Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,421 detections
Filters
Last updated
All Time
Detection languages
4,217
105
40
25
13
Contributors
1,327
1,003
725
627
332
Categories
2,253
2,239
1,434
1,144
973
Platforms
4,107
453
295
83
82
Products / Services
10,677
9,759
6,693
4,421
3,749
MITRE Techniques
886
774
552
505
456
CVEs
18
12
12
12
10
IDS Classtypes
1,868
466
446
362
230
IDS Protocols
2,366
846
388
301
93
This rule detects attempts to modify or delete Multi-Factor Authentication (MFA) provider configurations via the Microsoft Graph API. Specifically, it looks for HTTP DELETE requests to 'graph.microsoft.com' with a URI containing 'authentication'. This activity could indicate an attacker attempting to disable or alter MFA settings to gain unauthorized access or maintain persistence.
This rule detects attempts to block defender access by holding a file or resource lock. Specifically, it looks for TCP traffic on port 445 (SMB) containing the string "LockFile" in a case-insensitive manner. A threshold of 10 occurrences within 10 seconds from the same source IP is set to trigger an alert, indicating potential malicious activity aimed at hindering security software.
This rule detects attempts to change the power plan on a system via a remote web shell. It specifically looks for HTTP requests containing 'powercfg' and 'setactive' in the URI, indicating the use of the 'powercfg /setactive' command, which is used to change the active power scheme. This activity suggests an attacker might be trying to manipulate system power settings, potentially for persistence or to interfere with system operations.
This rule detects the delivery of a potential autostart payload as a startup script over HTTP. It looks for HTTP URIs containing keywords like 'startup', 'autostart', or 'autorun' (case-insensitive) and checks the file data for the 'MZ' header, indicating an executable file, within the first 2 bytes of the file content. This combination suggests an attempt to deliver an executable that could be configured for persistence.
This rule detects the creation of a Docker container via the Docker API (port 2375) where the container body content includes the string "cron" (case-insensitive). This could indicate an attempt to establish persistence or schedule malicious tasks within a Docker environment.
This rule detects the download of obfuscated JavaScript code that uses 'eval(String.fromCharCode(' to execute content. This pattern is commonly used by malware to hide malicious scripts, often acting as a stager to download and execute further payloads. The detection specifically targets HTTP responses (flow:to_client) containing this string, indicating a client is receiving such obfuscated code.
This rule detects the delivery of a Node.js reverse shell payload over HTTP. It looks for HTTP responses (flow:to_client) containing the strings "require('net')" and "connect(" (case-insensitive), which are indicative of Node.js code attempting to establish a network connection, often for a reverse shell.
This rule detects the download of a Python script that contains code indicative of operating system command execution. Specifically, it looks for the strings "os.system(" and "subprocess" within HTTP response data, suggesting the script intends to execute system commands.
This rule detects email attachments with VBScript extensions (.vbs, .vbe) delivered via SMTP. It specifically looks for the filename attribute in the email flow to the server, indicating a potential malicious script delivery.
This rule detects the delivery of malicious VBScript macros within Office files over HTTP. It specifically looks for the presence of 'CreateObject' and 'WScript.Shell' strings in the file data, which are commonly used by VBScript macros to interact with the operating system and execute commands.
This rule detects the download of Visual Basic Script (VBS, VBE, VBA) files via HTTP. It specifically looks for HTTP responses where the URI contains file extensions commonly associated with Visual Basic scripts, indicating a potential attempt to deliver malicious scripts to a client system.
This rule detects the transfer of a potentially malicious PDF file containing embedded JavaScript over HTTP. It specifically looks for the PDF file header '%PDF' followed by the string '/JavaScript' within the file data, indicating the presence of JavaScript code within the PDF. This is a common technique used by attackers to execute malicious code when the PDF is opened.
This rule detects the opening of a potentially malicious Office document containing macros. It specifically looks for HTTP traffic where the response body contains both "[Content_Types].xml" and "vbaProject", which are indicators of an Office document (like .docx, .xlsx, .pptx) that includes VBA macros. The 'flow:to_client,established' indicates that the document is being downloaded by a client over an established HTTP connection.
This rule detects the presence of the string "ReflectiveLoader" within HTTP response bodies. This string is commonly associated with Reflective DLL Injection techniques, where a malicious DLL is loaded directly into a process's memory without being written to disk. The detection is case-insensitive and focuses on traffic flowing from the server to the client.
This rule detects attempts to load a DLL module from a remote network path over SMB. It specifically looks for traffic on port 445 (SMB) containing both ".dll" and "\\" (indicating a network path) in a case-insensitive manner. This behavior is often associated with trojan activity or other forms of malicious execution where an attacker might try to load a malicious DLL from a shared network drive.
This rule detects potential shellcode delivery over HTTP by looking for the presence of specific Windows API function names, 'VirtualAlloc' and 'WriteProcessMemory', within the file data of HTTP responses. These API calls are commonly used in shellcode to allocate memory and write malicious code into a process.
This rule detects the download of a CSV file that contains a Dynamic Data Exchange (DDE) attack payload. Specifically, it looks for HTTP responses delivering a file with a '.csv' extension and the string '=HYPERLINK(' within the file data, indicating a potential DDE exploit attempt.
This rule detects attempts to create a remote named pipe over SMB (Server Message Block) protocol. It specifically looks for TCP traffic directed to port 445 (SMB) on the home network, containing both the SMB signature (FF SMB) and the string "\pipe\" (case-insensitive), indicating an attempt to access or create a named pipe. This activity is often associated with inter-process communication, which can be leveraged by attackers for various purposes, including lateral movement, service execution, or privilege escalation.
This rule detects a high volume of Inter-Process Communication (IPC) activity targeting the RPC Endpoint Mapper on the home network. Specifically, it triggers an alert if more than 30 TCP connections to port 135 (RPC Endpoint Mapper) are observed from a single source IP within a 10-second window. This could indicate an attempt to enumerate services or exploit vulnerabilities related to RPC.
This rule detects a payload download after a redirect chain, which is a common technique used in user execution attacks. It specifically looks for HTTP responses containing a redirect pattern in the HTTP referer and then checks for the 'MZ' magic bytes (indicating a Windows executable) in the file data within a short depth. This suggests a user being redirected and then automatically downloading a malicious executable.
This rule detects the download of files that have a 'double extension' pattern, specifically where a common document or image file extension (pdf, doc, jpg, png) is followed by an executable extension (exe, bat, vbs, ps1). This pattern is often used by attackers to trick users into executing malicious files, as the operating system might only display the first extension, making the file appear benign. The detection is based on analyzing the HTTP URI for this specific naming convention.
Page 184 of 211