation of a weak cipher, specifically 'arcfour', during an SSH session. It monitors TCP traffic flowing to the home network on port 22 (SSH) and triggers an alert if the string 'arcfour' is found in the established session, ignoring case.
This rule detects when an AWS Organization Unit (OU) is modified, specifically when the 'MoveAccount' API call is made to 'organizations.amazonaws.com'. This activity could indicate an attempt to evade detection or alter the organizational structure for malicious purposes.
This rule detects the delivery of a payload that attempts to use rundll32.exe for proxy execution. It specifically looks for HTTP traffic (flow:to_client,established) containing both "rundll32.exe" and ".dll," (case-insensitive) in the file data, indicating a potential malicious DLL being delivered for execution via rundll32.
This rule detects attempts to modify the Info.plist file on macOS systems to include 'LSUIElement' with a value of '<true/>'. This modification can be used by malware or unwanted applications to hide their presence from the macOS Dock and menu bar, effectively bypassing user detection and making the application run as a background process. The rule specifically looks for these two content strings within HTTP file data flowing to the client.
This rule detects HTTP traffic where the URI contains both 'odbcconf' and 'REGSVR' (case-insensitive). This combination is indicative of an attempt to use odbcconf.exe for DLL proxy execution, a technique often employed by adversaries for defense evasion.
This rule detects HTTP traffic where the User-Agent header contains "MSHTML", indicating potential remote script execution via Mshta. Mshta.exe is a Microsoft utility that can execute HTML Application (HTA) files, which can contain scripts. Attackers often abuse Mshta to execute malicious scripts, bypassing traditional execution policies. The rule specifically looks for outbound HTTP connections from the internal network ($HOME_NET) to any external destination, where the User-Agent string includes "MSHTML" (case-insensitive). This behavior is commonly associated with trojan activity and defense evasion tactics.
This rule detects the string "CheckRemoteDebuggerPresent" within HTTP response payloads. This string is associated with an anti-debugging technique used by malware to detect if it's being analyzed in a debugger environment. The rule specifically looks for this content in data flowing from the server to the client (flow:to_client,established; file.data;). The detection is case-insensitive (nocase).
This rule detects the delivery of an HTA (HTML Application) file via HTTP. It specifically looks for HTTP responses containing a URI with the '.hta' extension (case-insensitive) and the content '<HTA:APPLICATION' (case-insensitive) within the file data, indicating an HTA application being served to a client. This technique is often used by attackers for defense evasion and initial access.
This rule detects attempts to modify file permissions remotely via SMB by looking for the string "icacls" in TCP traffic directed to port 445 (SMB). The detection is case-insensitive and focuses on established connections flowing to the server. This activity is classified as trojan activity, suggesting an attacker might be attempting to alter file access controls on a remote system.
This rule detects attempts to modify an Azure Management Group, specifically when a PUT request is made to 'management.azure.com' with 'managementGroups' in the URI. This activity could indicate an attempt to evade defenses by altering management group configurations.
Detects the execution of mshta.exe containing a URL with an '@' character to spoof a legitimate domain (e.g., www.bbc.com@malicious.com). This technique is used by Gamaredon in the GammaPhish stage to obfuscate the real C2 domain when launching initial HTA payloads.
Detects the use of regedit.exe to silently or explicitly import a .reg file located in the C:\ProgramData\ directory. This technique is used by threat actors, such as those deploying Nimbus RAT, to establish persistence.
Detects attempts to read Runner.Worker process memory to extract GitHub Actions secrets
in their unmasked form. The Miasma worm uses sudo python3 to escalate privileges and
read /proc/<PID>/mem, then pipes through grep to extract secret values.
in their unmasked form. The Miasma worm uses sudo python3 to escalate privileges and
read /proc/<PID>/mem, then pipes through grep to extract secret values.
Detects the execution of known VerdantBamboo payload names (luserput, ovs-dbctl, egnyte_host_monitor_client) or specific malicious deployment paths, indicating potential PLENET, BRICKSTORM, or AGENTPSD malware activity on compromised Linux and edge devices.
Page 467 of 864