Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,421 detections
Filters
Last updated
All Time
Detection languages
4,217
105
40
25
13
Contributors
1,327
1,003
725
627
332
Categories
2,253
2,239
1,434
1,144
973
Platforms
4,107
453
295
83
82
Products / Services
10,670
9,758
6,693
4,421
3,749
MITRE Techniques
886
774
552
505
456
CVEs
18
12
12
12
10
IDS Classtypes
1,868
466
446
362
230
IDS Protocols
2,366
846
388
301
93
This rule detects the download of a potentially malicious LNK shortcut file over HTTP. It specifically looks for HTTP responses (flow:to_client) containing a URI with ".lnk" (nocase) and the byte sequence "|4C 00 00 00|" at the beginning of the file data (depth:4), which is characteristic of an LNK file header. This activity is often associated with initial access or execution techniques where attackers use shortcut files to deliver malware or execute malicious commands.
This rule detects when a user clicks on a malicious link, indicated by a referrer from common email/webmail services (mail., webmail., outlook., gmail.), and the subsequent HTTP response contains a Windows executable (MZ header). This suggests a drive-by download attempt or a user being tricked into downloading malware after clicking a phishing link.
This rule detects the delivery of a malicious DLL (Dynamic Link Library) file via HTTP download. It specifically looks for HTTP responses (flow:to_client) containing a URI with ".dll" (case-insensitive) and the "MZ" magic bytes at the beginning of the file data, indicating an executable file. This combination suggests a DLL being downloaded to a client system, which could be part of a malware delivery chain.
This rule detects potential API injection payloads, specifically looking for the strings "CreateRemoteThread" and "OpenProcess" within HTTP response data. These API calls are commonly used in techniques like process injection to execute malicious code within another process. The rule is designed to identify the delivery of such payloads to client systems.
This rule detects attempts to abuse native Windows API functions, specifically 'NtCreateProcess', via web shell execution. It looks for HTTP requests where the URI content includes 'NtCreateProcess' in a case-insensitive manner, indicating a potential web shell trying to create a new process on the server.
This rule detects HTTP POST requests to AWS Lambda invocation endpoints, specifically targeting URLs matching the pattern '/lambda.[a-z0-9-]+.amazonaws.com' with the URI '/invocations'. A threshold of 20 such requests within 60 seconds from a single source IP triggers the alert, indicating potential code execution activity via AWS Lambda.
This rule detects when a file containing both ".plist" in its HTTP URI and "LaunchDaemon" in its content is delivered via HTTP. This combination suggests the download of a macOS LaunchDaemon property list file, which could be used for persistence or privilege escalation on macOS systems.
This rule detects the string "launchctl load" within TCP traffic on port 22 (SSH). This indicates an attempt to load a launchd service on a macOS or Linux system via a remote SSH connection. This activity could be legitimate system administration but also could be indicative of an attacker establishing persistence or executing malicious services.
This rule detects potential DCOM lateral execution attempts. It specifically looks for TCP traffic to port 135 (typically used by DCOM/RPC) on the home network, containing the byte sequence '|05 00 0b|' within the first 3 bytes of the payload. A threshold of 5 occurrences from the same source within 30 seconds is set to reduce false positives.
This rule detects the download of a potential trojanized installer file over HTTP. It looks for HTTP responses to clients that contain 'setup', 'install', or 'installer' in the URI, have a file size greater than 500KB, and contain the 'MZ' header, indicating a Windows executable. This combination suggests a user is downloading an executable that could be malicious.
This rule detects the download of archive files (ZIP, RAR, 7Z, TAR.GZ) over HTTP that contain an executable file signature ('MZ' header). This combination suggests a potential user execution scenario where a malicious executable might be delivered within an archive.
This rule detects HTTP POST requests to the '/sdk/vimService' URI on TCP port 443 (HTTPS) targeting an ESXi host. This pattern is indicative of direct API command execution attempts against the VMware vSphere API, which could be used by an attacker to interact with or control the ESXi hypervisor.
This rule detects when an executable file (.exe) is copied to a share associated with a removable drive (indicated by 'USBSTOR') over the SMB protocol. This could indicate an attempt to transfer malicious executables to or from a removable device.
This rule detects LDAP bind requests originating from an external source to a domain controller (port 389) within the home network. It specifically looks for the 'bindRequest' content in TCP traffic and triggers an alert if 10 such requests are observed from the same source within a 30-second window. This could indicate an attempt to enumerate or authenticate against directory services from outside the internal network, potentially as part of initial access or reconnaissance.
This rule detects TFTP (Trivial File Transfer Protocol) traffic on UDP port 69, specifically looking for a content pattern that indicates a firmware push. The pattern '|00 02|' at the beginning of the UDP payload suggests a TFTP write request (opcode 2), which is commonly used for uploading files, including firmware, to network devices. The rule is designed to alert on such activity directed towards the local network ($HOME_NET).
This rule detects DNS queries for domains that resemble update servers used in the SolarWinds supply chain attack. Specifically, it looks for DNS queries containing 'update' followed by 'solarwinds', 'orion', 'avupdate', or 'antivirus' in the domain name. This pattern was associated with the SUNBURST backdoor's communication with its command and control infrastructure.
This rule detects attempts to download typosquatted NPM packages from registry.npmjs.org. It specifically looks for HTTP requests to the NPM registry where the URI contains common typos of popular packages like 'lodash', 'requests', 'express', 'mongoose', and 'momentjs'. This indicates a potential supply chain attack where developers might accidentally download malicious packages due to a typo.
This rule detects HTTP responses containing JavaScript that attempts to redirect the user's browser to another page and executes code using 'eval()'. This combination is often used in malicious web pages to redirect users to exploit kits or phishing sites, and to obfuscate malicious JavaScript.
This rule detects HTTP responses from a web server to a client that contain JavaScript code attempting to redirect the user's browser. Specifically, it looks for the string "window.location.replace" within the HTTP response body (file.data) when the HTTP referer header indicates the request originated from Google or Bing search results. This pattern is often associated with content injection attacks where malicious code is injected into legitimate search results to redirect users to malicious sites.
This rule detects potential phishing attempts delivered via Slack messages. It triggers when HTTP traffic to 'slack.com' contains '/messages/' in the URI, indicating a Slack message context, and has a threshold of 5 occurrences within 60 seconds from the same source.
This rule detects Address Resolution Protocol (ARP) announcements from new or unknown devices on the network. Specifically, it looks for ARP packets with an opcode of '2', which signifies an ARP reply. The rule uses a threshold to trigger an alert if a new ARP reply is observed from a source within a 5-second window, indicating a potential new device joining the network or an attempt at ARP spoofing.
Page 173 of 211