Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
565 detections
Filters
Last updated
All Time
Detection languages
464
49
14
12
11
Contributors
217
119
88
54
41
Categories
20,443
11,831
5,875
5,151
4,864
565
Platforms
495
55
21
17
14
Products / Services
468
195
64
23
14
MITRE Techniques
180
93
66
63
60
CVEs
4
4
4
4
3
IDS Classtypes
303
37
23
23
21
IDS Protocols
449
3
Detects network communication with the Rokarolla trojan's command and control (C2) server ('beralisvc.info') and subsequent injection of base64-encoded HTML phishing overlays into legitimate banking application UIs. The rule identifies C2 contact via network events and the presence of specific HTML content indicators ('html_base64', 'PCFEt0NUWVBFIGh0bWw+', 'com.imaginbank.app') in HTTP responses, suggesting an overlay attack.
Detects HTTP responses containing JavaScript files with a Content-Length exceeding 1MB. This behavior is associated with the Bluekit PhaaS (Phishing-as-a-Service) platform, which uses large, obfuscated JavaScript bundles for browser fingerprinting and to evade static security signatures.
Detects unauthenticated GET requests to the vulnerable ServiceNow REST API endpoint '/api/now/related_list_edit/create' which was exploited in early June 2026. The detection monitors for requests originating from anonymous or guest users, lacking authorization headers, and returning successful (200) responses.
Detects Browser-in-the-Middle (BitM) phishing attacks, such as Bluekit, that utilize the rrweb library for real-time DOM serialization and WebSocket streaming to capture user sessions. The rule correlates the presence of the rrweb library in HTTP traffic with WebSocket communication patterns containing session handshakes and serialized DOM payloads.
Detects malicious script injection into HTTP responses via MitM
Detects malicious script injection into HTTP responses via MitM
This rule detects the delivery of a payload associated with the 'Incognito Token Theft Tool'. It specifically looks for the case-insensitive string 'list_tokens' within HTTP response body content flowing from a server to a client. This string is indicative of the tool's functionality, which often involves listing tokens for exfiltration or further abuse, suggesting an attempt at privilege escalation or credential access.
This rule detects successful exploitation attempts against the Ivanti Sentry vulnerability CVE-2026-10520, which is a pre-authentication OS command injection. It specifically looks for HTTP 200 OK responses to requests targeting the vulnerable configuration endpoint '/mics/api/v2/sentry/mics-config/handleMessage'. A 200 OK status indicates that the request was successfully processed, suggesting a potential successful command injection.
This rule detects the delivery of a malicious XSL (Extensible Stylesheet Language) script via HTTP to a client. The detection is based on the HTTP URI containing ".xsl" (case-insensitive) and the file data containing "<msxsl:script" (case-insensitive). This pattern is indicative of an attempt to use XSLT for proxy execution, often associated with techniques like WMIC (Windows Management Instrumentation Command-line) for defense evasion.
This rule detects attempts to bypass macOS Gatekeeper by removing the 'com.apple.quarantine' extended attribute from downloaded files. It specifically looks for HTTP responses containing the string 'com.apple.quarantine' in the file data, indicating a potential attempt to modify or remove this attribute during or after a download.
This rule detects HTTP traffic containing the string "KerberosRequestorSecurityToken" in the file data, indicating a potential Kerberos exploit for credential theft delivery. The detection is focused on traffic flowing from the server to the client.
This rule detects potential thread hijacking attempts by looking for the presence of specific Windows API calls, 'SuspendThread' and 'SetThreadContext', within HTTP client-to-server traffic. These API calls are commonly used in thread hijacking techniques to manipulate the execution flow of a legitimate process, often to inject and execute malicious code. The rule specifically looks for these strings within file data transmitted over HTTP, suggesting an attempt to deliver a payload that utilizes these functions.
This rule detects potential command and control (C2) communication where data is hidden within image files using steganography. It specifically looks for HTTP responses (flow:to_client) containing JPEG image headers ('FF D8 FF') within the first 3 bytes, with a file size greater than 500,000 bytes. A threshold is applied to trigger an alert if 5 such events occur from the same destination within 60 seconds, indicating a potential high volume of large steganographic image transfers.
This rule detects the delivery of a payload via HTTP that contains junk code padding and appears to be an executable file. Specifically, it looks for the byte sequence '90 90 90 90 90 90 90 90 90 90' (often used as NOPs for padding or obfuscation) followed by the 'MZ' magic bytes at the beginning of a file (indicating a Windows executable). The detection is triggered on HTTP responses flowing to the client.
This rule detects the delivery of a polymorphic engine payload via HTTP. It looks for specific content within the HTTP response body, including the strings "mutate" and "engine" (case-insensitive), and the "MZ" magic bytes at the beginning of the file data, indicating a Windows executable. This combination suggests the download of a polymorphic malware component designed to evade detection.
This rule detects the presence of the string "ReflectiveLoader" in HTTP response bodies, which is indicative of a Reflective DLL Loading payload. Reflective DLL loading is a technique used by attackers to load a DLL into a process without the need for the DLL to be present on disk, often used for defense evasion.
This rule detects the download of a multi-stage Command and Control (C2) stage two payload. It specifically looks for HTTP traffic where the referer header contains 'pastebin', 'github', 'discord', or 'telegram' (case-insensitive) and the file data starts with 'MZ', indicating a Windows executable. This combination suggests a potential malicious download from common code/file sharing platforms often used by attackers for C2 infrastructure.
This rule detects potential command and control (C2) activity where commands are hidden within PNG image files. It specifically looks for HTTP traffic flowing from the server to the client (to_client) that contains the PNG file signature (89 50 4E 47) within the first 4 bytes of the file data, and where the file size is greater than 100,000 bytes. A threshold is applied to trigger an alert if 10 such events occur within 60 seconds from the same destination IP address, indicating a potential high volume of C2 communication disguised as image downloads.
This rule detects an HTML file being served to a client that contains an embedded Base64 encoded executable payload. It specifically looks for the HTML download attribute (<a download=), the 'base64,' string, and the 'TVQAA' string, which is a common signature for the beginning of a Base64 encoded Windows executable (MZ header). The detection is performed on HTTP traffic flowing to the client.
This rule detects HTTP responses containing a payload that appears to be XOR encrypted. It specifically looks for a sequence of at least 200 bytes consisting of non-printable ASCII characters (0x01-0x1f and 0x7f-0xff) within the file data of an HTTP response flowing to the client. This pattern is indicative of XOR encryption, often used by malware to obfuscate its payload.
This rule detects the delivery of a malicious LNK file via HTTP that utilizes icon smuggling. It specifically looks for HTTP responses containing a URI with ".lnk" and the byte sequence "|4C 00 00 00|" at the beginning of the file data, which is characteristic of LNK files. Icon smuggling is a defense evasion technique where a malicious file disguises itself with a legitimate icon to trick users into executing it.
Page 14 of 27