Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,605 detections
Filters
Last updated
All Time
Detection languages
495
433
214
119
105
Contributors
403
350
248
92
65
Categories
20,427
11,813
5,871
5,145
4,864
1,605
Platforms
860
775
236
213
66
Products / Services
469
348
348
319
208
MITRE Techniques
726
541
453
167
163
CVEs
6
5
2
2
2
IDS Classtypes
235
83
34
19
18
IDS Protocols
283
56
51
16
12
This rule detects activity associated with the 'Ghostcode' threat campaign by monitoring multiple telemetry sources. It identifies connections to known malicious IP addresses and domains, patterns consistent with phishing kit hosting, and specific URL structures used in credential harvesting or payload delivery. The rule correlates sign-in logs, device network events, DNS queries, and email telemetry to identify potential compromise.
CloudSEK researchers uncovered BigBear 2.0, a global Microsoft 365 phishing-as-a-service operation targeting hundreds of organizations across 40+ countries. The investigation exposed the attacker’s admin panel, affiliate network, phishing infrastructure, and thousands of stolen credentials and session cookies, revealing how modern AiTM attacks can hijack authenticated sessions even after MFA.
Detects network activity (DNS lookups, TLS SNI, and HTTP Host headers) associated with proxy infrastructure (iproyal.com and lightningproxies.net) known to be used by the HEAVYGRAM/CHOSEN BRICK threat actors to mask Telegram-based command and control traffic.
Detects network, HTTP, and DNS activity associated with the known three-tier delivery infrastructure (phishing sites, relay/dispatcher servers, and payload hosts) used by the threat actor UNC6671/SilverFox/Aurora. The rule distinguishes between high-confidence confirmed connections and low-confidence DNS-only events.
Detects network, HTTP, and DNS activity associated with the known three-tier delivery infrastructure (phishing sites, relay/dispatcher servers, and payload hosts) used by the threat actor UNC6671/SilverFox/Aurora. The rule distinguishes between high-confidence confirmed connections and low-confidence DNS-only events.
Detects network, HTTP, and DNS activity associated with the known three-tier delivery infrastructure (phishing sites, relay/dispatcher servers, and payload hosts) used by the threat actor UNC6671/SilverFox/Aurora. The rule distinguishes between high-confidence confirmed connections and low-confidence DNS-only events.
This rule detects DNS queries for specific lookalike domains (e.g., *uzrailwaystax.com, *devon-uz.com) known to be used as Command and Control (C2) infrastructure by the threat actors associated with BloodAlchemy and the SpiceRAT malware.
This rule detects network activity (HTTP requests or DNS queries) interacting with specific suspicious domains that mimic Microsoft 365, Purview, or DocuSign authentication pages. These domains are identified by specific naming patterns and content markers indicative of credential harvesting or device code phishing attacks.
Detects DNS queries and TLS SNI traffic directed towards known typosquatted domains associated with the SilkParasite campaign. These domains are designed to impersonate Central Asian government, energy, and telecommunications entities to facilitate malicious activity.
Detects network activity and HTTP traffic associated with the Iron Man System kit, specifically targeting hardcoded C2 infrastructure (IP-based) and lure domain patterns involving specific brand tokens combined with disposable TLDs.
Detects network activity, including DNS queries and TLS certificate usage, related to the impersonation of the Uzbekistan state railway authority through the domain 'uzrailwaystax.com' and associated SSL/TLS certificates.
Detects DNS resolutions for domains specifically associated with command and control infrastructure.
Detects network traffic to known Transparent Tribe (APT36) C2 IP addresses and DNS resolution attempts for their associated command and control domains. This rule monitors for communication with identified malicious infrastructure often used by the group for C2 activity.
Detects DNS queries and HTTP GET requests directed at known typosquatted domains associated with the APT36 (Transparent Tribe) threat group, which are utilized for payload staging and delivery.
Detects the execution of processes named 'DriverInstaller.exe' or 'Automata-20.exe', the invocation of cmd.exe as a child process of these executables, or network requests originating from these processes to GitHub API and raw content endpoints. This pattern is indicative of potential initial access, tool staging, or malicious payload retrieval.
Detects potential command and control (C2) beaconing activity to GitHub repository API endpoints. The rule monitors for a high frequency of requests to specific file names commonly associated with C2 payloads (e.g., command.txt, results.txt, heartbeat.txt) and employs statistical analysis to identify consistent, non-random connection patterns that deviate from expected business usage.
Detects network activity (DNS, TLS SNI, and direct TCP connections) associated with the Transparent Tribe threat group's command-and-control infrastructure, specifically targeting the domain 'sharema128.net' and its associated IP address.
Detects DNS queries, HTTP requests, and TLS connections associated with known APT36 (Transparent Tribe) malicious infrastructure, specifically targeting typosquatted news domains used for staging payloads.
This rule identifies network activity, email URLs, and DNS queries associated with a specific set of known malicious domains often used in phishing or credential harvesting campaigns. By aggregating telemetry from EmailUrlInfo, EmailEvents, DeviceNetworkEvents, and DnsEvents, the rule flags any interactions with these indicators of compromise.
Detects DNS queries and established TLS connections to Microsoft Dev Tunnels (devtunnels.ms), which can be abused by adversaries to establish tunnels for unauthorized remote access, such as tunneling RDP traffic to bypass network security controls.
This rule detects DNS queries and TLS SNI connections to 'devtunnels.ms'. This domain is associated with Microsoft Dev Tunnels, a service that exposes local development environments to the internet. Adversaries may abuse this legitimate service to establish reverse tunnels or proxies, enabling lateral movement and bypassing inbound network restrictions.
Page 26 of 77