Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,230 detections
Filters
Last updated
All Time
Detection languages
2,175
1,018
354
260
212
Contributors
1,013
818
688
574
212
Categories
20,456
11,839
5,876
5,155
4,865
4,230
Platforms
2,933
889
585
248
198
Products / Services
2,239
1,453
841
416
344
MITRE Techniques
1,164
1,087
870
798
439
CVEs
22
20
20
18
17
IDS Classtypes
927
408
222
146
104
IDS Protocols
1,914
105
70
47
6
Hunts network, HTTP, and email-URL telemetry for known ARToken infrastructure (operator backend IPs and phishing/panel domains). Bounded to a 30-day lookback and tiers matches by confidence: domain hits are high-confidence (attacker-registered infrastructure), while IP hits are medium-confidence since the IPs sit on shared DigitalOcean hosting that can be reassigned to unrelated tenants once ARToken's infrastructure is taken down. Empty/unparsed indicator fields are excluded to avoid spurious matches in the HTTP event parsing branch. No known file hashes are associated with this intel.
This rule monitors for interactions with known malicious files (by SHA256 hash), connections to confirmed C2 infrastructure (specific IP address and domains), or requests to known malicious URLs. It aggregates indicators across file, process, network, and web browsing telemetry to identify potential threats or compromised systems communicating with known attacker infrastructure.
This rule detects malicious activity by monitoring for specific known indicators, including hashes of malicious files (ProcessRollup2), network connections to known C2 infrastructure (NetworkConnectIP4), and URL clicks (UrlClick) associated with malicious domains or paths. It acts as a multi-stage indicator correlation rule to identify execution or communication with known threats.
This rule detects potential malicious activity by monitoring for known indicators of compromise, including specific SHA256 file hashes, a known malicious IP address, and URLs associated with identified threats. The detection spans file creation/execution, network connections, and URL visits to block or alert on interactions with suspicious infrastructure.
This rule detects potential malicious activity by monitoring for known indicators of compromise, including specific SHA256 file hashes, a known malicious IP address, and URLs associated with identified threats. The detection spans file creation/execution, network connections, and URL visits to block or alert on interactions with suspicious infrastructure.
This rule monitors for indicators of compromise (IOCs) associated with Operation SideCopy, including specific file hashes, known command-and-control (C2) IP addresses, malicious domains, and URLs. It triggers on file creation, process execution, and network connections matching these known indicators.
This rule detects outgoing HTTP POST requests that contain a ZIP file with a filename prefix of 'StolenData_' in the request body. This is a known behavior of the TokenGrabber stealer family, which exfiltrates collected victim data (e.g., browser credentials, session tokens) to a remote server, often via a Discord webhook or similar infrastructure.
Detects potential exploitation of CVE-2026-41940 affecting cPanel/WHM, where administrative actions occur without a preceding successful login event from the same source IP within a 30-minute window. This indicates an authentication bypass attempt.
Detects HTTP connections between internal hosts and suspected C2 infrastructure associated with the Operation SilkParasite campaign. The rule specifically monitors for connections to known malicious IPs and identifies the retrieval of a cloned RTX Corporation homepage content, which acts as a decoy for the SpiceRAT malware.
Detects outbound HTTP requests from endpoints to a known C2 infrastructure associated with mobile device spyware. The rule identifies two specific stages: polling for new commands using a GET request and posting command execution results using a POST request, both targeting an MDM-mimicking API structure.
Detects outbound HTTP requests from endpoints to a known C2 infrastructure associated with mobile device spyware. The rule identifies two specific stages: polling for new commands using a GET request and posting command execution results using a POST request, both targeting an MDM-mimicking API structure.
Detects cleartext HTTP POST requests to specific URI endpoints (/api/v1/devices/register or /api/v1/devices/heartbeat) known to be used by the Corp_MDM Android spyware for C2 communication, registration, or heartbeat signals.
Detects cleartext HTTP POST requests to specific URI endpoints (/api/v1/devices/register or /api/v1/devices/heartbeat) known to be used by the Corp_MDM Android spyware for C2 communication, registration, or heartbeat signals.
This rule monitors for outbound TCP and HTTP traffic to a known malicious infrastructure hosting a fake or compromised 'Corp MDM' (Mobile Device Management) admin panel, which serves as a Command and Control (C2) channel for spyware.
Detects an Android device registration attempt to a known malicious C2 IP address using parameters characteristic of a mobile device management (MDM) implant. The rule looks for a POST request to a specific registration endpoint containing device identifiers like deviceId, manufacturer, model, and osVersion.
Detects an Android device registration attempt to a known malicious C2 IP address using parameters characteristic of a mobile device management (MDM) implant. The rule looks for a POST request to a specific registration endpoint containing device identifiers like deviceId, manufacturer, model, and osVersion.
Detects an Android device registration attempt to a known malicious C2 IP address using parameters characteristic of a mobile device management (MDM) implant. The rule looks for a POST request to a specific registration endpoint containing device identifiers like deviceId, manufacturer, model, and osVersion.
Detects outbound network traffic and HTTP requests originating from the internal network destined for a known malicious infrastructure associated with 'Corp MDM'. The traffic includes C2 communication patterns, specific API URI paths, and potential login interactions on non-standard ports, consistent with phishing, malware delivery, or unauthorized administrative access.
Detects outbound network traffic and HTTP requests originating from the internal network destined for a known malicious infrastructure associated with 'Corp MDM'. The traffic includes C2 communication patterns, specific API URI paths, and potential login interactions on non-standard ports, consistent with phishing, malware delivery, or unauthorized administrative access.
Detects HTTP beaconing and command-and-control (C2) communication patterns consistent with the 'Corp_MDM' Android spyware, specifically heartbeat check-ins, command polling, and result reporting to a known malicious C2 IP address.
Detects HTTP beaconing and command-and-control (C2) communication patterns consistent with the 'Corp_MDM' Android spyware, specifically heartbeat check-ins, command polling, and result reporting to a known malicious C2 IP address.
Page 39 of 202