Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,937 detections
Filters
Last updated
All Time
Detection languages
1,930
3
2
1
1
Contributors
592
477
360
250
124
Categories
995
927
834
546
538
Platforms
1,753
214
81
54
41
Products / Services
1,868
1,144
65
51
17
MITRE Techniques
564
412
305
201
175
CVEs
4
4
4
2
2
IDS Classtypes
1,937
503
461
381
236
IDS Protocols
1,098
362
201
171
37
This rule detects modifications to the 'com.apple.loginwindow' content over a TCP connection to port 22 (SSH). This content is associated with macOS's re-opened applications list, which can be manipulated by adversaries to establish persistence by ensuring malicious applications are launched after a user logs in or a system restarts. The detection specifically looks for the string 'com.apple.loginwindow' in the traffic, indicating an attempt to interact with or modify this critical system component.
This rule detects the delivery of potentially malicious kernel modules or extensions over HTTP. It specifically looks for HTTP responses containing files with '.ko' (Linux kernel object) or '.kext' (macOS kernel extension) file extensions in the URI, indicating a client is downloading such a file. The 'flow:to_client,established' ensures the detection occurs on files being sent from a server to a client over an established HTTP connection.
This rule detects an attempt to exploit an unquoted service path vulnerability via an SMB file drop. Specifically, it looks for SMB traffic to port 445 on the home network containing the strings "Program Files" and ".exe" (case-insensitive). This pattern suggests an attacker might be dropping an executable file into a directory within "Program Files" that is part of an unquoted service path, which could lead to arbitrary code execution upon service restart.
This rule detects attempts to exploit DLL Search Order Hijacking vulnerabilities by monitoring SMB network traffic for requests containing '.dll' and '\AppData\' in the content. This pattern suggests an attacker might be attempting to drop a malicious DLL into a user's AppData directory on a network share, which could then be loaded by a legitimate application due to search order vulnerabilities, leading to persistence or execution of malicious code.
This rule detects attempts to hijack the PATH environment variable during an SSH session. It specifically looks for the string "export PATH=" within TCP traffic on port 22 (SSH), indicating a potential malicious modification of the PATH environment variable to control command execution paths.
This rule detects attempts to hijack the dynamic linker's LD_PRELOAD mechanism over an SSH connection. It specifically looks for the string "LD_PRELOAD" within TCP traffic on port 22 (SSH). This technique is often used by attackers for persistence or privilege escalation by injecting malicious libraries into legitimate processes.
This rule detects attempts to hijack macOS applications using malicious dynamic libraries (DYLIBs). It specifically looks for HTTP responses containing a URI with the ".dylib" extension and the content "__TEXT" within the file data, indicating a Mach-O executable segment. This combination suggests the delivery of a potentially malicious dynamic library designed for hijacking purposes on macOS systems.
This rule detects the HTTP download of common boot script file types (batch, command, shell, PowerShell) that contain the string 'HKLM' (HKEY_LOCAL_MACHINE). This combination suggests an attempt to establish persistence or execute malicious code by modifying system-wide registry settings, often associated with trojan activity. The detection is based on the file extension in the URI and the content within the downloaded file's data.
This rule detects network traffic on port 445 (SMB) containing the strings "services.exe" and "ImagePath" (case-insensitive). This combination suggests an attempt to hijack the execution flow of a service by replacing its binary, specifically targeting the 'services.exe' process, which is a critical Windows component. The rule is designed to identify trojan activity related to persistence mechanisms.
This rule detects attempts to modify the shared library configuration file '/etc/ld.so' over an SSH connection. This activity is indicative of a shared library hijacking technique, often used for persistence or privilege escalation, where an attacker modifies the system's library loading paths to inject malicious libraries. The detection specifically looks for the string "/etc/ld.so" within TCP traffic destined for port 22 (SSH) on the home network.
This rule detects when an executable file (.exe) is dropped into a Windows 'Start Menu\Programs\Startup' folder via Server Message Block (SMB). This is a common technique used by attackers to establish persistence on a compromised system, ensuring that their malicious code runs every time the user logs in or the system starts.
This rule detects when a system daemon configuration file, specifically one containing ".service" in its URI and "[Service]" in its content, is delivered via HTTP from any source to the internal network. This could indicate an attempt to establish persistence or modify system services on a compromised host.
This rule detects the download of ISO, IMG, VHD, or VHDX files over HTTP that are larger than 500KB. These file types are often used as containers for malware delivery, allowing attackers to bypass traditional file-based security controls by embedding malicious executables or scripts within disk images.
This rule detects potential HID (Human Interface Device) keystroke injection attacks via USB emulation. It specifically looks for HTTP client body content containing both the terms 'keyboard' and 'inject' (case-insensitive). This pattern suggests an attempt to simulate keyboard input, often associated with devices like 'BadUSB' or 'Rubber Ducky' that emulate a keyboard to deliver malicious keystrokes.
This rule detects attempts to download executable files disguised as common media file types (MP4, MP3, AVI, MOV) over HTTP. It specifically looks for the 'MZ' header, which indicates a Windows executable, within the first two bytes of the file data, combined with a URI ending in a media file extension. This technique is often used by attackers to bypass security controls and trick users into executing malicious payloads.
This rule detects attempts to abuse an IoT device's firmware update page by sending a large POST request containing the word "firmware" (case-insensitive) to TCP port 80 on the home network. This activity is indicative of an attempt to corrupt the device's firmware, potentially leading to denial of service or unauthorized control.
This rule detects attempts to remotely lock out user accounts via SMB (Server Message Block) by looking for specific content within TCP traffic on port 445. It specifically targets the 'NetUserSetInfo' function call, which can be used to modify user account properties, in conjunction with the keyword 'lockout'. This combination suggests an attacker is attempting to trigger a mass account lockout.
This rule detects potential C2 beaconing activity over HTTP. It specifically looks for HTTP GET requests where the URI path consists of 8 to 16 lowercase alphanumeric characters. The rule uses a threshold of 20 such requests within 60 seconds from the same source IP address to identify beaconing behavior.
This rule detects attempts to replace cryptocurrency wallet addresses within HTTP POST requests. It specifically looks for patterns matching Bitcoin (P2PKH, P2SH, Bech32) and Ethereum (0x) wallet addresses in the client body of HTTP POST requests. This activity is indicative of clipboard hijacking or similar malware that aims to redirect cryptocurrency transactions to an attacker's wallet.
This rule detects potential tampering with financial transaction data during transit. It specifically looks for TCP traffic flowing to a server, where the data size is between 100 and 500 bytes, and the content contains both "amount" and "transfer" (case-insensitive). This combination suggests an attempt to modify financial transaction details.
This rule detects the use of AMQP (Advanced Message Queuing Protocol) on port 5672, specifically looking for the 'AMQP' content within the first 4 bytes of the TCP payload. It triggers an alert if this pattern is observed 5 times within 60 seconds from the same source IP, indicating potential Command and Control (C2) activity using AMQP as a communication channel.
Page 78 of 93