Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,605 detections
Filters
Last updated
All Time
Detection languages
495
433
214
119
105
Contributors
403
350
248
92
65
Categories
20,440
11,814
5,871
5,145
4,864
1,605
Platforms
860
775
236
213
66
Products / Services
469
348
348
319
208
MITRE Techniques
726
541
453
167
163
CVEs
6
5
2
2
2
IDS Classtypes
235
83
34
19
18
IDS Protocols
283
56
51
16
12
Detects network, DNS, email, and URL click events matching known IOC domains associated with AdFection, Candiru, and Discover-Tech threat intelligence reports.
Detects DNS lookups, TLS connections, and network traffic associated with the PoeLLM cryptominer communicating with Kryptex mining pools, as well as Stratum mining protocol login attempts.
Detects DNS lookups, TLS connections, and network traffic associated with the PoeLLM cryptominer communicating with Kryptex mining pools, as well as Stratum mining protocol login attempts.
Detects HTTP, TLS, DNS, and TCP communication with known AhsayCBS campaign infrastructure and Alibaba OSS storage buckets used for payload delivery.
IOC sweep for ARTEX campaign indicators: C2 host, nine proxy IPs, xcai.pro and its subdomains, and the CLAUDE.md URL across Defender, CEF/firewall, DNS and Entra sign-in telemetry. Domains match on exact host or subdomain only, connection types are limited to real connection events, and sign-ins are limited to successes and credential failures.
Detects network traffic (DNS, TLS SNI, and HTTP) associated with Wazza phishkit infrastructure, specifically looking for malicious domains like boegl-krysl.eu and coppietersrecherche.eu, as well as Cloudflare workers.dev domains used for beaconing and lures.
Detects network traffic (DNS, TLS SNI, and HTTP) associated with Wazza phishkit infrastructure, specifically looking for malicious domains like boegl-krysl.eu and coppietersrecherche.eu, as well as Cloudflare workers.dev domains used for beaconing and lures.
This rule monitors endpoint telemetry (DNS queries, network connections, file creation, and process execution) to identify matches against a predefined list of known malicious indicators, including IP addresses, domains, and file hashes (SHA256). The rule differentiates between confirmed malicious activity and low-confidence indicators, providing a prioritized view of potential threats.
Detects DNS lookups, TLS connections, and network traffic associated with the PoeLLM cryptominer communicating with Kryptex mining pools, as well as Stratum mining protocol login attempts.
This rule detects network communication, DNS queries, email interactions, and URL clicks associated with known TA419 threat actor infrastructure. It monitors multiple telemetry sources to identify indicators of compromise (IOCs) such as specific domains, IP addresses, and email addresses.
IOC sweep for P7 DarkSword / Coruna: known file hashes, C2/exploit-host IPs, domains and URLs against Defender device file and network events. Tightened to public IPs, connection action types, exact hosts/subdomains and path-qualified URLs; the shared AWS IP is only matched with its C2 port.
Detects HTTP, TLS, DNS, and TCP communication with known AhsayCBS campaign infrastructure and Alibaba OSS storage buckets used for payload delivery.
Detects indicators associated with the ChatGPT Custom GPT ClickFix campaign across process, network connection, DNS, and HTTP telemetry: known malicious file hashes, C2 IP addresses, the chattypetty.com domain, and known payload-hosting URLs.
Detects network activity related to the 'Blinder Tunnel' C2 infrastructure. The rules identify a Chisel tunnel client initiating a WebSocket handshake (identifiable by the 'chisel-v3-channel' header) to external infrastructure and a DNS lookup for a specific domain (soroshpasargad.com) identified as a relay nameserver used by the threat actor CL-STA-1178.
Detects DNS queries and TLS SNI traffic associated with known lookalike domains used by the threat actor TA419 for organization impersonation, which are commonly utilized in spearphishing campaigns.
Detects DNS queries, HTTP host headers, and TLS SNI traffic associated with known credential-phishing domains used by the threat actor TA419. The rule monitors for communication to a specific list of domains identified as malicious or used in phishing campaigns.
Detects DNS lookups and outbound network connections to known command and control (C2) and staging domains associated with the STAC4924 campaign. The rule performs strict matching on domain names to ensure that subdomains are identified while avoiding false positives from partial string matches within URLs.
Detects network traffic (DNS, TLS SNI, and HTTP) associated with Wazza phishkit infrastructure, specifically looking for malicious domains like boegl-krysl.eu and coppietersrecherche.eu, as well as Cloudflare workers.dev domains used for beaconing and lures.
This rule detects various malicious indicators including known file hashes, IP addresses, domains, and specific URLs associated with threat activity. It consolidates hits from process, file, and network telemetry to alert on potential compromise or communication with identified command-and-control (C2) infrastructure.
This rule detects network communication, DNS queries, email interactions, and URL clicks associated with known TA419 threat actor infrastructure. It monitors multiple telemetry sources to identify indicators of compromise (IOCs) such as specific domains, IP addresses, and email addresses.
This rule detects network communication, DNS queries, email interactions, and URL clicks associated with known TA419 threat actor infrastructure. It monitors multiple telemetry sources to identify indicators of compromise (IOCs) such as specific domains, IP addresses, and email addresses.
Page 3 of 77