Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,937 detections
Filters
Last updated
All Time
Detection languages
1,930
3
2
1
1
Contributors
592
477
360
250
124
Categories
995
927
834
546
538
Platforms
1,753
214
81
54
41
Products / Services
1,868
1,144
65
51
17
MITRE Techniques
564
412
305
201
175
CVEs
4
4
4
2
2
IDS Classtypes
1,937
503
461
381
236
IDS Protocols
1,098
362
201
171
37
This rule detects DNS queries to known dynamic DNS services that are frequently abused by C2 infrastructure. Specifically, it looks for queries ending in '.duckdns.org', '.no-ip.com', '.ddns.net', '.hopto.org', or '.zapto.org'. A threshold of 5 queries within 60 seconds from the same source IP is applied to reduce false positives.
This rule detects HTTP traffic where the 'Host' header contains common Content Delivery Network (CDN) domains (cloudfront.net, azureedge.net, fastly.net, cloudflare.net) and the 'X-Forwarded-Host' header is also present. This pattern can indicate C2 infrastructure attempting to hide behind CDN fronting, a technique used by adversaries to obscure the true origin of their command and control servers.
This rule detects potential command and control (C2) communication over TCP that uses AES encryption with a hardcoded key pattern. It specifically looks for the byte sequence "41 45 53" (which corresponds to the ASCII string "AES") within the payload of a TCP flow from the internal network to any external destination. The rule further refines detection by checking for a payload size between 100 and 500 bytes and applies a threshold of 20 occurrences within 60 seconds from the same source IP to reduce false positives. This pattern is indicative of certain malware families that use predictable AES keying for their C2 channels.
This rule detects when an executable file (.exe) is dropped into a shared network folder. It specifically looks for SMB traffic containing both ".exe" and "\\share\\" in the content, indicating a potential attempt to distribute malicious executables or move them laterally within a network.
This rule detects potential session hijacking attempts by monitoring HTTP traffic for unusually long cookie values. Specifically, it looks for HTTP cookies containing base64-like strings (alphanumeric characters, plus, slash, and equals signs) that are 100 characters or longer. A threshold of 5 such occurrences within 3 seconds from the same destination IP address triggers the alert, indicating a possible attempt to use a stolen browser session cookie.
This rule detects potential browser session token injection via a Man-in-the-Middle (MitM) attack. It looks for HTTP responses (flow:to_client) that contain the strings "document.cookie", "=", and "XMLHttpRequest" (case-insensitive) within the file data. The combination of these strings in a client-bound HTTP response suggests an attempt to manipulate browser cookies, possibly to inject session tokens, often seen in MitM scenarios where an attacker intercepts and modifies traffic to compromise user sessions.
This rule detects the exfiltration of a custom XOR-compressed archive over HTTP. It specifically looks for HTTP POST requests originating from the home network, containing file data, with a payload size greater than 10000 bytes, and a PCRE match for a sequence of at least 200 non-ASCII or control characters, which is indicative of XOR-compressed binary data.
This rule detects the exfiltration of browser bookmarks over HTTP POST requests. It specifically looks for HTTP POST requests where the client body contains the string "Bookmarks" (case-insensitive) and the data size is greater than 500 bytes. This pattern is indicative of an attacker or malware attempting to steal a user's browser bookmarks.
This rule detects potential sandbox evasion techniques by identifying HTTP traffic (specifically client-to-server responses) that contains both 'GetCursorPos' and 'Sleep' within the file data. This combination is often used by malware to check for user interaction (mouse movement) and introduce delays, which can indicate an attempt to determine if it's running in a sandboxed environment.
This rule detects network traffic (specifically HTTP responses) that contains patterns indicative of malware attempting to prevent double execution using mutexes. It looks for the strings "CreateMutex" and "ALREADY_EXISTS" (case-insensitive) within the file data of the HTTP response. This behavior is common in malware to ensure only one instance of itself is running on a system, often as a defense evasion technique.
This rule detects the download of executable files (EXE, DLL, BIN) over HTTP that appear to be stripped of their standard headers. It specifically looks for the 'MZ' magic bytes at the beginning of the file data, indicating a Windows executable, but then implies a lack of full header structure by the 'Stripped Executable Payload Without Headers' message. The rule also requires the file size to be greater than 10000 bytes.
This rule detects HTTP responses containing SVG (Scalable Vector Graphics) content that also embeds base64 encoded data starting with 'TVQAA'. This specific sequence ('TVQAA') is characteristic of a base64 encoded Windows executable (MZ header). The rule aims to identify a technique known as SVG smuggling, where malicious executables are hidden within SVG files and delivered to clients, often as a defense evasion tactic.
This rule detects attempts to remotely disable the Windows Event Log service over SMB (port 445). It specifically looks for TCP traffic to port 445 on the home network, containing the case-insensitive strings "EventLog" and "StopService". This activity is indicative of an attacker trying to hinder forensic analysis or evade detection by stopping logging services.
This rule detects HTTP responses that contain a URI with a double extension, where the first extension is a common document or image file type (doc, pdf, jpg, png, txt) and the second extension is an executable or script file type (exe, bat, vbs, ps1, cmd). This pattern is often used in file masquerading to trick users into executing malicious files.
This rule detects attempts to submit a Dockerfile containing 'FROM' and 'RUN' instructions to the Docker API via an HTTP POST request to the '/build' endpoint. This activity could indicate an attacker attempting to build a malicious Docker image on a compromised Docker host.
This rule detects attempts to modify macOS Plist files over an SSH connection. Specifically, it looks for TCP traffic on port 22 (SSH) where the payload contains both '/Library/Preferences/' and '.plist' (case-insensitive). This activity is flagged as potential defense evasion, as modifying Plist files can be used to alter system behavior or application settings to evade security mechanisms.
This rule detects the delivery of a CMSTP INF file over HTTP that contains specific content indicative of a User Account Control (UAC) bypass attempt. It looks for HTTP responses containing a URI with ".inf", and within the file data, the strings "[DefaultInstall]" and "RegisterOCXs". This combination suggests an attempt to leverage CMSTP (Connection Manager Profile Installer) to execute arbitrary code, often used by adversaries for defense evasion and privilege escalation.
This rule detects the download of a Microsoft Management Console (MMC) snap-in file (.msc) over HTTP that also contains the string "MMCVersion". This combination is often used by attackers to execute malicious code or establish persistence, leveraging the trusted nature of MMC snap-ins. The rule specifically looks for the file extension in the URI and the 'MMCVersion' string within the file's data, indicating a potential malicious MMC snap-in being delivered via HTTP.
This rule detects attempts to grep for passwords within the bash history file over an SSH connection. Specifically, it looks for the string 'grep -i password ~/.bash_history' in TCP traffic destined for port 22 (SSH). This activity is indicative of an attacker attempting to discover credentials on a compromised system.
This rule detects potential exfiltration of password manager database files over HTTP. It specifically looks for HTTP POST requests with a URI containing common password manager names (keepass, lastpass, 1password, bitwarden) and a data size greater than 1000 bytes. This combination suggests a large file, potentially a database, is being uploaded.
This rule detects attempts to harvest Slack messages for credential tokens by monitoring HTTP requests to slack.com with the URI '/conversations.history'. A threshold of 20 such requests within 60 seconds from the same source IP triggers the alert, indicating potential automated data exfiltration or reconnaissance.
Page 64 of 93