Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,230 detections
Filters
Last updated
All Time
Detection languages
2,175
1,018
354
260
212
Contributors
1,013
818
688
574
212
Categories
20,456
11,839
5,876
5,155
4,865
4,230
Platforms
2,933
889
585
248
198
Products / Services
2,239
1,453
841
416
344
MITRE Techniques
1,164
1,087
870
798
439
CVEs
22
20
20
18
17
IDS Classtypes
927
408
222
146
104
IDS Protocols
1,914
105
70
47
6
Detects OAuth 2.0 authorization requests sent to login.microsoftonline.com using the 'prompt=none' parameter, where the redirect_uri domain is not a trusted Microsoft property. This is a common indicator of consent phishing or malicious OAuth application abuse where an attacker attempts to redirect authorization tokens to an adversary-controlled endpoint.
Detects web traffic directed towards the AnonyMousKIT SMS relay API endpoint, commonly used by threat actors for dispatching SMS phishing lures. The rule monitors for requests to specific API paths related to SMS dispatching and analyzes the gateway status messages returned by the service.
Detects network requests (DNS queries or HTTP requests) to a predefined list of lookalike domains associated with the JWR phishing kit. These domains are designed to impersonate legitimate transport (LTA, OneMotoring, ERP) or courier/postal brands (Ninja Van, SingPost, Emirates Post) to deliver malicious payloads or credential harvesting pages.
Detects outbound network requests to VAPI.ai APIs that are associated with the initiation of AI-powered voice agents. This telemetry can indicate the use of automation or malicious scripts, such as those used by AnonyMousKIT to launch persona-based voice phishing (vishing) campaigns.
Detects the AnonyMousKIT vishing activity pattern by monitoring Twilio API call creation events followed by specific status or gather webhook callbacks from the same host within a one-hour window, consistent with automated voice phishing to collect DTMF-entered passcodes.
Detects the specific C2/WebSocket instruction sequence utilized by the JWR/Outsider phishing kit operators. The rule monitors DeviceNetworkEvents for characteristic outbound URL query parameters that indicate progress through a phishing interaction, including initial info collection (to_info), card data submission (to_card), and subsequent verification or outcome steps.
This rule detects DNS lookups, email URL clicks, and network connections involving lookalike domains that mimic Singaporean government or infrastructure services (e.g., LTA, OneMotoring, ERP, Gov.sg). It employs a regex-based pattern match for common brand-keywords combined with high-risk top-level domains, identifying potential phishing activity associated with the JWR framework that utilizes algorithmically varied, single-suffix rotated lookalike domains.
Detects the specific fingerprinting sequence associated with Mirage2FA AiTM phishing campaigns. The detection triggers when a process downloads a specific JavaScript loader from an '/xls/' path, followed closely within two minutes by an IP/geolocation lookup request to common services (api.ipify.org, api.country.is, api.ipgeolocation.io), which is a characteristic precursor to credential interception.
Detects HTTP beaconing activity characteristic of the OnyxC2 stealer malware, specifically identifying the synchronization command ('action=sync') containing hardcoded parameters for host identification and bot versioning.
Detects network activity associated with Adversary-in-the-Middle (AiTM) phishing kits that perform client-side fingerprinting and geolocation tracking. The rules identify the initial fingerprinting request, the subsequent setting of a geolocation cookie by the proxy, and the query to a third-party geolocation service, using state tracking to correlate the chain of events.
Detects network activity associated with the GhostCode kit's bot-filter challenge, which performs session token/hash chaining prior to a device-code phishing redirect. The rule monitors for specific URL patterns containing 'check=1' and a session identifier, coupled with a mandatory 'js_enabled=1' cookie, commonly used to filter automated security scanners and verify bot activity before serving malicious content.
Detects network activity associated with the GhostCode phishing campaign, which leverages themed pages (e.g., MailDashboard) and Cloudflare Turnstile to perform security bypass checks. The rules identify the initial access URI pattern, the presence of specific phishing content in the HTTP response, and the subsequent verification cookies used after the CAPTCHA solution.
Detects outbound web requests to the Telegram API triggered by Google Apps Script components (sidebar macros). This pattern is indicative of malicious Google Docs or Slides files using embedded scripts to exfiltrate data or perform command-and-control communication via the Telegram API when the document is opened by a user.
These rules monitor for suspicious WordPress authentication activity, including brute force and credential spraying attacks targeting XML-RPC endpoints and the standard wp-login.php interface. The rule set includes detections for high-frequency login attempts and subsequent indicators of potential successful authentication.
Detects network traffic (DNS, TLS SNI, and HTTP Host headers) attempting to communicate with infrastructure associated with the EvilTokens Phishing-as-a-Service (PhaaS) platform. This activity is indicative of credential harvesting or adversary-in-the-middle (AiTM) attacks.
Detects anomalous POST requests containing the 'CrpxBoundary' string sent to a '/relay.php' endpoint. This signature is associated with the pre-encryption data exfiltration phase of CRPx0 ransomware.
This rule detects incoming HTTP POST requests to the '/api/v1/validate/code' endpoint of a Langflow instance. The rule specifically looks for a JSON key 'code' containing a large, potentially base64-encoded string, which indicates an attempt to exploit CVE-2025-3248 to achieve unauthenticated remote code execution.
Detects web requests to 'wp-admin/theme-install.php' containing suspicious query parameters that indicate an attempt to force an unauthenticated theme installation via a Cross-Site Request Forgery (CSRF) exploit (Click2Shell). The rule identifies requests with malicious payloads in the 'theme' parameter, specifically looking for indicators that attempt to bypass CSRF protections when originating from an external site or a non-admin session context.
Detects endpoint, process, and network activity associated with the 'TaskStomp' threat actor, specifically targeting known malicious file hashes, command-and-control domains, and specific URLs used in their campaigns.
Detects adversary-in-the-middle (AiTM) phishing activity utilizing reverse-proxy kits (such as Evilginx2, EvilProxy, or Modlishka) to bypass MFA. The rule identifies suspicious login requests by correlating common identity provider login paths with missing security headers (CSP/HSTS) and anomalous server or hostname characteristics typical of proxied phishing infrastructure.
Detects potential Adversary-in-the-Middle (AiTM) phishing activity by identifying requests to common tunneling services (e.g., ngrok, Cloudflare Tunnel) that include suspicious authentication or login-related URI paths, correlated with referrers from well-known email providers.
Page 42 of 202