Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
565 detections
Filters
Last updated
All Time
Detection languages
464
49
14
12
11
Contributors
217
119
88
54
41
Categories
20,443
11,831
5,875
5,151
4,864
565
Platforms
495
55
21
17
14
Products / Services
468
195
64
23
14
MITRE Techniques
180
93
66
63
60
CVEs
4
4
4
4
3
IDS Classtypes
303
37
23
23
21
IDS Protocols
449
3
This rule detects HTTP responses (flow:to_client) that contain specific strings indicative of an environment-keyed payload checking the domain before execution. Specifically, it looks for the case-insensitive strings "GetComputerNameEx" and "NetworkDomain" within the file data of the HTTP response. This behavior is often associated with malware attempting to determine its execution environment to evade analysis or target specific systems.
This rule detects HTTP responses from a server to a client that contain specific strings ('ComputerName', 'UserName', and 'MZ') within the file data. The presence of 'MZ' at the beginning (depth:2) suggests an executable file. The combination of these strings indicates a potential 'guardrail' payload checking the environment (computer name and user name) before executing, which is a common technique used by malware to evade analysis environments or target specific systems. The rule is designed to identify trojan activity related to defense evasion.
This rule detects the installation of a root certificate via an HTTP response. It specifically looks for HTTP traffic flowing from the server to the client (to_client, established) where the URI contains ".cer" (case-insensitive) and the file data contains the string "-----BEGIN CERTIFICATE-----". This combination suggests a certificate file being delivered over HTTP, which could be indicative of a malicious root certificate installation attempt, often used in man-in-the-middle attacks or to establish persistence for malware.
This rule detects attempts to replace system binaries via malicious updates by inspecting HTTP responses. It specifically looks for HTTP traffic directed to the client, containing a file with the 'MZ' header (indicating a Windows executable) and a URI path that suggests a system binary location (e.g., /bin/, /sbin/, /usr/bin/). This combination indicates a potential malicious update delivering an executable to a critical system directory.
This rule detects the use of SVG files for HTML smuggling payloads. Specifically, it looks for HTTP responses containing an SVG file ('.svg' in the URI) that also contain '<script' and 'Blob(' within its data. This combination is indicative of an HTML smuggling technique where malicious content is hidden within a seemingly innocuous SVG file and then processed by JavaScript to construct a malicious payload, often a file download.
This rule detects potential malware payloads encrypted with RC4. It specifically looks for HTTP responses (flow:to_client,established) containing the string "RC4" (case-insensitive) and a long base64-like string (at least 100 characters, optionally ending with padding) within the file data. This combination suggests an RC4-encrypted payload being delivered to a client.
This rule detects when a bootloader file is delivered via HTTP. It specifically looks for HTTP responses (flow:to_client) where the URI contains keywords like 'bootloader', 'grub', 'bootmgr', or 'mbr' (case-insensitive) and the file data contains the magic bytes '|55 AA|', which often indicate the end of a boot sector or a master boot record.
This rule detects attempts to masquerade an executable file as a PDF document during an HTTP download. It specifically looks for HTTP responses where the 'Content-Type' header is set to 'application/pdf', but the actual file data begins with the 'MZ' magic bytes, indicating it is a Windows executable.
This rule detects the delivery of a payload via HTTP that contains the string "SetWindowsHookEx" (case-insensitive). This string is associated with a Windows API function used to install a hook procedure that monitors system events. Attackers often use this technique for persistence or to inject malicious code into other processes.
This rule detects potential process argument spoofing attempts by looking for specific strings within HTTP traffic. It specifically searches for 'CreateProcessW' and 'lpCommandLine' in the file data of HTTP responses, indicating that a client might be receiving a payload designed to create a process with spoofed command-line arguments. This technique is often used by malware to hide its true intentions or evade detection.
This rule detects the delivery of a Compiled HTML Help (CHM) file via HTTP that contains the string "ITSF" within its file data. CHM files can be used to deliver malicious content, and the presence of "ITSF" (likely indicating an InfoTech Storage Format header) combined with HTTP delivery suggests a potential attempt to bypass security controls or execute malicious code. This is often associated with T1218.001 (Signed Binary Proxy Execution: Compiled HTML Help) from the MITRE ATT&CK framework.
This rule detects attempts to hijack the clipboard on a web page by identifying HTTP responses (flow:to_client) that contain both 'clipboardData' and 'setData' (case-insensitive) in the file data. This combination of keywords suggests a script attempting to read from and write to the client's clipboard, which is a common technique for clipboard hijacking.
This rule detects HTTP traffic where a shortened URL (from services like bit.ly, tinyurl, ow.ly, or t.co) is used in the HTTP referer header, and the HTTP response body contains the 'MZ' magic bytes, indicating a Windows executable file. This combination suggests a malicious redirect leading to the download of a payload, often associated with phishing or drive-by download attacks.
This rule detects attempts by users to download fake software cracks, keygens, activators, patches, or serials from HTTP servers. It specifically looks for HTTP responses containing URIs with keywords like 'crack', 'keygen', 'activator', 'patch', or 'serial' (case-insensitive) and verifies that the downloaded file data starts with 'MZ', indicating a Windows executable. This combination suggests a user is downloading potentially malicious software disguised as a legitimate software cracking tool.
This rule detects the delivery of potentially malicious Flash (.swf) or Java (.jar, .class) files over HTTP. It specifically looks for HTTP responses where the URI ends with one of these extensions and the file data begins with 'MZ', which is the magic number for Windows executable files. This combination suggests an attempt to disguise an executable as a Flash or Java file, likely for exploit delivery.
This rule detects potential browser exploit delivery via heap spray techniques. It specifically looks for a sequence of 12 NOP (No Operation) instructions (0x90) in HTTP response data flowing to a client. This pattern is commonly used in heap spray attacks to prepare memory for shellcode execution.
This rule detects the presence of the string 'document.write(unescape(' in HTTP response bodies. This pattern is commonly used in web-based attacks to inject malicious content, often obfuscated, into legitimate web pages served to clients. The 'flow:to_client,established' indicates that the rule is looking at traffic flowing from the server to the client over an established connection, specifically within the HTTP data payload ('file.data'). The 'nocase' option ensures the detection is case-insensitive.
This rule detects HTTP responses that appear to be phishing pages designed to capture credentials. It specifically looks for HTTP traffic flowing to the client that contains both the words "password" and "submit" (case-insensitive) in the file data, and where the HTTP host is an IP address. This combination suggests a credential input form on a page served from an IP address, which is a common characteristic of phishing attempts.
This rule detects HTTP responses containing a PDF file that also includes the string "/URI" and "login" (case-insensitive). This combination is indicative of a malicious PDF credential phishing page being served to a client. The rule specifically looks for the PDF magic bytes at the beginning of the file data.
This rule detects the delivery of a JavaScript payload that has been hex encoded. It specifically looks for the hex representation of the string "script" (\x73\x63\x72\x69\x70\x74) within HTTP response data flowing to the client. This technique is often used by attackers to obfuscate malicious JavaScript code and evade signature-based detection.
This rule detects the delivery of a kernel exploit via HTTP. It specifically looks for HTTP responses (flow:to_client) containing a file with the 'MZ' header (indicating a Windows executable) and the string 'exploit' (case-insensitive) in the HTTP URI. This combination suggests an attempt to deliver a malicious executable, potentially a kernel exploit, to a client system.
Page 17 of 27