Every published rule

This rule detects direct access to raw pastes in different paste services frequently used by malware in their second stages to download hostile code in encrypted or encoded form

This rule detects Baby Shark C2 Framework default communication patterns

This rule detects anomalous user agent strings used in APT malware in proxy logs

This rule detects User Agent strings that end with an equal sign, that can be a sign of base64 encoding.

This rule detects anomalous user agent strings used by malware in proxy logs

This rule detects source code enumeration that use GET requests by keyword searches in URL strings

This rule detects certain strings in the uri_query field when combined with null referer and null user agent can indicate behavior linked with the webshell ReGeorg.

This rule detects the use of rclone, a command-line program to manage files on cloud storage, via its default user-agent string

This rule detects executable downloads from anomalous remote systems

This rule detects POST requests to the F5 BIG-IP iControl Rest API "bash" endpoint, which enables the execution of commands on the BIG-IP

This rule detects a flashplayer update from an unofficial location

This rule detects XSS attempts injected via GET requests in access logs

This rule detects the update check performed by Advanced IP/Port Scanner utilities.

This rule detects user agent and URI paths used by empire agents

This rule detects a segmentation fault error message caused by a crashing apache worker process

This rule detects Bitsadmin connections to domains with uncommon TLDs

This rule detects known anomalous (default) user-agents related to scanning/recon tools

This rule detects path traversal exploitation attempts

This rule detects connections to interplanetary file system (IPFS) containing a user's email address which mirrors behaviours observed in recent phishing campaigns abusing IPFS to host credential harvesting webpages.

This rule detects anomalous user agent strings user by hack tools in proxy logs