Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,230 detections
Filters
Last updated
All Time
Detection languages
2,175
1,018
354
260
212
Contributors
1,013
818
688
574
212
Categories
20,456
11,839
5,876
5,155
4,865
4,230
Platforms
2,933
889
585
248
198
Products / Services
2,239
1,453
841
416
344
MITRE Techniques
1,164
1,087
870
798
439
CVEs
22
20
20
18
17
IDS Classtypes
927
408
222
146
104
IDS Protocols
1,914
105
70
47
6
Detects HTTP POST requests directed to the specific URI path '/api/validate/keyboard-events', which is used by a North Korean-linked npm malware to exfiltrate keylogger data.
This rule detects attempts to sell or exchange VPN credentials by looking for the keywords "vpn" and "credentials" in the client body of HTTP traffic. This could indicate an attacker attempting to monetize stolen VPN access or an insider threat attempting to leak sensitive access information.
This rule detects potential reconnaissance activity by identifying IP addresses that generate a high volume of HTTP requests with user agents indicating bots, crawlers, or scanners. It counts requests per IP address within one-hour bins and flags those with 50 or more such requests.
This rule detects HTTP POST requests to known paste sites (pastebin.com, paste.ee, hastebin.com) with a data size greater than 500 bytes. This behavior is often associated with adversaries using these sites to host malicious payloads or exfiltrate data.
This rule detects potential Cross-Site Scripting (XSS) attempts by identifying multiple URI queries containing common XSS payloads such as '<script>', 'javascript:', or 'onerror=' within a one-hour window from the same client IP address. A count of 3 or more attempts triggers the alert.
Detects an unusually high volume of web requests (1000 or more per minute) originating from a single IP address to an IIS web server. This pattern can indicate various malicious activities such as brute-force attacks, denial-of-service (DoS) attempts, or aggressive web scanning.
This rule detects the delivery of potentially malicious Microsoft Office startup files (Excel, Word, PowerPoint macro-enabled or binary files) via HTTP. It specifically looks for files with extensions like .xlsb, .xlsm, .docm, .pptm, or .dotm in the HTTP URI and checks for the presence of "vbaProject" content within the file data, indicating the presence of VBA macros which are often used in malicious documents.
This rule detects attempts to access sensitive configuration or backup files on an IIS web server. It looks for requests where the URI stem contains keywords like '.env', 'config', or 'backup', which are commonly associated with files that may contain sensitive information.
This rule detects potential information disclosure attempts by monitoring W3C IIS logs for repeated queries containing keywords like 'version', 'build', or 'debug'. A high frequency (5 or more attempts within an hour) from a single IP address suggests an adversary is trying to enumerate software versions or debug information, which can be used for further reconnaissance or exploit development.
This rule detects a high volume of POST requests to login, authentication, or password-related URI stems within a 5-minute window from unique IP addresses. This behavior is indicative of brute-force attacks or credential stuffing attempts against web applications.
This rule detects HTTP requests containing multiple common HTTP header names (X-Forwarded-For, X-Real-IP, X-Originating-IP) in the 'http.header_names' field. This pattern is often associated with attempts to bypass Web Application Firewalls (WAFs) or other security devices by injecting junk or spoofed headers to confuse or misdirect them.
This rule detects HTTP password spray attacks where an attacker attempts to log in to multiple user accounts on a web application using a common password. It specifically looks for HTTP POST requests to a URI containing 'login' and triggers an alert if 30 such requests are observed within 60 seconds, tracked by the destination IP address.
Bun Runtime Remote Download
Cortex XDR
Detects network connections downloading the Bun runtime from the oven-sh GitHub repository, a behavior exhibited by the Hades loader. This rule specifically looks for HTTP network events where the URL contains 'github.com' and 'oven-sh/bun/releases/download', indicating an attempt to download the Bun runtime.
This rule detects HTTP traffic where the URI contains both "firmware" and "update" (case-insensitive) and the HTTP host is an IP address. This combination suggests a firmware update request originating from or destined for an unverified source, potentially indicating a malicious or unauthorized firmware update attempt.
This rule detects potential phishing attempts involving malicious file sharing via OneDrive. It specifically looks for HTTP traffic directed to 'onedrive.live.com' with 'sharing' in the URI. A threshold is set to trigger an alert if five such events occur from the same source within 60 seconds, indicating a potential automated or repeated attempt to share malicious content.
This rule detects attempts to upload web shells for website defacement. It specifically looks for HTTP POST requests where the URI contains the string "deface" (case-insensitive). This combination suggests an attacker is trying to modify a website's content, potentially by uploading a malicious script or file.
This rule detects potential data exfiltration attempts via Slack incoming webhooks. It triggers when an HTTP POST request is made to 'hooks.slack.com' with a URI containing '/services/' and a data size greater than 500 bytes. This pattern is indicative of an application or script sending data to a Slack channel using a webhook.
This rule detects HTTP traffic that attempts to impersonate legitimate browser traffic (specifically Chrome on Safari) for command and control (C2) purposes. It looks for a specific User-Agent pattern that mimics Chrome on Safari and a URI pattern consisting of 8 to 16 lowercase alphanumeric characters. A threshold is applied to prevent excessive alerts, triggering if 20 such events occur within 60 seconds from the same source.
This rule detects HTTP traffic where the 'Host' header contains common Content Delivery Network (CDN) domains (cloudfront.net, azureedge.net, fastly.net, cloudflare.net) and the 'X-Forwarded-Host' header is also present. This pattern can indicate C2 infrastructure attempting to hide behind CDN fronting, a technique used by adversaries to obscure the true origin of their command and control servers.
This rule detects attempts to use cloud services (specifically AWS SSM or Azure Management) for internal lateral movement. It triggers when HTTP requests are made to 'ssm.amazonaws.com' or 'management.azure.com' with the URI containing 'SendCommand'. A threshold of 5 such events from the same source within 30 seconds is set to reduce false positives.
This rule detects potential session hijacking attempts by monitoring HTTP traffic for unusually long cookie values. Specifically, it looks for HTTP cookies containing base64-like strings (alphanumeric characters, plus, slash, and equals signs) that are 100 characters or longer. A threshold of 5 such occurrences within 3 seconds from the same destination IP address triggers the alert, indicating a possible attempt to use a stolen browser session cookie.
Page 141 of 202