Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
696 detections
Filters
Last updated
All Time
Detection languages
332
134
106
55
25
Contributors
115
100
66
62
55
Categories
136
129
107
104
84
Platforms
324
178
85
83
80
Products / Services
134
112
104
52
47
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
CVEs
2
2
2
2
1
IDS Classtypes
48
29
11
7
6
IDS Protocols
66
20
11
6
3
This rule detects the download of a potential post-exploitation framework binary over HTTP. It looks for HTTP responses containing the 'MZ' magic bytes (indicating a Windows executable) and specific keywords like 'beacon', 'agent', 'implant', 'payload', or 'stager' in the HTTP URI. This combination suggests an attempt to deliver malicious tools to a compromised system.
This rule detects the download of known exploit kits by inspecting HTTP URI patterns. It specifically looks for the strings 'rig', 'fallout', 'spelevo', or 'purplefox' followed by 'kit' (case-insensitive) within the HTTP URI. The detection is triggered on traffic flowing to the client that is part of an established connection.
This rule detects HTTP responses that contain hidden keywords, a technique often used in SEO poisoning. It specifically looks for HTML content with 'display:none' and 'font-size:0' which are common methods to hide text from users while still being parsed by search engine crawlers.
This rule detects outbound TCP connections on port 9050, which is commonly used by the Tor anonymity network. The rule is configured to trigger an alert if there are at least 3 such connections from the same source within a 60-second window, indicating potential use of Tor. The message suggests this activity is related to accessing an Initial Access Broker market.
This rule detects potential rogue DNS server activity by monitoring UDP traffic on port 53 (DNS) to the home network. It specifically looks for DNS query responses (indicated by the content "|84 80|") and triggers an alert if 20 such responses are observed from the same source IP within a 30-second window. This behavior could indicate an unauthorized or malicious DNS server attempting to respond to client queries.
This rule detects HTTP network connections to common Cloud Virtual Private Server (VPS) providers (DigitalOcean, Vultr, Linode, Hetzner) where the URI content includes the word 'create'. This combination suggests an attempt to set up new infrastructure, potentially for malicious purposes, aligning with resource development tactics.
Detects download of malware builder or generator tools from code repositories
Detects executables signed with self-signed code certificates for trust bypass
Detects access to platforms selling zero-day vulnerability intelligence
Detects IP geolocation lookups used to determine system geographic location
Detects automated social media account registration used for fake identity infrastructure
Detects the creation of files ending with '.sig', '.asc', or '.cer'. These extensions are commonly associated with digital signatures, PGP/GPG keys, and certificates, which could indicate activities like code signing, certificate generation/import, or PGP/GPG key manipulation by an adversary.
This rule detects a specific HTTP POST request pattern associated with the Mirai botnet's check-in mechanism. It looks for HTTP POST requests to the '/report' URI with a body size between 21 and 99 bytes. A threshold of 10 such requests from the same source within 60 seconds triggers the alert, indicating potential botnet activity.
This rule detects potential automated social media account creation attempts by monitoring HTTP traffic for requests to common social media platforms (twitter.com, x.com, facebook.com) that include 'signup' in the URI. A threshold of 5 such requests within 60 seconds from the same source IP triggers the alert, indicating a possible automated or high-volume registration process.
This rule detects the download of potential proof-of-concept (PoC) exploit code for CVEs. It specifically looks for HTTP responses containing a URI that matches the pattern 'CVE-YYYY-NNNN' (e.g., CVE-2023-1234) and also contains the word 'exploit' in the file data. This combination suggests that a client on the internal network is downloading code related to a known vulnerability, which could be for research, testing, or malicious purposes.
This rule detects attempts to download raw payload files (PowerShell scripts, executables, DLLs, batch files, VBScripts, Python scripts, or shell scripts) from raw.githubusercontent.com. This activity is often associated with adversaries attempting to retrieve malicious tools or scripts from code repositories.
This rule detects attempts to download known exploit framework tools such as Metasploit, Cobalt Strike, Empire, Covenant, Sliver, or Havoc by inspecting HTTP URI content. The detection is based on case-insensitive pattern matching within the HTTP URI.
Payload Download from GitLab Raw
Suricata
This rule detects attempts to download executable or script files (PowerShell, executable, DLL, shell script, Python script) from the 'raw' content section of gitlab.com. This behavior is often associated with adversaries staging or retrieving malicious payloads.
This rule detects outbound TCP connections on port 9050, which is commonly used by the Tor anonymity network. The rule is configured to trigger an alert if there are at least 3 such connections from the same source within a 60-second window, indicating potential use of Tor. The message suggests this activity is related to accessing an Initial Access Broker market.
This rule detects HTTP requests to known dedicated server rental providers (ovh.com, leaseweb.com, servermania.com) where the URI contains the word 'order'. This activity could indicate an adversary attempting to rent infrastructure for attack purposes, such as command and control servers, phishing sites, or other malicious operations.
This rule detects a drive-by download attempt initiated via a malicious advertisement. It specifically looks for HTTP responses to clients where the HTTP referer header contains common advertisement-related keywords (ad., ads., advert) and the response body contains the 'MZ' magic bytes, indicating an executable file download. This combination suggests a user was redirected from an advertisement to a site that then attempted to download an executable.
Page 13 of 34