Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,306 detections
Filters
Last updated
All Time
Detection languages
2,251
24
22
7
2
Contributors
910
584
506
125
48
Categories
20,427
11,813
5,871
5,145
4,864
2,306
Platforms
2,193
209
169
62
61
Products / Services
2,253
2,159
163
32
31
MITRE Techniques
713
422
387
187
184
CVEs
17
12
12
12
10
IDS Classtypes
995
426
281
190
98
IDS Protocols
1,291
401
281
117
45
Detects network activity (DNS queries, HTTP Host headers, and TLS SNI) directed towards the known Blinder Tunnel staging domain 'asdfafadafg.online'. This behavior is indicative of command-and-control (C2) communication or initial staging of malicious payloads.
Detects HTTP, TLS, DNS, and TCP communication with known AhsayCBS campaign infrastructure and Alibaba OSS storage buckets used for payload delivery.
Detects an unauthenticated remote code execution attempt against AhsayCBS via the UpdateReceivers.do endpoint using the checkSysPwd parameter, associated with CVE-2026-105133 and CVE-2026-105134.
Detects DNS lookups, TLS connections, and network traffic associated with the PoeLLM cryptominer communicating with Kryptex mining pools, as well as Stratum mining protocol login attempts.
Detects connections from internal hosts to the ARTEX-linked actor host 38.244.50.120, including requests for the exposed .claude/CLAUDE.md file and its open-directory port 18899.
Detects outbound SMTP traffic associated withAVERAT malware, tracking the EHLO sequence, STARTTLS command negotiation, server acceptance, and subsequent custom TLS ClientHello patterns on port 25.
Detects network traffic associated with Wazza phishkit anti-bot gates, including beacon communications, TLS SNI patterns, fingerprint iframe URIs, and challenge-platform requests.
Detects HTTP responses and TLS client connections associated with Adobe-themed device code phishing lure pages hosted on workers.dev, utilizing specific patterns and keywords such as 'Confirm to open document', 'VERIFICATION CODE', and long hyphenated domain structures.
Detects an exploitation attempt against PoeLLM or LiteLLM MCP test/connection endpoint using a python3 stdio payload that fetches data from port 81.
Detects outbound network traffic matching XMRig Monero cryptocurrency miner stratum login behavior originating from an internal host.
Detects HTTP, TLS, DNS, and TCP communication with known AhsayCBS campaign infrastructure and Alibaba OSS storage buckets used for payload delivery.
Detects repeated octet-stream POST polling of /window.rs (5+ in 20s, alerting once per window), matching the ~3s Mir0Auth session polling while the victim completes device login. SID de-duplicated from another rule.
Detects P7 DarkSword implant C2 beaconing: HTTP/1.0 JSON POSTs to /beacon, /event or /a with the hardcoded iPhone OS 18_5 Safari 18.5 User-Agent. Requires the full combination of protocol version, method, URI, UA and content type, and alerts only after 3 matching requests from one source within 120 seconds (detection_filter) to suppress one-off matches.
Detects the handshake process for Blackwood/Chisel reverse SOCKS5 or TCP-over-HTTP tunneling to a known malicious Iranian-hosted C2 IP address. The detection matches specific HTTP headers used by the Chisel tool during its initialization phase.
Detects HTTP responses and requests involving exposed Claude Code open directories (.claude/CLAUDE.md) tied to ARTEX operator infrastructure.
Detects DNS lookups, TLS connections, and network traffic associated with the PoeLLM cryptominer communicating with Kryptex mining pools, as well as Stratum mining protocol login attempts.
Detects DNS lookups, TLS connections, and network traffic associated with the PoeLLM cryptominer communicating with Kryptex mining pools, as well as Stratum mining protocol login attempts.
Detects outbound network traffic matching XMRig Monero cryptocurrency miner stratum login behavior originating from an internal host.
Detects outbound network traffic matching XMRig Monero cryptocurrency miner stratum login behavior originating from an internal host.
Detects outbound network traffic matching XMRig Monero cryptocurrency miner stratum login behavior originating from an internal host.
Detects HTTP, TLS, DNS, and TCP communication with known AhsayCBS campaign infrastructure and Alibaba OSS storage buckets used for payload delivery.
Page 2 of 110