Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,937 detections
Filters
Last updated
All Time
Detection languages
1,930
3
2
1
1
Contributors
592
477
360
250
124
Categories
995
927
834
546
538
Platforms
1,753
214
81
54
41
Products / Services
1,868
1,144
65
51
17
MITRE Techniques
564
412
305
201
175
CVEs
4
4
4
2
2
IDS Classtypes
1,937
503
461
381
236
IDS Protocols
1,098
362
201
171
37
This rule detects network traffic indicating the deletion of a persistence registry key, specifically 'CurrentVersion\\Run', after an execution. It looks for TCP traffic to the home network on port 445 (SMB) containing both 'CurrentVersion\\Run' and 'RegDeleteKey' (case-insensitive). This behavior is often associated with malware attempting to clean up its persistence mechanisms to evade detection.
This rule detects HTTP traffic where the URI contains both "pcalua" and "-a" (case-insensitive). This pattern is indicative of indirect execution via pcalua.exe, a legitimate Windows utility that can be abused by attackers to proxy execution of other programs, often for defense evasion. The rule specifically looks for this behavior in HTTP requests, suggesting an attempt to download or execute a payload indirectly.
This rule detects HTTP requests originating from Microsoft Office Word that are attempting to fetch remote templates with specific file extensions (.dotx, .dotm, .dot). This behavior can be indicative of malicious documents attempting to retrieve external content, often used in phishing or malware delivery campaigns to bypass security controls or fetch additional stages of an attack.
This rule detects the delivery of an Electron application ASAR (Atom Shell Archive) package over HTTP. The detection is based on the presence of '.asar' in the HTTP URI, indicating a potential malicious Electron application being downloaded to a client within the home network. Electron applications are often used for desktop applications and can be exploited if malicious code is embedded within their ASAR packages.
This rule detects attempts to read the 'cpassword' field from Group Policy Preferences XML files over SMB. The 'cpassword' field was historically used to store encrypted passwords, which could be easily decrypted, leading to credential exposure. Detection of this string in SMB traffic indicates an attempt to access or exfiltrate these sensitive credentials.
This rule detects attempts to query the Windows Registry remotely for the 'HKLM\Software\RealVNC' key over TCP port 445 (SMB). This activity is indicative of an attacker attempting to locate stored credentials, specifically those related to RealVNC, which could then be used for further lateral movement or privilege escalation. The detection is based on the presence of the string 'HKLM\Software\RealVNC' in the network traffic.
This rule detects DNS queries that contain non-standard hex-encoded data, which is often indicative of Command and Control (C2) communication. Specifically, it looks for DNS queries where the query name contains a sequence of 32 or more hexadecimal characters (0-9, a-f). This pattern is frequently used by malware to exfiltrate data or receive commands via DNS tunneling, where data is encoded into subdomains.
This rule detects potential air-gap bridging activity via removable media. Specifically, it looks for SMB traffic on port 445 containing the string "USBSTOR" (case-insensitive) and the file extension ".bin" (case-insensitive). This combination suggests a file transfer related to USB storage, possibly a firmware update or a malicious payload, being moved across a network segment, potentially bypassing an air-gapped system.
This rule detects attempts to perform remote DLL injection via UNC path writes over SMB. It specifically looks for SMB traffic to port 445 on the home network, containing ".dll", "\\", and "System32" in a case-insensitive manner. This combination suggests an attempt to write a DLL file to a System32 directory on a remote machine using a UNC path, which is a common technique for DLL injection.
This rule detects the delivery of a malicious PowerShell profile script named 'profile.ps1' via HTTP. The rule specifically looks for the string 'IEX' (Invoke-Expression) within the file data, indicating an attempt to execute arbitrary commands. This technique is often used for persistence, where an attacker modifies a PowerShell profile to execute malicious code every time PowerShell is launched.
This rule detects network traffic on TCP port 445 (SMB) containing the strings "Winlogon" and "Userinit" (case-insensitive). This pattern is indicative of a potential modification to the Winlogon Helper DLL for persistence, as Winlogon and Userinit are key components in the Windows logon process. An attacker might modify a helper DLL to execute malicious code during system startup.
This rule detects the delivery of potentially malicious Microsoft Office startup files (Excel, Word, PowerPoint macro-enabled or binary files) via HTTP. It specifically looks for files with extensions like .xlsb, .xlsm, .docm, .pptm, or .dotm in the HTTP URI and checks for the presence of "vbaProject" content within the file data, indicating the presence of VBA macros which are often used in malicious documents.
This rule detects the delivery of an AppleScript payload over HTTP. It specifically looks for HTTP responses (flow:to_client) that contain the string ".scpt" (case-insensitive) in the HTTP URI. This indicates a potential malicious script being downloaded to a client system, often used for execution on macOS systems.
This rule detects patterns indicative of a USB autorun payload download. Specifically, it looks for HTTP traffic (flow:to_client,established) containing the strings "[autorun]" and "open=" (case-insensitive) within the file data. This combination suggests a client is receiving a file that attempts to leverage the autorun feature, often used by malware for initial execution from removable media.
This rule detects the download of common remote access tools (AnyDesk, TeamViewer, RustDesk, Zoho, Atera, UltraViewer) over HTTP. The detection is triggered when an HTTP response flows to the client, is established, contains a URI, and the URI matches one of the specified tool names using a case-insensitive PCRE. Additionally, the response body size must be greater than 100,000 bytes, indicating a potential executable or installer download. This activity is classified as trojan activity and is associated with the MITRE ATT&CK technique T1566.004 (Phishing: Voice Phishing) and tactic Initial Access, suggesting that the download might occur after a voice phishing call.
This rule detects attempts to push malicious firmware to a device via TFTP (Trivial File Transfer Protocol). It specifically looks for UDP traffic on port 69 (TFTP) where the packet content starts with "|00 02|" (indicating a TFTP write request) and the data size is greater than 10000 bytes, suggesting a firmware image transfer.
This rule detects the creation of an Azure Blob Lifecycle Management rule that is configured for deletion. It specifically looks for HTTP PUT requests to blob.core.windows.net with 'managementPolicies' in the URI, indicating an attempt to define or modify lifecycle policies for Azure Blob Storage, potentially for data deletion.
This rule detects attempts to overwrite the Master Boot Record (MBR) or disk structure using the 'dd' command via a remote SSH connection. Specifically, it looks for the string 'dd if=/dev/zero of=/dev/sda' within TCP traffic on port 22 (SSH). This command, if executed, would wipe the primary disk, leading to system destruction.
This rule detects potential command and control (C2) communication over the MQTT protocol. It specifically looks for TCP traffic on port 1883 (the standard MQTT port) from the home network to any destination. The detection is triggered by the presence of a specific byte sequence ('|10|') at the beginning of the payload, which corresponds to an MQTT PUBLISH message type. A threshold of 5 such messages within 60 seconds from the same source IP is set to reduce false positives, indicating a sustained pattern of MQTT PUBLISH activity that could be indicative of C2.
This rule detects HTTP traffic that attempts to impersonate legitimate browser traffic (specifically Chrome on Safari) for command and control (C2) purposes. It looks for a specific User-Agent pattern that mimics Chrome on Safari and a URI pattern consisting of 8 to 16 lowercase alphanumeric characters. A threshold is applied to prevent excessive alerts, triggering if 20 such events occur within 60 seconds from the same source.
This rule detects obfuscated protocol data in non-standard command and control (C2) channels over TCP. It triggers when TCP traffic flows from the home network to any destination, is established, has a data size between 101 and 499 bytes, and occurs at a high frequency (30 times in 60 seconds from the same source). This pattern is indicative of trojan activity, specifically related to command and control communications.
Page 63 of 93