Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,605 detections
Filters
Last updated
All Time
Detection languages
495
433
214
119
105
Contributors
403
350
248
92
65
Categories
20,440
11,814
5,871
5,145
4,864
1,605
Platforms
860
775
236
213
66
Products / Services
469
348
348
319
208
MITRE Techniques
726
541
453
167
163
CVEs
6
5
2
2
2
IDS Classtypes
235
83
34
19
18
IDS Protocols
283
56
51
16
12
Detects DNS queries for the domain 'pdf.gusercontent.com', which is known to be used as a lookalike domain for Google-related services to deceive users. This pattern is often indicative of malicious infrastructure used for credential harvesting, phishing, or malware delivery.
Detects unauthorized outbound network traffic from browser processes to the lookalike domain 'pdf.gusercontent.com'. This domain is associated with a malicious Firefox browser extension, 'PDF Identity Verifier', which is designed to exfiltrate session telemetry and data from Google account sessions.
Detects network traffic attempting to connect to common public DNS-over-HTTPS (DoH) providers (Cloudflare, Google, Quad9) via TLS SNI or HTTP headers. This activity is often associated with malware or malicious agents attempting to bypass traditional DNS monitoring for command and control (C2) communication.
Detects DNS queries for RatHat C2 panels using characteristic naming patterns and specific malicious domains, as well as outbound network connections to known RatHat C2 IP infrastructure.
Detects network connections to known public DNS-over-HTTPS (DoH) resolvers, specifically cloudflare-dns.com and dns.google, as well as non-browser processes performing HTTPS requests to these IPs. Such traffic patterns are often indicative of Command and Control (C2) communication utilizing DoH to bypass network-level DNS filtering and monitoring.
Detects network connections to known public DNS-over-HTTPS (DoH) resolvers, specifically cloudflare-dns.com and dns.google, as well as non-browser processes performing HTTPS requests to these IPs. Such traffic patterns are often indicative of Command and Control (C2) communication utilizing DoH to bypass network-level DNS filtering and monitoring.
This rule set detects network communication patterns associated with the AnonyMousKIT phishing kit, specifically targeting the exfiltration of captured user credentials to the Telegram Bot API and communication with known phishing panel infrastructure. It monitors for DNS lookups of 'anomkit.shop', established TCP connections to the associated backend relay, and HTTP requests containing specific credential-related keywords directed towards the Telegram API.
Detects DNS queries and HTTP requests associated with the OnyxC2 command and control infrastructure, including specific hardcoded domains and suspicious DNS traffic targeting newly-abused top-level domains (.top, .cyou, .lol).
Detects network traffic to specific domains (api.hhos.ru, mainapi.store) associated with the VPN-for-X browser extension's monetization API. This behavior is indicative of command-and-control or tracking communication identified as potentially malicious within the context of a browser extension.
Detects network activity associated with the NarwhalRAT malware, specifically C2 beaconing via HTTP/DNS to known infrastructure and file downloads from staging domains.
This rule performs a retrospective hunt for indicators of compromise (IOCs) associated with the ClosedQuorum malware. It identifies suspicious activity by matching against known file hashes, specific filenames, and network traffic directed towards services (such as DeepSeek, OpenRouter, Mistral, and Discord) which the malware uses for C2 or data exfiltration. The detection logic aggregates results from file system, process, and network telemetry.
This rule performs a retrospective hunt for indicators of compromise (IOCs) associated with the ClosedQuorum malware. It identifies suspicious activity by matching against known file hashes, specific filenames, and network traffic directed towards services (such as DeepSeek, OpenRouter, Mistral, and Discord) which the malware uses for C2 or data exfiltration. The detection logic aggregates results from file system, process, and network telemetry.
Detects network traffic (HTTP, TLS, and DNS) originating from the internal network directed toward Telegram's API endpoints (api.telegram.org) and domains (t.me). This behavior is often associated with the use of the Telegram Bot API as a command-and-control (C2) channel or for data exfiltration by malware.
Detects network traffic (HTTP, TLS, and DNS) originating from the internal network directed toward Telegram's API endpoints (api.telegram.org) and domains (t.me). This behavior is often associated with the use of the Telegram Bot API as a command-and-control (C2) channel or for data exfiltration by malware.
Detects network connections or DNS queries to known suspicious domains associated with command and control infrastructure.
Detects network connections or DNS queries to known suspicious domains associated with command and control infrastructure.
Detects network connections or DNS queries to known suspicious domains associated with command and control infrastructure.
Detects network connections, process command line arguments, and DNS queries associated with identified Galago or Panzer ransomware C2, leak site, or contact infrastructure (Tox IDs/Tor .onion addresses).
Detects network connections, process command line arguments, and DNS queries associated with identified Galago or Panzer ransomware C2, leak site, or contact infrastructure (Tox IDs/Tor .onion addresses).
This rule detects DNS queries or network connections originating from endpoints to a list of known malicious domains associated with various malware families (ClearFake, IClickFix, AMOS, Vidar, etc.). This helps identify potential C2 communication, malicious payload delivery, or infrastructure interaction.
Detects anomalous network behavior consistent with the PolinRider malware, which uses public Ethereum JSON-RPC endpoints and blockchain explorers (e.g., Etherscan.io) as a dead-drop resolver for command-and-control (C2) communication. The rules monitor for specific RPC methods (eth_getTransactionByHash, eth_call, eth_getBalance) over HTTP/TLS and DNS resolution queries to known blockchain explorer infrastructure.
Page 14 of 77