Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,230 detections
Filters
Last updated
All Time
Detection languages
2,175
1,018
354
260
212
Contributors
1,013
818
688
574
212
Categories
20,456
11,839
5,876
5,155
4,865
4,230
Platforms
2,933
889
585
248
198
Products / Services
2,239
1,453
841
416
344
MITRE Techniques
1,164
1,087
870
798
439
CVEs
22
20
20
18
17
IDS Classtypes
927
408
222
146
104
IDS Protocols
1,914
105
70
47
6
Detects outbound network communication originating from potential VILE ransomware processes. The rule monitors for suspicious Go-based HTTP clients using specific User-Agents (Go-http-client/2.0 or 1.1) initiating network connections to remote ports 80 or 443 with JSON payloads, while explicitly excluding common web browsers and internal RFC-1918 network ranges.
Detects browser network events accessing Cloudflare Turnstile endpoints followed immediately by a connection to an anomalous, newly registered AiTM subdomain. This sequence of events is indicative of a CAPTCHA bypass technique used by the Tycoon2FA phishing kit.
Identifies users accessing Cloudflare Turnstile or reCAPTCHA gateways immediately preceding the AiTM proxy domain resolution. This behavior is indicative of an adversary-in-the-middle (AiTM) phishing attack attempting to bypass CAPTCHA challenges.
This rule detects network activity involving connections to known malicious IP addresses or DNS domains ('govtop.one') and subsequent attempts to download specific suspicious file payloads, such as archives or image files often associated with malicious activity. This activity is indicative of potential command and control communication or initial malware ingress.
Detects a web session that proxies an enterprise authorisation endpoint while also handling session-cookie names associated with authenticated access. This rule identifies suspicious activity indicative of an Adversary-in-the-Middle (AiTM) attack where an attacker proxies authentication requests and steals session cookies.
Detects one web session posting username, password, and MFA or one-time-code form fields through the same intermediary host. This behavior is indicative of an Adversary-in-the-Middle (AiTM) attack, where an attacker intercepts and relays authentication requests, including multi-factor authentication (MFA) codes, to gain unauthorized access.
Detects a phishing page upgrading to WebSocket or polling transport with Socket.IO event framing during authentication. This behavior is indicative of an adversary-in-the-middle (AiTM) attack, specifically associated with the 'Tycoon' threat activity.
Detects browser network events fetching secondary stage loaders via PHP handlers masking as schema descriptors.
Identifies potential Neo-reGeorg webshell execution by correlating HTTP POST requests to Java Server Pages (.jsp/.jspx) with reflection events (defineClass) in system logs. This specific mechanism is utilized by Operation Escaneo (MexicanMafia) to load AES-encrypted, base64/BLV-encoded payloads in memory.
Detects the presence of 'access_token' and 'step' strings in conjunction with 'POST' and 'application/json' within network traffic or files, indicating potential C2 communication or data exfiltration related to the Remus malware distribution ecosystem.
Detects unauthenticated ServiceNow Scripted REST Resource access attributed to Guest user or known attacker IP 51.159.98.241
This rule detects network requests for specific URI paths and filenames ('css.js' or 'cf.js') known to be used by the ErrTraffic malware distribution framework for delivering ClickFix payloads. It identifies potential command and control (C2) infrastructure by grouping requests based on client IP, source IP, domain, destination IP, and URL.
Detects unauthorized or external access attempts to exposed Ollama API endpoints (port 11434) for generating or chatting, which could be indicative of LLMjacking. The rule identifies requests from known attacker IPs or any external IP, especially if the request count is high.
Detects HTTP GET requests for JavaScript or CSS resources from netdna-ssl.com or wpengine.netdna-ssl.com subdomains. This activity could indicate a supply chain compromise where malicious code is injected into legitimate web resources served from these content delivery networks.
This rule detects POST requests to the URI '/api/device/start' which is indicative of the EvilTokens phishing kit attempting to initiate a Microsoft OAuth Device Code flow. This technique is often used in phishing campaigns to gain unauthorized access to user accounts by tricking them into authenticating through a device code.
Detects network traffic to the malicious domain web-telegram[.]ug, which is indicative of Command and Control (C2) communication.
Detects web requests containing the custom X-Antibot-Token header utilized by EvilToken proxies, indicating potential malicious activity related to AI-enabled device code phishing campaigns.
Detects interaction with the WordPress Theme Editor utility immediately followed by a file modification to functions.php, indicative of the ErrTraffic deployment phase. This activity can be a sign of web shell deployment or other malicious code injection.
Detects the uploading of a plugin matching known disguised slugs ('content-delivery-helper' or 'database-optimizer') used by attackers to install backdoors after establishing a rogue admin account in WordPress environments. This rule specifically targets POST requests to the WordPress plugin update endpoint with these malicious plugin names in the query string.
This rule detects potential credential harvesting attempts by identifying a high volume of short-duration HTTP requests to common login, sign-in, verify, account, or authentication URI stems. It specifically looks for requests originating from user agents commonly associated with bots or scripting tools (e.g., 'bot', 'curl', 'python', 'powershell') and successful HTTP status codes (200). The 'short' session duration is inferred from small response sizes (less than 5000 bytes), suggesting automated access rather than human interaction.
Detects the unique URL structures matching the Service Worker DGA targeting randomized Amazon S3 buckets, indicative of potential command and control communication.
Page 136 of 202