Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
404 detections
Filters
Last updated
All Time
Detection languages
193
104
95
4
3
Contributors
90
77
62
50
22
Categories
231
151
101
83
77
Platforms
270
109
39
18
9
Products / Services
10,665
9,773
6,704
4,421
3,749
404
MITRE Techniques
138
119
74
64
47
CVEs
4
2
2
2
1
IDS Classtypes
1
IDS Protocols
1
Detects the execution of 'squid.exe' with command-line arguments that contain whitespace characters potentially indicative of a NULL terminator vulnerability (Squidbleed). The rule specifically looks for common whitespace representations like 'w_space', 'space', 'tab', 'newline', '\n', '\r', and '\t' in the command line.
This rule detects potential exploitation attempts related to the 'Squidbleed' vulnerability (CVE-2021-28116) by monitoring 'squid.exe' process command lines for keywords indicative of stack variable overflow exploitation in its FTP parser. Specifically, it looks for the presence of terms like 'stack', 'heap', 'offset', 'buffer', or 'pointer' combined with 'overread', 'overflow', or 'bounds'.
This rule detects potential exploitation attempts related to the Squidbleed vulnerability, specifically looking for the execution of 'squid.exe' with command-line arguments indicative of a 'while loop bypass via null terminator manipulation'. The keywords 'while', '++copyFrom', 'strchr', and 'w_space' are used to identify suspicious command-line activity.
This rule detects when the 'squid.exe' process is executed with command-line arguments indicating a configuration reload, restart, or explicit use of 'squid.conf'. This could be indicative of an attacker manipulating Squid proxy settings, potentially as part of the Squidbleed vulnerability exploitation or other malicious activity.
Detects the generation of core dump files by the Squid proxy server process, which could indicate a crash, segmentation fault, or an attempt to exploit a vulnerability like Squidbleed. This rule specifically looks for 'squid.exe' processes with command line arguments related to core dumps or crashes.
This rule detects potential exploitation attempts related to the Squidbleed vulnerability, specifically looking for command-line arguments indicative of heap buffer overread conditions within the 'squid.exe' process. It monitors for keywords such as 'strchr', 'buffer', 'overread', 'parse', 'directory', and 'listing' in the command line.
Detects suspicious command-line arguments associated with the 'squid.exe' process that may indicate exploitation attempts related to the Squidbleed vulnerability, specifically looking for patterns indicative of 4KB buffer freelist recycling. This includes keywords like 'malloc', 'free', '4096', '4KB', 'buffer', and 'MEM_'.
Detects the execution of the Squid proxy process with command-line arguments indicating the use of FTP parsing components. This could be indicative of a vulnerability exploitation attempt or unusual configuration.
Detects execution of squid.exe or commands containing squid with arguments related to AddressSanitizer or buffer overflows.
Detects suspicious command line arguments containing null byte indicators, often used to bypass file extension filters or path processing security measures.
Detects execution of squid.exe with suspicious command line arguments
Detects a click originating from a legitimate email or marketing redirection service and ending on a page that requests enterprise credentials. This behavior is indicative of a phishing attempt where an adversary leverages trusted email services to redirect users to a credential harvesting site.
This rule detects the execution of the squid.exe process where the command line does not explicitly specify a configuration file using the '-f' or '-n' flags, nor does it reference 'squid.conf'. Running Squid without a defined configuration file may lead to the application loading default, insecure, or unintended settings, which could be exploited as part of a vulnerability chain or misconfiguration.
This rule detects attempts to extract authorization headers (Bearer, Basic, or X-API-Key) over FTP (port 21) by inspecting network signatures. This could indicate an attempt to exploit a vulnerability or misconfiguration where sensitive credentials are being transmitted in an insecure manner.
Detects the execution of 'squid.exe' with command-line arguments that contain whitespace characters potentially indicative of a NULL terminator vulnerability (Squidbleed). The rule specifically looks for common whitespace representations like 'w_space', 'space', 'tab', 'newline', '\n', '\r', and '\t' in the command line.
Detects outbound network connections from 'squid.exe' to internal IP addresses on port 21 (FTP). This could indicate an attacker controlling an FTP server within the internal network, potentially exploiting a vulnerability like Squidbleed.
This rule detects potential exploitation attempts related to the Squidbleed vulnerability, specifically looking for the execution of 'squid.exe' with command-line arguments indicative of a 'while loop bypass via null terminator manipulation'. The keywords 'while', '++copyFrom', 'strchr', and 'w_space' are used to identify suspicious command-line activity.
This rule detects when the 'squid.exe' process is executed with command-line arguments indicating a configuration reload, restart, or explicit use of 'squid.conf'. This could be indicative of an attacker manipulating Squid proxy settings, potentially as part of the Squidbleed vulnerability exploitation or other malicious activity.
Detects attempts to exploit the Squidbleed vulnerability by monitoring process command lines for Squid (squid.exe) using specific accept_filter or defer_accept related keywords. This could indicate an attempt to bypass configuration or exploit a vulnerability related to TCP connection handling.
This rule detects suspicious command-line arguments indicative of a potential buffer overflow attempt targeting the 'squid.exe' process. The presence of keywords like 'buffer+', 'ptr++', 'offset', 'increment', or 'boundary' in the command line of 'squid.exe' suggests an attempt to manipulate memory or exploit a vulnerability.
This rule detects potential exploitation of the Squidbleed vulnerability by identifying network connections to FTP port 21 where the remote URL contains 'PASV' or 'EPSV' commands, and the initiating process is 'squid.exe'. This indicates an attempt to abuse FTP passive mode through the Squid proxy.
Page 10 of 20