Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,230 detections
Filters
Last updated
All Time
Detection languages
2,175
1,018
354
260
212
Contributors
1,013
818
688
574
212
Categories
20,456
11,839
5,876
5,155
4,865
4,230
Platforms
2,933
889
585
248
198
Products / Services
2,239
1,453
841
416
344
MITRE Techniques
1,164
1,087
870
798
439
CVEs
22
20
20
18
17
IDS Classtypes
927
408
222
146
104
IDS Protocols
1,914
105
70
47
6
Detects DNS queries, TLS SNI headers, and HTTP host headers associated with the known exfiltration domain 't.m-kosche.com' linked to the Mini Shai-Hulud malware.
Detects DNS queries, TLS SNI headers, and HTTP host headers associated with the known exfiltration domain 't.m-kosche.com' linked to the Mini Shai-Hulud malware.
Detects outbound network traffic from internal hosts to public Telegram Bot API or Slack webhooks, indicative of potential data exfiltration by the npm indexed-btree malware or similar malicious actors utilizing these services for command and control or exfiltration.
Detects network activity initiated by Node.js processes towards specific Infura and Alchemy RPC endpoints for the Sepolia testnet, including specific JSON-RPC queries containing potential malicious contract addresses. This pattern is indicative of C2 communication using legitimate Web3 infrastructure.
Detects network traffic associated with the malicious npm package 'indexed-btree', which uses the Telegram Bot API to exfiltrate data. The rules monitor for connections to api.telegram.org via HTTPS and identify specific hardcoded bot tokens and chat IDs associated with the malicious campaign.
This rule detects potential Adversary-in-the-Middle (AiTM) phishing activity by correlating network requests to known malicious lure domains with help-desk or vishing-themed events (such as password resets or unsolicited IT support) for the same user within a one-hour window. This behavior is indicative of a help-desk impersonation campaign where attackers direct users to credential harvesting sites.
Hunts network, HTTP, and email-URL telemetry for known ARToken infrastructure (operator backend IPs and phishing/panel domains). Bounded to a 30-day lookback and tiers matches by confidence: domain hits are high-confidence (attacker-registered infrastructure), while IP hits are medium-confidence since the IPs sit on shared DigitalOcean hosting that can be reassigned to unrelated tenants once ARToken's infrastructure is taken down. Empty/unparsed indicator fields are excluded to avoid spurious matches in the HTTP event parsing branch. No known file hashes are associated with this intel.
Detects anomalous spikes in inference API request volume per caller, correlated with increased p95 latency and elevated error rates (5xx or 408). This behavior is characteristic of a denial-of-service attack targeting AI inference endpoints, potentially exhausting backend resources and disrupting service availability.
Detects anomalous high-frequency requests to machine learning model endpoints from a single client, a pattern indicative of model extraction (stealing) attacks. This rule monitors inference request paths and success statuses to identify potential systematic input-space probing.
Detects anomalous high-volume API requests from a single user/key to AI model inference endpoints. The rule tracks query diversity and total volume within an hour to identify behavior consistent with model extraction or cloning (AML.T0024.002) via systematic input/output pair collection.
Detects anomalous high-frequency queries to machine learning model inference endpoints involving probability or confidence score outputs. This behavior is indicative of a membership inference attack, where an adversary attempts to determine if specific data samples were included in a model's training set by harvesting confidence scores.
Detects anomalous high-frequency queries to machine learning model inference endpoints involving probability or confidence score outputs. This behavior is indicative of a membership inference attack, where an adversary attempts to determine if specific data samples were included in a model's training set by harvesting confidence scores.
Detects potential Denial of Service (DoS) against AI/LLM inference endpoints. It monitors for high-frequency request spikes or abnormally large request payloads (oversized context windows) directed at common model endpoints that could lead to disproportionate compute resource consumption.
Detects network activity associated with the 'ClickFix' campaign, specifically targeting the cdnsuicaches[.]com domain. The rules identify the initial DNS query, the subsequent TLS SNI connection, and the retrieval of malicious JavaScript containing the 'cookie-captcha-complete' overlay signature. This behavior is indicative of a browser-based social engineering attack.
Detects high-frequency, automated API requests to commercial Large Language Model (LLM) endpoints from a single source IP. The rule identifies suspicious activity characterized by a rapid rotation of multiple API tokens, often indicative of an intermediary proxy or middleware service attempting to bypass provider-specific usage limits, billing controls, or safety guardrails.
Detects repeated, suspicious HTTP requests targeting sensitive management or administrative interfaces (e.g., /admin, /wp-admin, /cgi-bin) that utilize obfuscated, unusually encoded payloads. This activity is consistent with automated attempts to exploit recently disclosed vulnerabilities where traditional WAF/IDS signatures have been bypassed or failed to trigger high-confidence alerts.
Detects outbound HTTP requests to the Telegram Bot API associated with the malicious 'indexed-btree' npm package. The rule specifically monitors for hardcoded Telegram bot tokens and chat IDs used for data exfiltration.
Detects outbound HTTP requests to the Telegram Bot API associated with the malicious 'indexed-btree' npm package. The rule specifically monitors for hardcoded Telegram bot tokens and chat IDs used for data exfiltration.
Detects outbound network traffic attempting to exfiltrate data to Slack or Telegram APIs using hardcoded bot tokens or channel identifiers associated with the 'indexed-btree' malware campaign.
Detects outbound HTTP POST requests to known public Ethereum RPC gateways (Alchemy and Infura) containing embedded, hardcoded API keys or references to specific contract addresses associated with the 'indexed-btree' malware campaign. This pattern indicates a compromised host leveraging legitimate Web3 infrastructure for Command and Control (C2) communication.
Detects high-volume, systematic querying of LLM inference endpoints, which may indicate unauthorized model extraction, distillation attempts, or targeted data exfiltration from an LLM.
Page 50 of 202