Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,230 detections
Filters
Last updated
All Time
Detection languages
2,175
1,018
354
260
212
Contributors
1,013
818
688
574
212
Categories
20,456
11,839
5,876
5,155
4,865
4,230
Platforms
2,933
889
585
248
198
Products / Services
2,239
1,453
841
416
344
MITRE Techniques
1,164
1,087
870
798
439
CVEs
22
20
20
18
17
IDS Classtypes
927
408
222
146
104
IDS Protocols
1,914
105
70
47
6
Detects web browsers connecting via Port 80 (HTTP) to domains that strictly mandate HTTPS (HSTS bypass), revealing SSL stripping via DNS hijack. Specifically targets 'login.microsoftonline.com' and 'okta.com'.
This rule detects a high volume of HTTP requests to Salesforce API endpoints associated with bulk data queries. Specifically, it looks for 20 or more requests within a 60-second window from a single source IP to 'salesforce.com' with URI paths containing both '/services/data/' and '/query/'. This pattern suggests a potential bulk download of customer records or other data via the Salesforce API.
Detects repeated HTTP PUT operations targeting the Ghost CMS admin API for post updates. This rule focuses on network connections or process command lines indicating such activity, retaining principal and target context for further correlation. This activity could be indicative of exploitation of vulnerabilities like CVE-2026-26980, leading to mass compromise and content manipulation.
Detects Cobalt Strike beacon default HTTP checkin pattern
Detects bulk export of Confluence wiki content
This rule detects potential credential harvesting attempts by identifying a high volume of short-duration HTTP requests to common login, sign-in, verify, account, or authentication URI stems. It specifically looks for requests originating from user agents commonly associated with bots or scripting tools (e.g., 'bot', 'curl', 'python', 'powershell') and successful HTTP status codes (200). The 'short' session duration is inferred from small response sizes (less than 5000 bytes), suggesting automated access rather than human interaction.
Detects transmission of a bitmask representing environment checks to the C2.
Tracks browser network events fetching the dynamic malicious payload pipiteimosa.extension.js, specifically when initiated by Chrome or Microsoft Edge browsers. This activity is associated with the UnregStealer malware, which targets Brazilian banking credentials.
Tracks browser network events where chrome.exe or msedge.exe are fetching a dynamic extension script named 'whitelist.extension.txt'. This activity is associated with the UnregStealer malware, which is known for human-operated browser credential theft.
This rule detects potential prompt injection attempts targeting AI systems by looking for specific keywords related to AI models (gpt, claude, copilot) in HTTP logs, combined with suspicious characters or commands commonly used in injection attacks (e.g., <script>, javascript:, eval(). The rule triggers if 5 or more such attempts are observed from a single IP within an hour.
SniperDz VAPID Key Activity
Cortex XDR
Detects web requests or command line activity containing the specific VAPID public key associated with the SniperDz push-notification infrastructure. This key is known to be used by the SniperDz PhaaS (Phishing-as-a-Service) ecosystem.
Detects network connections or DNS queries to the specific link-aggregation domain 'fanlnk.to'. This domain is known to be abused by the threat actor SniperDz to mask the destination of malicious social media lures, often leading to phishing or malware delivery.
Detects network connections to known SmartApeSG backend domains (wigetticks.com, wizzleticks.com) or specific regex pattern 'okendo-reviews.js$' associated with SmartApeSG C2 infrastructure.
Detects high-volume use of AI APIs potentially for generating attack content
This rule detects potential domain fronting activity used to hide Command and Control (C2) servers. It specifically looks for HTTP traffic where the TLS Server Name Indication (SNI) or HTTP Host header contains known domain fronting providers like cloudfront.net or azureedge.net, combined with a suspicious pattern in the HTTP Host header that includes an 8 or more character alphanumeric string followed by a top-level domain commonly associated with malicious activity (xyz, top, club, icu). This combination suggests an attempt to disguise C2 communications by routing them through legitimate content delivery networks.
This rule detects potential prompt injection attempts targeting AI systems by looking for specific keywords related to AI models (gpt, claude, copilot) in HTTP logs, combined with suspicious characters or commands commonly used in injection attacks (e.g., <script>, javascript:, eval(). The rule triggers if 5 or more such attempts are observed from a single IP within an hour.
Detects HTTP C2 communication patterns associated with Remcos RAT loader by monitoring network events for specific URLs and known malicious IP addresses. This rule identifies outbound network connections to hardcoded malicious IPs and specific URL paths often used for command and control by Remcos.
Identifies outbound HTTP GET requests fetching masqueraded Donut shellcode disguised as .woff web font files from non-browser processes. This rule specifically looks for network events where the remote URL ends with '.woff' and the initiating process is not a common web browser (chrome.exe, msedge.exe, firefox.exe).
Detects outbound HTTP communication using specific Tencent-themed API impersonation URI structures, which may indicate TencShell activity.
Detects processes making network requests to the '/cf.js' endpoint, which is indicative of ErrTraffic activity. This rule specifically looks for network events where the remote URL ends with '/cf.js'.
Inspects network connection URIs for the SKS= or MAP= parameters, which are used by the Showboat malware to initialize proxy tunnels. This rule specifically looks for these parameters in HTTP connection events.
Page 138 of 202