Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
404 detections
Filters
Last updated
All Time
Detection languages
193
104
95
4
3
Contributors
90
77
62
50
22
Categories
231
151
101
83
77
Platforms
270
109
39
18
9
Products / Services
10,665
9,773
6,704
4,421
3,749
404
MITRE Techniques
138
119
74
64
47
CVEs
4
2
2
2
1
IDS Classtypes
1
IDS Protocols
1
Detects attempts to exploit the Squidbleed vulnerability by monitoring process command lines for Squid (squid.exe) using specific accept_filter or defer_accept related keywords. This could indicate an attempt to bypass configuration or exploit a vulnerability related to TCP connection handling.
This rule detects suspicious command-line arguments indicative of a potential buffer overflow attempt targeting the 'squid.exe' process. The presence of keywords like 'buffer+', 'ptr++', 'offset', 'increment', or 'boundary' in the command line of 'squid.exe' suggests an attempt to manipulate memory or exploit a vulnerability.
Detects suspicious command-line arguments associated with the 'squid.exe' process that may indicate exploitation attempts related to the Squidbleed vulnerability, specifically looking for patterns indicative of 4KB buffer freelist recycling. This includes keywords like 'malloc', 'free', '4096', '4KB', 'buffer', and 'MEM_'.
Detects network connections originating from a Squid proxy process (squid.exe or processes containing 'squid' in their name) attempting to connect to an FTP server (port 21). This could indicate a reachability test or other activity related to the Squidbleed vulnerability, or general proxy misuse.
This rule detects JavaScript code within web traffic (proxy, web, or sandbox logs) that indicates attempts to block developer tools, prevent debugging, or detect automation drivers. Specifically, it looks for keywords and patterns associated with context-menu blocking, debugger statements, checks for browser window dimensions (often used to detect minimized or non-interactive browser windows), and the presence of automation-related strings like 'navigator.webdriver', 'selenium', or 'playwright'. This behavior is often observed in adversary-in-the-middle (AitM) phishing pages, such as those used by the Tycoon threat group, to hinder analysis and prevent automated detection.
Detects web traffic where a user initiates a request for content related to 'policy', 'conduct', 'compliance', or 'handbook', experiences at least three redirects across different hosts, and ultimately lands on a page containing keywords indicative of a login, sign-in, OAuth, or authorization prompt. This pattern is often used in multi-stage phishing campaigns to obscure the malicious infrastructure.
Detects a two-stage credential page that receives an email address and then requests tenant branding or a password form during the same browser session. This behavior is indicative of advanced phishing attacks that attempt to mimic legitimate login flows.
Detects HTTP requests directed at known MexicanMafia Operation Escaneo phishing infrastructure, specifically targeting tax authority and SeedDMS document management users. The rule alerts on access to identified artifact filenames used in the campaign, such as phishing poc and spoofed document management pages.
Detects HTTP requests initiated by common browser adblock extensions to remote API endpoints for retrieving rule configuration files. This behavior can be exploited by adversaries to perform remote scriptlet injection or change extension behavior via server-side updates, potentially enabling unauthorized JavaScript execution in the browser's context.
Detects Browser-in-the-Middle (BitM) phishing infrastructure associated with PhaaS kits (e.g., Bluekit). The detection monitors proxy access logs for patterns where page assets (images, fonts, CSS) are fetched through a proxy API endpoint on behalf of the victim, combined with WebSocket connections used for real-time relay of victim inputs to the attacker.
Detects instances where the Squid proxy application is used to establish network connections over ports 21 (FTP) or 22 (SSH) to specific external IP ranges. This behavior may indicate an attacker using the internal proxy server to anonymize command-and-control (C2) traffic or perform unauthorized external reconnaissance.
This rule detects the execution of the squid.exe process where the command line does not explicitly specify a configuration file using the '-f' or '-n' flags, nor does it reference 'squid.conf'. Running Squid without a defined configuration file may lead to the application loading default, insecure, or unintended settings, which could be exploited as part of a vulnerability chain or misconfiguration.
Detects a web session that proxies an enterprise authorisation endpoint while also handling session-cookie names associated with authenticated access. This rule identifies suspicious activity indicative of an Adversary-in-the-Middle (AiTM) attack where an attacker proxies authentication requests and steals session cookies.
Detects one web session posting username, password, and MFA or one-time-code form fields through the same intermediary host. This behavior is indicative of an Adversary-in-the-Middle (AiTM) attack, where an attacker intercepts and relays authentication requests, including multi-factor authentication (MFA) codes, to gain unauthorized access.
Detects a phishing page upgrading to WebSocket or polling transport with Socket.IO event framing during authentication. This behavior is indicative of an adversary-in-the-middle (AiTM) attack, specifically associated with the 'Tycoon' threat activity.
Detects potential port scanning activity originating from a Squid proxy server targeting FTP (port 21). This rule identifies instances where a Squid process attempts to connect to port 21 on multiple remote IPs within a one-hour window, which could indicate reconnaissance or malicious activity.
This rule detects potential exploitation attempts related to the 'Squidbleed' vulnerability (CVE-2021-28116) by monitoring 'squid.exe' process command lines for keywords indicative of stack variable overflow exploitation in its FTP parser. Specifically, it looks for the presence of terms like 'stack', 'heap', 'offset', 'buffer', or 'pointer' combined with 'overread', 'overflow', or 'bounds'.
This rule detects potential session token leakage through network proxy responses. It specifically looks for network events where the action type is 'NetworkSignatureInspected', the remote port is 21 (commonly FTP), and the remote URL contains keywords indicative of session tokens such as 'session', 'cookie', 'JSESSIONID', 'PHPSESSID', or 'ASP.NET_SessionId'. This could indicate a vulnerability where session information is inadvertently exposed in proxy logs or network traffic.
Detects potential memory leak debugging or exploitation attempts related to the Squid proxy server by monitoring process command lines for keywords like 'leak', 'memory', 'valgrind', 'gdb', or 'debug'. This could indicate an adversary attempting to exploit a memory leak vulnerability or a developer debugging one.
Detects potential port scanning activity originating from a Squid proxy server targeting FTP (port 21). This rule identifies instances where a Squid process attempts to connect to port 21 on multiple remote IPs within a one-hour window, which could indicate reconnaissance or malicious activity.
This rule detects attempts to extract authorization headers (Bearer, Basic, or X-API-Key) over FTP (port 21) by inspecting network signatures. This could indicate an attempt to exploit a vulnerability or misconfiguration where sensitive credentials are being transmitted in an insecure manner.
Page 9 of 20