Detection Rules Library

Every evasion works by expressing identical logic in bytes the blocklist does not contain. That is why detection must operate on normalised fields, and why the actual fix is at the application layer, not the signature layer.

Encoding hides the command from a human reading a command line. It does not hide it from Script Block Logging, which records the deobfuscated content at execution. If you take one thing from this tool, enable 4104.

Chase the decoder, not the encoding. An attacker can encode arbitrarily many ways, but at some point something has to decode it, and that call is a far more stable detection surface.

Port selection defeats port blocking, not behavioural analysis. A server initiating a long-lived outbound connection is backwards, and that stays true no matter which port the attacker picks.

Counting failures per account misses spraying by design. The correct aggregation is distinct accounts per source, and the correct follow-up is joining to the first success from that same source.

Signature validation proves a token was signed with the right key. It says nothing about whether the key was stolen or the token was replayed. Issuance correlation and context binding are what close that gap.

Obfuscation is an anti-human-inspection tactic, not a network-evasion one. The flow log records the same resolved destination no matter how the URL was written, which is exactly why flow data is worth retaining far longer than packet capture.

CSP is usually sold as a prevention control, but its report-uri is a detection feed most teams never wire up. Every blocked injection becomes a structured alert from the browser itself — including DOM-based attacks your server logs cannot see.

A single crafted request is indistinguishable from normal traffic and should not alert. Reconnaissance is a statistical signal, so the detection belongs in aggregation — request cadence, path diversity, and 404 ratio — not in per-request signatures.

This is the clearest demonstration of why normalised-field matching beats raw-byte matching. One http.uri rule replaces an unbounded set of encoding-specific signatures, and it also catches the encoding the attacker invents tomorrow.

The passive half of this technique is undetectable, which means detection is the wrong place to spend effort. The winning move is to run the same enumeration against yourself on a schedule and fix what it finds before someone else runs it.

Volumetric attacks are trivially visible and largely a bandwidth-procurement problem. Application-layer attacks are the ones that hurt, and they hide beneath every volumetric threshold — which is why response time and error rate, not request count, are the metrics that matter.