Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5 detections
Filters
Last updated
All Time
Detection languages
3
1
1
Contributors
4
1
Categories
3
3
2
2
2
Platforms
3
2
1
Products / Services
3
1
1
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
IDS Classtypes
3
IDS Protocols
2
1
Detects a banking trojan invoking SendInput, mouse_event, keybd_event, or related APIs to control the victim session. The rule specifically looks for process events where the filename matches common RAT names (banana, client, update, service) and the command line contains API calls related to input injection.
Detects HID keystroke injection attacks from hardware implants
This rule detects the string "xdotool" within an SSH session (port 22) traffic flowing from the client to the server. xdotool is a command-line tool that simulates keyboard input and mouse activity, often used for automated input injection. Detection of this string suggests an attempt to automate actions within an SSH session, which could be indicative of malicious activity such as automated command execution or data exfiltration.
This rule detects potential HID (Human Interface Device) keystroke injection attacks via USB emulation. It specifically looks for HTTP client body content containing both the terms 'keyboard' and 'inject' (case-insensitive). This pattern suggests an attempt to simulate keyboard input, often associated with devices like 'BadUSB' or 'Rubber Ducky' that emulate a keyboard to deliver malicious keystrokes.
This rule detects HTTP traffic containing the string "duckyScript" in the file data, indicating a potential payload delivery page associated with OMG Cables or Rubber Ducky devices. These devices are often used for injecting malicious keystrokes or other payloads.