Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,605 detections
Filters
Last updated
All Time
Detection languages
495
433
214
119
105
Contributors
403
350
248
92
65
Categories
20,427
11,813
5,871
5,145
4,864
1,605
Platforms
860
775
236
213
66
Products / Services
469
348
348
319
208
MITRE Techniques
726
541
453
167
163
CVEs
6
5
2
2
2
IDS Classtypes
235
83
34
19
18
IDS Protocols
283
56
51
16
12
This rule monitors endpoint telemetry for known indicators of compromise associated with the Casbaneiro/Ousaban banking trojan. It identifies activity across network connections (IPs and domain patterns), DNS queries for specific C2 domains, and the presence or execution of known malicious file hashes (e.g., PDF lures, HTA, AutoIt scripts, and payload binaries).
This rule detects network communication (via DNS queries, web logs, or device network events) with a list of known malicious domains associated with Command and Control (C2) activity.
This rule monitors for user interactions with specific domains and URLs known to be associated with suspicious or malicious activity. It aggregates data from multiple sources, including email clicks (UrlClickEvents), device network activity (DeviceNetworkEvents), device browser events (DeviceEvents), and DNS queries (DnsEvents), to identify potential exposure to these indicators of compromise.
This rule monitors for user interactions with specific domains and URLs known to be associated with suspicious or malicious activity. It aggregates data from multiple sources, including email clicks (UrlClickEvents), device network activity (DeviceNetworkEvents), device browser events (DeviceEvents), and DNS queries (DnsEvents), to identify potential exposure to these indicators of compromise.
Detects browser-based processes (Chrome, Opera, Edge) making network requests to AI and cloud service domains (Google Gemini, Claude, Opera). This rule monitors for potentially unauthorized or excessive browser communication with these services.
Detects DNS queries, TLS SNI headers, and HTTP host headers associated with identified C2 infrastructure for NetSupport Manager malware, specifically domains themed around 'GTA6'. These indicators are used by attackers for command and control communication.
This rule monitors network connection logs, DNS query logs, and common security logs for known indicators of compromise, specifically IP addresses and domains associated with command and control (C2) infrastructure.
Detects DNS queries, TLS SNI, and HTTP Host header traffic associated with the IronToll phishing campaign. The rule specifically monitors for government-impersonating domains and lookalike domains utilizing various non-standard top-level domains (TLDs).
This rule monitors network connections and DNS query responses for activity associated with known suspicious domains: 'getmacouscloud.com', 'ferncore13.com', and 'grove-89.com'. It identifies communication attempts (successes, failures, or DNS lookups) between endpoints and these domains, which is indicative of potential command and control (C2) activity.
This rule monitors network connections and DNS query responses for activity associated with known suspicious domains: 'getmacouscloud.com', 'ferncore13.com', and 'grove-89.com'. It identifies communication attempts (successes, failures, or DNS lookups) between endpoints and these domains, which is indicative of potential command and control (C2) activity.
This rule monitors network traffic, DNS queries, and user web clicks to detect interactions with known malicious domains associated with credential harvesting and phishing campaigns, specifically those impersonating security or SSO portals.
Detects Server-Side Request Forgery (SSRF) attempts originating from the Grafana MCP (Model Context Protocol) process. The rule specifically monitors for instances where the 'grafana_api_request' tool is used in conjunction with a 'X-Grafana-URL' header targeting cloud metadata IP ranges (169.254.0.0/16), or where the host attempts to resolve GCP metadata domains ('metadata.google.internal'). This behavior is indicative of an attacker attempting to access cloud provider instance metadata to exfiltrate security credentials.
Detects network communication with domains and IP addresses known to be associated with 'ClickFix' social engineering campaigns (specifically those masquerading as legitimate HBO Max or macOS related updates). The rule applies a strict correlation between observed malicious IP traffic and specific DNS requests to reduce noise from IP address reuse or threat intelligence feed probes, while also excluding known security-related processes.
Detects network communication with domains and IP addresses known to be associated with 'ClickFix' social engineering campaigns (specifically those masquerading as legitimate HBO Max or macOS related updates). The rule applies a strict correlation between observed malicious IP traffic and specific DNS requests to reduce noise from IP address reuse or threat intelligence feed probes, while also excluding known security-related processes.
HBO Max ClickFix attacks IOC Hunt
Cortex XDR
Detects network activity (DNS queries or direct IP communication) associated with 'ClickFix' social engineering attacks targeting users under the guise of an HBO Max update or repair utility. The rule includes indicators for known malicious domains and IP addresses while incorporating filters to minimize false positives from security scanners, threat intel feeds, and automated crawlers by analyzing User-Agent strings and network source addresses.
Detects network activity associated with the EtherHiding technique, where adversaries leverage the Polygon blockchain to resolve command-and-control (C2) infrastructure and communicate with malicious smart contracts. This rule identifies specific JSON-RPC requests ('eth_call') using SloppyRAT contract selectors and DNS queries for blockchain-related RPC endpoints.
Detects DNS queries and TLS SNI traffic directed towards domains identified as part of Storm-3121/Storm-3032 phishing campaigns. These domains are themed around passkey management and single sign-on (SSO) services, likely intended for credential harvesting.
This rule detects internal network activity (DNS queries, network connections, and security logs) communicating with domains associated with the GhostCode phishing kit. These domains are typically used to host credential harvesting pages or phishing infrastructure.
Detects network activity and email headers associated with the DoppelBrand campaign. The rule monitors DNS queries for specific IOC domains (service-nowinc.com, domainlify.net) and inspects SMTP traffic for malicious MAIL FROM addresses and Reply-To headers targeting these domains.
CloudSEK researchers uncovered BigBear 2.0, a global Microsoft 365 phishing-as-a-service operation targeting hundreds of organizations across 40+ countries. The investigation exposed the attacker’s admin panel, affiliate network, phishing infrastructure, and thousands of stolen credentials and session cookies, revealing how modern AiTM attacks can hijack authenticated sessions even after MFA.
CloudSEK researchers uncovered BigBear 2.0, a global Microsoft 365 phishing-as-a-service operation targeting hundreds of organizations across 40+ countries. The investigation exposed the attacker’s admin panel, affiliate network, phishing infrastructure, and thousands of stolen credentials and session cookies, revealing how modern AiTM attacks can hijack authenticated sessions even after MFA.
Page 27 of 77