Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,230 detections
Filters
Last updated
All Time
Detection languages
2,175
1,018
354
260
212
Contributors
1,013
818
688
574
212
Categories
20,456
11,839
5,876
5,155
4,865
4,230
Platforms
2,933
889
585
248
198
Products / Services
2,239
1,453
841
416
344
MITRE Techniques
1,164
1,087
870
798
439
CVEs
22
20
20
18
17
IDS Classtypes
927
408
222
146
104
IDS Protocols
1,914
105
70
47
6
This rule detects outgoing network connections from the IIS worker process (w3wp.exe) to public-facing URLs that match common Microsoft Office WOPI (Web Application Open Platform Interface) request patterns, but are directed to domains other than trusted Microsoft-affiliated infrastructure. This behavior can be indicative of a Server-Side Request Forgery (SSRF) attempt, where an attacker tries to coerce the server into making unauthorized requests to external resources.
Detects potential browser fingerprinting and network reconnaissance behavior associated with Bluekit BitM PhaaS campaigns. The rule correlates large suspicious JavaScript file downloads (excluding common CDNs) with STUN server connectivity within a 10-minute window, a pattern often used by adversary-in-the-middle (AiTM) frameworks to fingerprint victims and establish WebRTC channels.
This rule detects high-volume HTTP POST requests to the FortiGate SSL VPN logincheck URI, specifically '/remote/logincheck', over common HTTPS ports (443, 4433, 8443, 9443, 10443). It uses a threshold of 5 requests from the same source IP within 30 seconds to identify potential credential stuffing or password spraying attacks against FortiGate devices, often associated with the 'FortiBleed' campaign.
Detects network traffic fetching device codes from the Kali365 backend, specifically targeting the '/api/device/start' or '/api/device/status/' endpoints. This activity is associated with the EvilTokens device code phishing kit.
Detects a single host making Zulip REST API POST requests to multiple distinct topics, specifically looking for patterns associated with system profiling and command/tasking as observed in ZiChatBot. The rule identifies activity where a source IP uses the Zulip API to send messages to at least two different topics, with the raw request content indicating either 'channel/stream' and 'topic/subject' or keywords like 'system info', 'shellcode', 'task', or 'command'.
This rule monitors for network connections to a specific remote IP (62.171.185.97) associated with suspicious activity. It flags connections involving specific high-risk ports, the use of Wget/1.18 for user agents, or access to the '/pwned' URL path, which are common indicators of automated attack tools or post-exploitation activity.
Detects unauthorized access attempts to ServiceNow Scripted REST APIs, specifically targeting misconfigured endpoints that do not require authentication. This rule monitors for requests made by the 'guest' user, known malicious IP addresses, or requests missing authorization headers directed at potentially vulnerable APIs like 'related_list_edit'.
Detects network connections from a host to the api.adblock-for-youtube.com domain at the /api/v2/rules endpoint. This behavior is associated with the 'Adblock for YouTube' browser extension (cmedhionkhpnakcndndgjdbohmhepckk) as it retrieves remote JavaScript scriplets for rule updates, which can be a vector for unauthorized code execution if the domain is compromised or used maliciously.
Detects the 'BadBlocker' Adblock for YouTube browser extension communicating with its command-and-control infrastructure to fetch and execute arbitrary scriptlets in the MAIN JavaScript world. By injecting directly into the page context, the extension gains unauthorized access to the DOM, user browsing sessions, and sensitive form data.
Detects unauthorized access attempts to sensitive SD-WAN control plane endpoints via REST API or the presence of suspicious 'evil_tenant.csv' artifacts, which may indicate reconnaissance or staging activities.
This rule detects potential Bluekit malware activity by identifying specific CSS filter function combinations (saturate, hue-rotate, brightness, and contrast) within HTTP header data. These functions are used by Bluekit to generate unique pixel hashes for page loads, intended to bypass screenshot-based detection. The rule also flags instances where these headers co-occur with content-length and javascript identifiers.
Detects HTTP GET requests to api.adblock-for-youtube.com to retrieve scriptlet rules. This endpoint is used by various browser extensions to fetch dynamic configuration updates, which can potentially facilitate MAIN-world JavaScript injection.
This rule identifies suspicious outbound network traffic potentially related to data exfiltration or command-and-control (C2) communication. It monitors for connections to the Telegram Bot API utilizing 'sendMessage' methods, often used by malware for exfiltrating credentials or sensitive data, as well as connections to known 'Bluekit' PhaaS (Phishing-as-a-Service) operator domains.
This rule monitors network and email gateway logs to detect activity related to the Bluekit Phishing-as-a-Service (PhaaS) platform. It identifies traffic to known Bluekit command-and-control or phishing domains, detects the presence of rrweb scripts often associated with session recording on phishing pages, alerts on brand-impersonation phishing pages using specific keyword combinations, and flags the presence of FortiBleed campaign lures.
Detects exploitation attempts against LB-LINK routers via parameter injection in the 'set_LimitClient_cfg' endpoint (CVE-2023-26801) and subsequent command-and-control behavior, including outbound connections to known RondoDox staging IPs and DNS queries for associated malicious domains.
Detects attempts to upload files to the SharePoint master page gallery using a POST request. This activity can be indicative of an attacker attempting to establish persistence or deface the SharePoint site by modifying its core components. The rule specifically looks for requests to '_layouts/15/Upload.aspx' or '_layouts/Upload.aspx' with 'RootFolder' and 'List' parameters containing '_catalogs/masterpage' or directory traversal sequences ('../').
Detects a web session that proxies an enterprise authorisation endpoint while also handling session-cookie names associated with authenticated access. This rule identifies suspicious activity indicative of an Adversary-in-the-Middle (AiTM) attack where an attacker proxies authentication requests and steals session cookies.
Detects use of Wayback Machine to access archived web content for reconnaissance
This rule detects WebSocket upgrade requests targeting Multi-Context Protocol (MCP) endpoints on AutoGen Studio default ports (8080/8081). It specifically flags connections originating from non-loopback addresses where the HTTP Origin header does not contain expected local indicators ('localhost', '127.0.0.1', '::1'), which may indicate unauthorized cross-origin access or remote exploitation attempts against the local development environment.
Detects HTTP requests to the SaaS platforms 'holabrief.com' or 'loopedin.io' that contain common URL redirection parameters, characteristic of an open-redirect abuse tactic used in phishing campaigns. These platforms are leveraged as intermediate hops to obfuscate the final destination of phishing links. The rule identifies the initial request and suggests correlation with subsequent traffic to unknown destinations to confirm a two-hop redirection chain.
Detects phishing emails that spoof specific healthcare domains (nhs.uk, mayoclinic.org, clevelandclinic.org) using invoice or payment-related subjects, characterized by DMARC/DKIM/SPF authentication failures. The detection correlates these emails with a subsequent user network request to known open-redirect or intermediary SaaS platforms (holabrief.com, loopedin.io) within a 10-minute window, indicating a likely credential harvesting or malware delivery sequence.
Page 126 of 202