Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,605 detections
Filters
Last updated
All Time
Detection languages
495
433
214
119
105
Contributors
403
350
248
92
65
Categories
20,427
11,813
5,871
5,145
4,864
1,605
Platforms
860
775
236
213
66
Products / Services
469
348
348
319
208
MITRE Techniques
726
541
453
167
163
CVEs
6
5
2
2
2
IDS Classtypes
235
83
34
19
18
IDS Protocols
283
56
51
16
12
This rule detects DNS queries for the hardcoded domain 'gsx.uk.com', which is associated with the command-and-control (C2) infrastructure of BabylonRAT malware.
This rule detects DNS queries for the hardcoded domain 'gsx.uk.com', which is associated with the command-and-control (C2) infrastructure of BabylonRAT malware.
This rule detects DNS queries for the hardcoded domain 'gsx.uk.com', which is associated with the command-and-control (C2) infrastructure of BabylonRAT malware.
Detects outbound network communication patterns (DNS lookups and TLS SNI traffic) associated with the Koktevrat Android RAT. The rule monitors for connections to known malicious domains used for command-and-control (C2) operations.
Detects outbound network communication patterns (DNS lookups and TLS SNI traffic) associated with the Koktevrat Android RAT. The rule monitors for connections to known malicious domains used for command-and-control (C2) operations.
Detects outbound network communication patterns (DNS lookups and TLS SNI traffic) associated with the Koktevrat Android RAT. The rule monitors for connections to known malicious domains used for command-and-control (C2) operations.
Detects network activity (DNS queries, TLS SNI, and HTTP requests) directed towards the 'web12api.com' domain, as well as specific HTTP response structures commonly associated with adversary registration or command-and-control communication protocols.
This rule detects network connections to known CRPx0 relay or Command and Control (C2) IP addresses, as well as DNS requests to domains associated with the CRPx0 infrastructure, including relay nodes, leak sites, and TLD-rotation services.
This rule detects network connections or DNS queries to known phishing domains (typosquatted Microsoft login domains), DeadDrop Resolver domains, and suspicious HTML payloads served from common CDN/package hosting sites (e.g., unpkg.com, npmmirror.com, cdn.jsdelivr.net, yarnpkg.com). These patterns are indicative of initial access attempts via phishing or the secondary stage of malware C2 communication.
Detects network activity from infrastructure provisioner tools (Terraform, Coder) or shell processes attempting to connect to suspicious domains (e.g., coder-infra.com) that resemble legitimate infrastructure domains. This activity is indicative of credential theft, specifically targeting OIDC tokens, SSH keys, or authentication tokens during automated provisioning processes.
Detects SMTP MAIL FROM/Reply-To headers, DNS queries, or TLS SNI matches for known Business Email Compromise (BEC) lookalike domains (e.g., service-nowinc.com, domainlify.net) used for phishing or spoofing organizational identities.
Detects SMTP MAIL FROM/Reply-To headers, DNS queries, or TLS SNI matches for known Business Email Compromise (BEC) lookalike domains (e.g., service-nowinc.com, domainlify.net) used for phishing or spoofing organizational identities.
This rule detects network and email activity associated with a list of known suspicious or 'ghost' domains. It monitors email sender and recipient addresses, email URL links, and DNS query logs for matches against the predefined domain list, identifying potential spearphishing or command-and-control communication.
This rule monitors network connections, DNS resolutions, and email URLs to detect traffic communicating with a known adversary-in-the-middle (AiTM) phishing infrastructure panel. By correlating security logs, DNS events, and email URL data against this specific indicator of compromise, it identifies potential interaction with phishing sites designed to capture credentials or session tokens.
Detects the use of command-line tools like curl, wget, PowerShell, or Python to perform DNS over HTTPS (DoH) queries, identified by specific command-line arguments and connections to known public DoH resolvers. This behavior can be indicative of attempts to bypass local DNS monitoring or security controls.
Detects DNS queries and TLS SNI traffic directed towards known phishing domains that mimic Brazilian financial and government portals, specifically targeting 'gerenciadorcaixa.digital', 'aapj.digital', and 'receitafederal.digital'.
Detects DNS queries and TLS SNI traffic related to known malicious domains used by threat actor groups Storm-3121 and Storm-3032 in passkey-themed phishing campaigns.
Detects DNS resolutions, TLS SNI, and HTTP host requests to known malicious phishing domains impersonating passkey and SSO infrastructure, often associated with Storm-3121/Storm-3032 activities.
Detects DNS queries for lookalike domains combining a government/brand-impersonation keyword (as its own label, not a substring) with a disposable TLD used across the IronToll campaign. Dropped the standalone 'digital' keyword, which was generic enough to match ordinary e-commerce domains on the same TLDs.
Detects DNS queries for lookalike domains combining a government/brand-impersonation keyword (as its own label, not a substring) with a disposable TLD used across the IronToll campaign. Dropped the standalone 'digital' keyword, which was generic enough to match ordinary e-commerce domains on the same TLDs.
Detects anomalous DNS activity characterized by either unauthorized DNS zone transfer (AXFR/IXFR) requests or aggressive subdomain enumeration patterns from external IP addresses. This rule monitors for high volumes of non-standard DNS queries or distinct subdomain lookups within a 15-minute window, which are common precursors to reconnaissance activities.
Page 30 of 77