Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,230 detections
Filters
Last updated
All Time
Detection languages
2,175
1,018
354
260
212
Contributors
1,013
818
688
574
212
Categories
20,456
11,839
5,877
5,156
4,865
4,230
Platforms
2,933
889
585
248
198
Products / Services
2,239
1,453
841
416
344
MITRE Techniques
1,164
1,087
870
798
439
CVEs
22
20
20
18
17
IDS Classtypes
927
408
222
146
104
IDS Protocols
1,914
105
70
47
6
Detects NeedyMantis' initial C2 beacon: an HTTP GET to /library/zip/ on port 443, anchored to the URI root, carrying a client-originated 'Set-Cookie:' header (clients normally send 'Cookie:', never 'Set-Cookie:' -- this direction reversal is the core anomaly and is near-impossible for legitimate traffic) alongside an explicit 'Upgrade: websocket' header. Matching the literal header text (not just header-name presence) and anchoring the URI removes generic WebSocket apps and any unrelated path containing '/library/zip/' as a substring.
Hunts telemetry for published NeedyMantis indicators: three known SHA-256 hashes (WinSparkle.dll first-stage loader and its encrypted archive, plus the older libcurl archive), the C2 domain corp.tripswithengine[.]com, and the C2 URL path /library/zip/ on that domain. Domain/URL matching parses the actual host out of RemoteUrl and requires an EXACT match (not substring 'has/contains'), so a different domain that merely contains 'corp.tripswithengine.com' as a suffix of a longer label (e.g. 'notcorp.tripswithengine.com') or as a prefix of an unrelated domain (e.g. 'corp.tripswithengine.com.evil.net') cannot match. No malicious IP address has been published for this campaign, so IP-based matching is intentionally not included.
Hunts telemetry for published NeedyMantis indicators: three known SHA-256 hashes (WinSparkle.dll first-stage loader and its encrypted archive, plus the older libcurl archive), the C2 domain corp.tripswithengine[.]com, and the C2 URL path /library/zip/ on that domain. Domain/URL matching parses the actual host out of RemoteUrl and requires an EXACT match (not substring 'has/contains'), so a different domain that merely contains 'corp.tripswithengine.com' as a suffix of a longer label (e.g. 'notcorp.tripswithengine.com') or as a prefix of an unrelated domain (e.g. 'corp.tripswithengine.com.evil.net') cannot match. No malicious IP address has been published for this campaign, so IP-based matching is intentionally not included.
Hunts telemetry for published NeedyMantis indicators: three known SHA-256 hashes (WinSparkle.dll first-stage loader and its encrypted archive, plus the older libcurl archive), the C2 domain corp.tripswithengine[.]com, and the C2 URL path /library/zip/ on that domain. Domain/URL matching parses the actual host out of RemoteUrl and requires an EXACT match (not substring 'has/contains'), so a different domain that merely contains 'corp.tripswithengine.com' as a suffix of a longer label (e.g. 'notcorp.tripswithengine.com') or as a prefix of an unrelated domain (e.g. 'corp.tripswithengine.com.evil.net') cannot match. No malicious IP address has been published for this campaign, so IP-based matching is intentionally not included.
Detects the NeedyMantis main-component handshake: an HTTP GET to port 443 with a User-Agent that is EXACTLY the hard-coded literal 'firefox/21.0' (anchored start+end) and an explicit 'Upgrade: websocket' header, marking the HTTPS-to-WebSocket protocol switch used before the RC4 key exchange. Restricting to port 443 and requiring an exact (not substring) UA match removes generic WebSocket apps and any traffic where 'firefox/21.0' merely appears inside a real, longer browser UA string.
Detects the NeedyMantis main-component handshake: an HTTP GET to port 443 with a User-Agent that is EXACTLY the hard-coded literal 'firefox/21.0' (anchored start+end) and an explicit 'Upgrade: websocket' header, marking the HTTPS-to-WebSocket protocol switch used before the RC4 key exchange. Restricting to port 443 and requiring an exact (not substring) UA match removes generic WebSocket apps and any traffic where 'firefox/21.0' merely appears inside a real, longer browser UA string.
Detects the NeedyMantis main-component handshake: an HTTP GET to port 443 with a User-Agent that is EXACTLY the hard-coded literal 'firefox/21.0' (anchored start+end) and an explicit 'Upgrade: websocket' header, marking the HTTPS-to-WebSocket protocol switch used before the RC4 key exchange. Restricting to port 443 and requiring an exact (not substring) UA match removes generic WebSocket apps and any traffic where 'firefox/21.0' merely appears inside a real, longer browser UA string.
Detects egress to the NeedyMantis C2 domain corp.tripswithengine[.]com across three vantage points: TLS SNI (port 443), DNS resolution, and HTTP Host header. Each content match is anchored to the start of its buffer ('startswith') so a different domain that merely contains 'corp.tripswithengine.com' as a suffix of a longer label (e.g. 'notcorp.tripswithengine.com') cannot match — only this exact domain or a genuine subdomain of it triggers.
Detects egress to the NeedyMantis C2 domain corp.tripswithengine[.]com across three vantage points: TLS SNI (port 443), DNS resolution, and HTTP Host header. Each content match is anchored to the start of its buffer ('startswith') so a different domain that merely contains 'corp.tripswithengine.com' as a suffix of a longer label (e.g. 'notcorp.tripswithengine.com') cannot match — only this exact domain or a genuine subdomain of it triggers.
Detects egress to the NeedyMantis C2 domain corp.tripswithengine[.]com across three vantage points: TLS SNI (port 443), DNS resolution, and HTTP Host header. Each content match is anchored to the start of its buffer ('startswith') so a different domain that merely contains 'corp.tripswithengine.com' as a suffix of a longer label (e.g. 'notcorp.tripswithengine.com') cannot match — only this exact domain or a genuine subdomain of it triggers.
Detects egress to the NeedyMantis C2 domain corp.tripswithengine[.]com across three vantage points: TLS SNI (port 443), DNS resolution, and HTTP Host header. Each content match is anchored to the start of its buffer ('startswith') so a different domain that merely contains 'corp.tripswithengine.com' as a suffix of a longer label (e.g. 'notcorp.tripswithengine.com') cannot match — only this exact domain or a genuine subdomain of it triggers.
Detects NeedyMantis' WebSockets comms-module handshake: an outbound HTTP GET to port 443 whose User-Agent is EXACTLY the hard-coded literal 'firefox/21.0' (anchored start+end, not a substring of a real browser UA) AND whose headers contain an explicit 'Upgrade: websocket' value. Anchoring the UA to an exact match and requiring the literal upgrade header (rather than just the presence of an 'Upgrade' header name) removes legitimate WebSocket apps and any app whose real UA merely contains 'firefox/21.0' as a substring.
Detects NeedyMantis' WebSockets comms-module handshake: an outbound HTTP GET to port 443 whose User-Agent is EXACTLY the hard-coded literal 'firefox/21.0' (anchored start+end, not a substring of a real browser UA) AND whose headers contain an explicit 'Upgrade: websocket' value. Anchoring the UA to an exact match and requiring the literal upgrade header (rather than just the presence of an 'Upgrade' header name) removes legitimate WebSocket apps and any app whose real UA merely contains 'firefox/21.0' as a substring.
Detects NeedyMantis' WebSockets comms-module handshake: an outbound HTTP GET to port 443 whose User-Agent is EXACTLY the hard-coded literal 'firefox/21.0' (anchored start+end, not a substring of a real browser UA) AND whose headers contain an explicit 'Upgrade: websocket' value. Anchoring the UA to an exact match and requiring the literal upgrade header (rather than just the presence of an 'Upgrade' header name) removes legitimate WebSocket apps and any app whose real UA merely contains 'firefox/21.0' as a substring.
Detects NeedyMantis' WebSockets comms-module handshake: an outbound HTTP GET to port 443 whose User-Agent is EXACTLY the hard-coded literal 'firefox/21.0' (anchored start+end, not a substring of a real browser UA) AND whose headers contain an explicit 'Upgrade: websocket' value. Anchoring the UA to an exact match and requiring the literal upgrade header (rather than just the presence of an 'Upgrade' header name) removes legitimate WebSocket apps and any app whose real UA merely contains 'firefox/21.0' as a substring.
Detects incoming web requests containing a 'pagename' parameter with URL-encoded path traversal sequences, which could allow unauthorized file access or directory traversal attacks against WordPress page-template resolution as described in CVE-2026-87902.
Detects network indicators associated with the Exvicy/ErrTraffic 'ClickFix' campaign. The rule identifies the retrieval of malicious HTML lure templates from compromised WordPress sites and subsequent telemetry/registration calls to an attacker-controlled 'api.php' script, which are precursors to the fake Cloudflare Turnstile 'Win+R' execution sequence.
Detects high-frequency authentication attempts originating from user agents associated with automation frameworks (Selenium, Playwright, Puppeteer, etc.). This pattern is often indicative of automated credential stuffing, brute force attacks, or CAPTCHA/2FA bypass attempts orchestrated by headless browsers.
This rule detects HTTP requests where the User-Agent header indicates a PowerShell execution occurring from a system configured with the zh-CN locale. This pattern is often associated with automated scripts or potential malicious activity masquerading as legitimate PowerShell traffic.
Detection of common web server reconnaissance, enumeration, and brute-force patterns targeting IIS environments. This includes detection of short-name (~1) probes, WebDAV method usage, NTFS alternate data stream requests, and brute-force attempts on login endpoints originating from PowerShell user agents.
Detects network activity (DNS, TLS, HTTP) associated with suspected C2 infrastructure hosted on Cloudflare Workers, specifically identifying patterns consistent with trojanized authentication pages acting as browser-based C2 relays or WebRTC/WebSocket signaling channels.
Page 25 of 202