Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,303 detections
Filters
Last updated
All Time
Detection languages
2,251
22
21
7
2
Contributors
910
584
506
125
48
Categories
20,427
11,813
5,871
5,145
4,864
2,303
Platforms
2,190
209
168
62
61
Products / Services
2,250
2,159
163
32
31
MITRE Techniques
713
422
384
187
184
CVEs
17
12
12
12
10
IDS Classtypes
995
426
281
190
98
IDS Protocols
1,291
401
281
117
45
This rule detects unauthorized or unauthenticated attempts to call the NetrServerPasswordSet2 method on a Domain Controller via the MS-NRPC (Netlogon) interface, which is indicative of an exploitation attempt related to CVE-2020-1472 (Zerologon). This vulnerability allows an attacker to bypass authentication and reset a Domain Controller's computer account password, leading to full domain compromise.
Detects anomalous WebSocket upgrade requests using a suspicious Firefox/21.0 User-Agent followed by a C2 buffer containing 'google.com' associated with the NeedyMantis threat actor group.
Detects network activity associated with ORAX Phishing-as-a-Service (PhaaS), specifically identifying fake Cloudflare security-verification pages and emoji-based CAPTCHA gates used as anti-analysis techniques to frustrate automated sandboxing.
This rule detects network traffic patterns associated with the ARToken phishing campaign, specifically identifying access to lure pages hosted on 'workers.dev' domains with 'docviewer' in the hostname and 'turnstile' challenge responses in the HTTP body, which is used for anti-analysis/evasion.
Detects network traffic patterns associated with the ORAX/OraxRDP AiTM (Adversary-in-the-Middle) phishing toolkit. The rule monitors for specific SignalR WebSocket upgrade requests and session-related GraphQL commands (such as MirrorChallenge, Init, and Input) used to facilitate MFA relay and web session hijacking.
Detects HTTP traffic where a common automated scanner or sandbox user agent triggers an immediate redirect to 'about:blank', a common technique used by phishing kits to hide content from automated security analysis tools.
Detects network indicators associated with the ORAX Phishing-as-a-Service (PhaaS) platform. This includes patterns for emoji-matching CAPTCHAs, spoofed Cloudflare security pages, specific wildcard subdomain DNS queries, and the use of anti-analysis gate sequences to prevent sandbox inspection.
Detects network indicators and session patterns associated with the JWR Phishing Framework, specifically targeting its WebSocket-based command and control (C2) communication, client engine (main.js/ws-worker.js) retrieval, and unique session token (JWRCVV) usage.
Detects HTTP and TLS traffic directed toward Vercel subdomains (vercel.app) that are consistent with known patterns for document-lure phishing or gated ZIP file distribution, often used for RMM-phishing campaigns.
Detects HTTP requests to Vercel deployment domains where the requested resource is a specific phishing kit asset ('font1.woff2'). This pattern is commonly associated with phishing campaigns hosted on free web hosting platforms.
Detection of network traffic patterns associated with the NovaCookies Adversary-in-the-Middle (AiTM) phishing kit. The rules monitor for DNS queries for .vu domains, HTTP requests to lookalike Microsoft 365 login pages hosted on .vu domains, POST requests containing credential data, and the receipt of specific session cookies (ESTSAUTH) indicative of successful AiTM session interception.
Detects network activity associated with the OnyxC2 malware, including DNS queries to .top TLDs for beaconing, subsequent HTTP check-ins to .top domains, and known TLS SNI matches for OnyxC2 C2 infrastructure.
This rule detects HTTP POST requests to the 'wp-login.php' endpoint of a WordPress installation where the 'log' (username) and 'pwd' (password) fields are both set to 'admin'. This is a common signature for automated brute-force or credential-stuffing attacks targeting default administrator credentials.
Detects network activity associated with a malicious NPM package (typosquatting) beaconing to a known C2 server (69.48.229.140) and performing command and control operations, including command polling and data exfiltration, specifically from a Node.js environment.
Detects network activity associated with a malicious NPM package (typosquatting) beaconing to a known C2 server (69.48.229.140) and performing command and control operations, including command polling and data exfiltration, specifically from a Node.js environment.
Detects network activity associated with a malicious NPM package (typosquatting) beaconing to a known C2 server (69.48.229.140) and performing command and control operations, including command polling and data exfiltration, specifically from a Node.js environment.
This rule monitors for outbound TCP and HTTP traffic to a known malicious infrastructure hosting a fake or compromised 'Corp MDM' (Mobile Device Management) admin panel, which serves as a Command and Control (C2) channel for spyware.
Detects a burst of Kerberos TGS-REQ (Ticket-Granting Service Request) messages using RC4 encryption (etype 0x17) over UDP or TCP port 88. A high volume of these requests from a single source within a short timeframe is indicative of Kerberoasting, a technique where an attacker requests service tickets to perform offline password cracking of service account credentials.
Detects anomalous MS-DRSR DRSGetNCChanges requests occurring between hosts where the requester is not a recognized Domain Controller. This pattern is commonly used by attackers to perform a DCSync attack, allowing for the replication of sensitive Active Directory data such as user password hashes.
Detects attempts to access or execute a file named 'cmd.jar' within the Cisco Firepower Management Center (FMC) or Cisco Security Manager (CSM) environment. This filename is associated with web shell activities used for unauthorized command execution on vulnerable Cisco appliances.
Detects network traffic associated with the Havoc C2 framework Demon agent. The rules identify specific HTTP request headers, response headers, and URI patterns (such as /funny_cat.gif, /test.txt, and /helloworld.js) used by the agent for beaconing and command-and-control communication.
Page 24 of 110