Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
565 detections
Filters
Last updated
All Time
Detection languages
464
49
14
12
11
Contributors
217
119
88
54
41
Categories
20,443
11,831
5,875
5,151
4,864
565
Platforms
495
55
21
17
14
Products / Services
468
195
64
23
14
MITRE Techniques
180
93
66
63
60
CVEs
4
4
4
4
3
IDS Classtypes
303
37
23
23
21
IDS Protocols
449
3
This rule detects when an executable file is embedded within an Office document that is being downloaded over HTTP. It specifically looks for the presence of both the Office document content type indicator "[Content_Types].xml" and the "MZ" magic bytes, which signify a Windows executable, within the same file data stream. This combination is a strong indicator of a malicious Office document attempting to deliver malware.
This rule detects the download of a compressed executable payload over HTTP. It specifically looks for HTTP traffic flowing to the client that contains both the GZIP magic number (1F 8B) and the Windows executable magic number (MZ) within the file data. This combination suggests a compressed executable file being delivered, which is a common technique used by malware to evade detection.
This rule detects when an executable file is masquerading as an image file during an HTTP download. It specifically looks for HTTP responses with a 'Content-Type: image/' header, but where the file data begins with 'MZ', which is the magic number for Windows Portable Executable (PE) files. This indicates a potential attempt to bypass security controls by disguising malicious executables as benign image files.
This rule detects HTTP responses from a server to a client that contain the phrase "Your computer is infected" (case-insensitive). This is indicative of a fake security alert page, often used in social engineering attacks to trick users into downloading malware or providing credentials. The rule specifically looks for this content within the file data of an established HTTP flow directed to the client.
This rule detects the delivery of a Microsoft Installer (MSI) package via HTTP that exhibits characteristics of a malicious file. It specifically looks for HTTP responses (flow:to_client) containing a URI with the ".msi" extension (http.uri; content:".msi"; nocase;) and the magic bytes "D0 CF 11 E0" (content:"|D0 CF 11 E0|"; depth:4;) which are indicative of an OLE2 compound document file format, commonly used by MSI files. The rule classifies this activity as 'trojan-activity'.
This rule detects the presence of anti-debugging techniques within HTTP payload data. Specifically, it looks for the strings "IsDebuggerPresent" and "ExitProcess" (case-insensitive) in the HTTP response body. The combination of these strings suggests that a malicious payload might be checking for a debugger and attempting to terminate if one is detected, a common defense evasion technique used by malware.
This rule detects the delivery of a fake GUI login prompt over HTTP, likely for credential capture. It looks for HTTP responses (flow:to_client) containing the strings "ShowDialog", "Password", and "GetWindowText" (case-insensitive) within the file data. This combination of keywords suggests an attempt to mimic a legitimate login interface to trick users into providing their credentials.
This rule detects attempts at token impersonation by looking for the strings "ImpersonateLoggedOnUser" and "DuplicateTokenEx" within HTTP response bodies. This technique is often used by attackers to elevate privileges by impersonating a logged-on user's security token.
This rule detects the delivery of a token manipulation tool over HTTP. It specifically looks for the presence of the strings "AdjustTokenPrivileges" and "OpenProcessToken" (case-insensitive) within the file data of an HTTP response. These strings are associated with Windows API calls used for modifying process tokens, which is a common technique for privilege escalation.
This rule detects the download of Office template files (such as .dot, .dotm, .xlt, .xltm, .pot, .potm) that contain VBA project content. This is indicative of potentially malicious Office documents designed to execute macros, often used for initial access or persistence by attackers.
This rule detects attempts to force the installation of browser extensions via a policy page. It specifically looks for the string "ExtensionInstallForcelist" in HTTP response data flowing to the client, indicating a mechanism used to programmatically install extensions, often abused by malware or unwanted programs to maintain persistence or inject malicious functionality into browsers.
This rule detects the download of a Chrome extension file (.crx) from an HTTP server to a client. It specifically looks for the string ".crx" in the HTTP URI and the string "CrOD" within the first 4 bytes of the file data, which is a common magic number for Chrome extension files. This combination suggests a potential malicious Chrome extension download, often used for persistence or other malicious activities.
This rule detects the delivery of a Lua script payload via HTTP. It specifically looks for HTTP responses containing '.lua' in the URI and the string 'os.execute(' within the file data, indicating an attempt to execute commands on the client system. This is often associated with trojan activity.
This rule detects HTTP traffic that appears to be a fake IT helpdesk page attempting to host a remote tool. It looks for the keywords "helpdesk", "download", and "remote" (case-insensitive) within the file data of HTTP responses. This combination of keywords suggests a social engineering attempt to trick users into downloading and executing remote access software under the guise of IT support.
This rule detects the download of a potentially malicious browser extension in CRX format. It specifically looks for HTTP responses containing ".crx" in the URI and the string "CrOD" within the first 4 bytes of the file data, indicating a Chrome extension download. This could be an attempt to install a malicious extension for persistence or other adversarial activities.
This rule detects potential banking web inject form overlays by looking for specific keywords in HTTP response data. It triggers when an HTTP response contains 'account_number', 'routing_number', and 'XMLHttpRequest' (all case-insensitive). This combination of keywords suggests an attempt to inject malicious forms into a legitimate banking website to steal credentials or financial information.
This rule detects the delivery of a potential ransomware MBR (Master Boot Record) wiper payload via HTTP. It specifically looks for HTTP responses containing file data that starts with the byte sequence '55 AA' (which often indicates a boot sector or MBR) and also contains 'MZ' (the DOS executable signature), with a file size greater than 10,000 bytes. This combination suggests a malicious executable designed to overwrite the MBR, a common tactic used by certain types of ransomware or disk wipers.
This rule detects HTTP traffic containing the strings "LogonUserA" and "ImpersonateLoggedOnUser" (case-insensitive) in the file data. This combination of strings suggests an attempt to create a token for impersonation, which is a technique used for privilege escalation, specifically related to the MITRE ATT&CK technique T1134.003 (Token Impersonation/Theft: Impersonation). The rule is designed to identify shellcode or malicious code attempting to leverage these Windows API functions for privilege escalation.
This rule detects the delivery of a payload containing the strings "Office Test" and "HKCU" over HTTP, indicating an attempt to modify the registry for persistence, potentially related to Office applications. The detection is based on inspecting file data within HTTP traffic flowing to the client.
This rule detects attempts to inject a malicious URL into the Outlook Home Page setting for persistence. It specifically looks for HTTP traffic (flow:to_client,established) containing the strings "HomePageURL" and "http" (case-insensitive) in the file data, indicating a potential attempt to modify Outlook's home page setting to point to an attacker-controlled URL.
This rule detects the delivery of a potential rootkit payload via HTTP download. It specifically looks for HTTP responses (flow:to_client) where the URI contains keywords like 'rootkit', 'rkill', 'kernel.module', or 'lkm' (case-insensitive) and the file data starts with 'MZ', indicating a Windows executable.
Page 16 of 27