Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,230 detections
Filters
Last updated
All Time
Detection languages
2,175
1,018
354
260
212
Contributors
1,013
818
688
574
212
Categories
20,456
11,839
5,876
5,155
4,865
4,230
Platforms
2,933
889
585
248
198
Products / Services
2,239
1,453
841
416
344
MITRE Techniques
1,164
1,087
870
798
439
CVEs
22
20
20
18
17
IDS Classtypes
927
408
222
146
104
IDS Protocols
1,914
105
70
47
6
Detects outbound HTTP requests to 'relay.php' containing a static authorization bearer token 'crpx0_c2_2026', which is associated with the command and control activity of the CRPx0 ransomware family.
Detects network traffic associated with the AdaptixC2 framework agent check-in process. The rule looks for specific HTTP GET request patterns, including URI paths commonly used by the agent, session-related cookies, and Content-Type headers set to application/octet-stream.
Detects network traffic associated with NGate Android malware communicating with its Command and Control (C2) server. The rule monitors for specific HTTP POST patterns, including an 'okhttp' user-agent and binary body content characteristic of NFC relay relay attempts used for fraudulent payment activities.
Detects outbound HTTP POST requests directed towards Internet Computer Protocol (ICP) canister gateways (e.g., icp0.io, ic0.app) containing specific API path patterns (/api/v2/canister/) used for executing queries or calls. The rule specifically flags traffic lacking common browser-like User-Agent strings, which is a common indicator of automated command-and-control beacons using these services as proxy infrastructure.
Detects network beaconing activity associated with the TuxBot v3 IoT botnet. The rule identifies specific User-Agent strings (TuxBot/3, BusyBox wget, Wget/1.x), requests for .elf files, and connections to suspicious top-level domains frequently used for botnet command-and-control (C2) infrastructure.
This rule detects attempts to exploit a vulnerability in Cisco IOS XE devices (specifically related to CVE-2025-20188) by identifying suspicious Authorization headers containing JWT tokens ('Bearer eyJ...') targeted at the '/webui/' endpoint. This behavior is associated with Akira ransomware exploitation efforts against networking infrastructure.
This rule detects network communication associated with the AMOS (Atomic macOS) Stealer malware. Specifically, it identifies inbound HTTP GET requests directed at the '/api/shell/agent' URI, which is used by the stealer to retrieve instructions or trigger remote shell operations from its command and control (C2) server.
Detects HTTP POST requests targeting the '/api/credentials' path on non-standard port 8133, which is indicative of AMOS (Atomic macOS Stealer) malware exfiltrating stolen credentials to a remote command and control server.
Detects network traffic associated with AMOS (Atomic macOS) Stealer malware, identifying C2 beaconing and tasking requests. The rules specifically monitor POST requests to '/api/t' with JSON payloads and GET requests to '/api/shell/agent' over non-standard ports (excluding 80 and 443).
Detects HTTP GET requests to external URIs matching a specific pattern (a 10-20 character hexadecimal path followed by ?force=1), which is characteristic of the delivery or staging mechanism used by MacStealer (Macfinger) and Atomic macOS Stealer (AMOS) malware families.
Detects network traffic associated with the 'ClickFix' technique, where malicious websites masquerade as legitimate CAPTCHA or bot-protection services to exfiltrate visitor telemetry via POST requests or fetch malicious script overlays.
This rule detects the two-stage network behavior of AMOS (Atomic macOS Stealer). First, it identifies the initial C2 registration beaconing to an '/api/t' endpoint. Subsequently, it monitors for an immediate follow-up TLS connection to 'ipinfo.io', which is commonly used by the malware for geolocation and victim system reconnaissance.
Detects multiple HTTP POST requests to a specific credential-related API path (/api/credentials) directed at an external IP address (95.163.153.80) on a non-standard port (8133). This pattern is indicative of potential automated credential exfiltration or brute-force activity.
Detects HTTP GET requests associated with the delivery of AMOS (Atomic macOS Stealer) payloads. This rule monitors for specific URL patterns (force=1) used by stager scripts to fetch Mach-O binary payloads from known malicious infrastructure or matching known malicious file hashes.
Detects HTTP GET requests associated with the delivery of AMOS (Atomic macOS Stealer) payloads. This rule monitors for specific URL patterns (force=1) used by stager scripts to fetch Mach-O binary payloads from known malicious infrastructure or matching known malicious file hashes.
Detects the presence of injected 'ganalytics-tracker-js' script on compromised webpages and the subsequent browser-initiated requests for the malicious 't.js' script. This is associated with ClickFix attack campaigns where users are socially engineered into executing malicious code.
Detects HTTP POST requests to a /collect endpoint containing visitorId and stage parameters, which is characteristic of ClickFix-style fake bot-protection overlays used to trick users into executing malicious scripts under the guise of security verification.
Detects a pattern of frequent (6 or more per minute) small HTTP POST requests (up to 16KB) targeting specific sensitive API or internal URI paths. The detection logic also filters for traffic originating from a specific Microsoft Edge browser user agent string on Windows 64-bit systems, which may indicate automated data exfiltration, beaconing, or communication with a Command and Control (C2) server.
This rule detects two-stage suspicious network activity: first, a POST request to a known Sauron Loader C2 endpoint ('/api/t'), and second, a subsequent TLS connection to 'ipinfo.io' used for geolocation. The correlation is achieved using flowbits to track the infection lifecycle.
Detects DNS lookup queries and HTTP POST beaconing attempts directed at known Sauron Loader C2 fallback infrastructure. The rule tracks specific domains associated with the malware's encrypted registration and command-and-control behavior.
Detects network beaconing activity associated with AMOS Stealer command-and-control communication. The rule identifies HTTP POST requests to the '/api/t' path with a JSON content type over port 8133, using a threshold to identify sustained communication patterns.
Page 46 of 202