Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,230 detections
Filters
Last updated
All Time
Detection languages
2,175
1,018
354
260
212
Contributors
1,013
818
688
574
212
Categories
20,456
11,839
5,877
5,156
4,865
4,230
Platforms
2,933
889
585
248
198
Products / Services
2,239
1,453
841
416
344
MITRE Techniques
1,164
1,087
870
798
439
CVEs
22
20
20
18
17
IDS Classtypes
927
408
222
146
104
IDS Protocols
1,914
105
70
47
6
Detects HTTP traffic identified as Sauron Loader, characterized by specific POST requests to hardcoded domains, URI path structures, and user-agent strings indicative of automated C2 activity.
Detects HTTP traffic identified as Sauron Loader, characterized by specific POST requests to hardcoded domains, URI path structures, and user-agent strings indicative of automated C2 activity.
This rule detects potentially malicious C2 communication by monitoring high-frequency HTTP POST requests from the 'rnpkeys.exe' process. It aggregates network events over 30-second windows and flags activity exceeding a threshold of 5 POST requests directed at known suspicious domains or specific high-port network destinations, which is characteristic of beaconing or data exfiltration activity.
Detects network activity, including HTTP requests and TLS SNI traffic, directed towards the known GRIMWEDGE C2 domain 'ocr.opusaccel.top'. This includes monitoring for repeated polling behavior indicative of a command and control heartbeat mechanism.
Detects a network request to download a file named 'msgbox.exe' using the curl command-line utility, consistent with the activity observed from threat actor UTA0560 (GRIMWEDGE). This rule monitors for HTTP GET requests targeting the specific file path while the User-Agent string begins with 'curl/'.
Detects network indicators associated with the BambooToken C2 infrastructure, including DNS lookups for specific domains, TLS SNI mismatches, non-standard MQTT port usage, and specific command-and-control tasking keywords within MQTT payloads.
This rule correlates web clicks on Google Sites URLs containing keywords related to GlobalProtect with the subsequent creation or renaming of an unsigned or improperly signed GlobalProtect.msi file on the same endpoint within a 30-minute window. This behavior is indicative of a spearphishing attempt using a masqueraded landing page to deliver malicious or unauthorized software.
This rule correlates web clicks on Google Sites URLs containing keywords related to GlobalProtect with the subsequent creation or renaming of an unsigned or improperly signed GlobalProtect.msi file on the same endpoint within a 30-minute window. This behavior is indicative of a spearphishing attempt using a masqueraded landing page to deliver malicious or unauthorized software.
This rule detects HTTP GET requests containing suspicious URL query parameters (nfe_valid_access_key_2026_secure or chave_tecl_cresol) that are associated with phishing kits targeting Brazilian taxpayers, often used to deliver or facilitate HVNC (Hidden Virtual Network Computing) remote access tools.
Detects outbound HTTP GET requests containing an 'auth=' parameter with a long string of alphanumeric characters, characteristic of an OAuth token exfiltration attempt by a malicious Twitch extension (JeetBot). The rule flags requests to external destinations that are not official Twitch, Twitch Video Network, or JTV domains.
Detects network traffic associated with the WallStealer malware, including the download of malicious payloads from a known C2 server, communication with a cryptominer C2, and the use of Steam Community profiles as dead-drop resolvers for C2 instructions.
Detects network communication associated with the Rapuncel MaaS (Malware-as-a-Service) campaign, specifically identifying the Command and Control (C2) connection, GitHub Pages-based redirect chains, and subsequent delivery of large, suspicious ZIP archives containing renamed executable/system files.
This rule detects potential NTLM relay or authentication downgrade attempts by monitoring HTTP POST requests to the Certificate Enrollment Service (CES) endpoint. It specifically flags when an 'Authorization' header contains an NTLM-wrapped 'Negotiate' token, which is often indicative of an attacker attempting to coerce or relay authentication material to the service.
Detects malicious network activity associated with TokenGrabber stealer malware, specifically identifying outbound HTTP requests to public IP lookup services (api.ipify.org) followed by chained geolocation lookups (ip-api.com). This behavior is characteristic of an initial reconnaissance phase where the malware determines the victim's external network footprint.
Detects endpoint, process, and network activity associated with the 'TaskStomp' threat actor, specifically targeting known malicious file hashes, command-and-control domains, and specific URLs used in their campaigns.
Detects malicious network activity associated with TokenGrabber stealer malware, specifically identifying outbound HTTP requests to public IP lookup services (api.ipify.org) followed by chained geolocation lookups (ip-api.com). This behavior is characteristic of an initial reconnaissance phase where the malware determines the victim's external network footprint.
Detects outbound HTTP POST requests to known blockchain RPC endpoints (bsc-dataseed and rpc.ankr.com) that utilize the 'eth_call' method. This behavior is associated with the ClearFake malware strain using the EtherHiding technique, where malicious scripts or payloads are hidden or retrieved via blockchain smart contracts.
This rule monitors HTTP traffic for requests containing 'bp.dat', which is associated with the registration phase of the Latrodectus malware downloader. It detects both URI-based and request body-based attempts by an infected host to register with a command and control server.
Detects outbound network traffic containing the hardcoded user-agent string 'Remcos', which is indicative of a Remcos RAT beacon communicating with a command-and-control (C2) server. The rule inspects HTTP requests to identify this specific malware signature within the established communication flow.
Detects network activity associated with ngrok tunnel domains or suspicious lookalike Microsoft SSO domains (microsoft-sso.com) attempting to perform OIDC discovery, JWKS retrieval, or MFA-related EAM endpoint interactions. This behavior is indicative of adversary-in-the-middle (AiTM) attacks targeting authentication processes.
This rule monitors network traffic, DNS queries, and user web clicks to detect interactions with known malicious domains associated with credential harvesting and phishing campaigns, specifically those impersonating security or SSO portals.
Page 27 of 202