Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,230 detections
Filters
Last updated
All Time
Detection languages
2,175
1,018
354
260
212
Contributors
1,013
818
688
574
212
Categories
20,456
11,839
5,876
5,155
4,865
4,230
Platforms
2,933
889
585
248
198
Products / Services
2,239
1,453
841
416
344
MITRE Techniques
1,164
1,087
870
798
439
CVEs
22
20
20
18
17
IDS Classtypes
927
408
222
146
104
IDS Protocols
1,914
105
70
47
6
Detects upload of malicious payloads to file hosting services for staging
This rule identifies HTTP requests containing specific URL affiliate tracking parameters associated with the "Borrowed Trust" SEO poisoning campaign. The campaign utilizes these parameters to monetize its activities, often redirecting users to gambling sites. Detection is based on the presence of known affiliate codes in `RemoteUrl` from `DeviceNetworkEvents` or `RequestURL` from `CommonSecurityLog` (proxy/firewall logs).
Detects stolen web session cookies being replayed from different IP addresses
Detects sustained large HTTP POST requests indicating data exfiltration
Detects directory traversal attempts in HTTP requests
Identifies network traffic targeting the backend API endpoints associated with EvilTokens device code generation and token weaponization. This rule specifically looks for requests to paths like /api/device/start, /api/device/status, /api/device/sessions, and various /api/prt/ endpoints (convert, refresh, exchange, cookie, owa-session, recon, azure) which are indicative of EvilTokens activity.
This rule detects HTTP traffic to specific Visual Studio Code (VS Code) remote tunnel domains, specifically 'tunnels.api.visualstudio.com' or 'vscode.dev'. A high frequency of such connections (10 times within 60 seconds from the same source) is flagged as potential command and control (C2) activity, indicating the use of VS Code Remote Tunnels as a C2 channel.
This rule detects HTTP traffic where the client body contains a long string (100 or more characters) composed exclusively of uppercase letters and digits 2-7, potentially followed by padding characters. This pattern is indicative of custom alphabet base encoding, often used in Command and Control (C2) communications to obfuscate data.
Detects fingerprinting of web application CMS versions for vulnerability research
Detects fingerprinting of web application CMS versions for vulnerability research
SniperDz Domain IOCs
Cortex XDR
Detects network connections or DNS queries to known domain names associated with the SniperDz core monetization and redirection infrastructure. This rule specifically looks for traffic to 'win.feezossl.xyz', 'win.anababayala.com', 'aff.bnaosf1he.shop', and 'offer.raviral.com' in DNS query names or HTTP network metadata.
Detects cross-site scripting attempts in HTTP requests
This rule detects when an OAuth application is granted tenant-wide administrative permissions within a Microsoft 365 environment. It specifically looks for HTTP POST requests to 'graph.microsoft.com' with the URI containing 'oauth2PermissionGrants'. This activity is indicative of a malicious OAuth app attempting to gain broad access to an organization's data and resources, often as a persistence mechanism.
Detects PowerShell initiating web requests specifically for .jpeg files, a core component of the staging phase of the SilentCanvas operation.
This rule detects a high volume of HTTP POST requests to known SMS API providers (Twilio, Nexmo, Vonage) from a single source IP address within a short timeframe. This pattern is indicative of a 'pumping attack' or SMS fraud, where an attacker attempts to generate a large number of SMS messages, often to premium rate numbers, to incur charges or exploit vulnerabilities in billing systems. The threshold is set to 20 requests within 60 seconds from the same source.
Detects the campaign-specific REDCAP-TOKEN cookie name in available endpoint or network event metadata. GTIG reported that INFINITERED used this HTTP cookie to receive encrypted commands and return system, database, and configuration information. This query depends on the cookie value being retained in AdditionalFields by the available sensor or integrated telemetry source.
Detects network requests to the HarborWatch API endpoint '/api/agent/tasks/claim'. This activity could indicate an agent attempting to claim tasks from a HarborWatch server, which might be part of legitimate operations or could be indicative of unauthorized access or activity if the agent is not recognized or the request is unexpected.
Detects network requests to the HarborWatch API heartbeat endpoint. This could indicate monitoring or health checks of the HarborWatch system, which might be benign or could be used by an attacker to check for system availability or to maintain persistence.
Detects scraping of partner and vendor relationship pages for supply chain targeting
This rule detects attempts to access the ESXi Hypervisor Command Line Interface (CLI) via HTTPS. It specifically looks for HTTP requests to the '/sdk' and 'vim25' URIs on port 443, which are indicative of vSphere API or CLI interactions with an ESXi host.
Detects access to paid threat intelligence or dark web data platforms
Page 139 of 202