Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,306 detections
Filters
Last updated
All Time
Detection languages
2,251
24
22
7
2
Contributors
910
584
506
125
48
Categories
20,427
11,813
5,871
5,145
4,864
2,306
Platforms
2,193
209
169
62
61
Products / Services
2,253
2,159
163
32
31
MITRE Techniques
713
422
387
187
184
CVEs
17
12
12
12
10
IDS Classtypes
995
426
281
190
98
IDS Protocols
1,291
401
281
117
45
Detects an unauthenticated remote code execution attempt against AhsayCBS via the UpdateReceivers.do endpoint using the checkSysPwd parameter, associated with CVE-2026-105133 and CVE-2026-105134.
Detects an unauthenticated remote code execution attempt against AhsayCBS via the UpdateReceivers.do endpoint using the checkSysPwd parameter, associated with CVE-2026-105133 and CVE-2026-105134.
Detects outbound SMTP traffic associated withAVERAT malware, tracking the EHLO sequence, STARTTLS command negotiation, server acceptance, and subsequent custom TLS ClientHello patterns on port 25.
Detects outbound SMTP traffic associated withAVERAT malware, tracking the EHLO sequence, STARTTLS command negotiation, server acceptance, and subsequent custom TLS ClientHello patterns on port 25.
Detects HTTP responses and requests involving exposed Claude Code open directories (.claude/CLAUDE.md) tied to ARTEX operator infrastructure.
Detects HTTP traffic associated with the Wazza phishing kit anti-bot mechanism, including token minting requests, signed token responses, and validation checks.
Detects network traffic (DNS, TLS SNI, and HTTP) associated with Wazza phishkit infrastructure, specifically looking for malicious domains like boegl-krysl.eu and coppietersrecherche.eu, as well as Cloudflare workers.dev domains used for beaconing and lures.
Detects network traffic (DNS, TLS SNI, and HTTP) associated with Wazza phishkit infrastructure, specifically looking for malicious domains like boegl-krysl.eu and coppietersrecherche.eu, as well as Cloudflare workers.dev domains used for beaconing and lures.
Detects HTTP responses and TLS client connections associated with Adobe-themed device code phishing lure pages hosted on workers.dev, utilizing specific patterns and keywords such as 'Confirm to open document', 'VERIFICATION CODE', and long hyphenated domain structures.
Detects a multi-stage Wazza phishkit communication chain over HTTP, involving initial configuration retrieval, token minting, token firing, and subsequent redirection with signed tokens.
Detects HTTP requests and responses associated with the Wazza phishing kit, specifically targeting the /api/wazza-config endpoint and its wildcard routing configuration JSON responses.
Detects the handshake process for Blackwood/Chisel reverse SOCKS5 or TCP-over-HTTP tunneling to a known malicious Iranian-hosted C2 IP address. The detection matches specific HTTP headers used by the Chisel tool during its initialization phase.
Detects DNS lookups, TLS connections, and network traffic associated with the PoeLLM cryptominer communicating with Kryptex mining pools, as well as Stratum mining protocol login attempts.
Detects network activity associated with the TA419 threat group's 'Frameless' Browser-in-the-Browser (BitB) Adversary-in-the-Middle (AitM) phishing campaign. The rules identify unauthorized OAuth2 authorization requests to non-Microsoft hosts that match known malicious client IDs, the delivery of BitB overlay scripts, and the subsequent execution of malicious scripts correlated with OneDrive-themed lookalike redirects, indicating a credential theft attempt.
Detects outbound network traffic associated with the Azazel operation, including connections to identified C2 infrastructure, open directory/upload listeners, domain-specific staging servers, and exfiltration attempts to MEGA cloud storage endpoints.
Detects the Mir0Auth phishing kit sequence within a single HTTP flow: POST /task_queue.cs beacon followed by POST /context.go device-code request, both with application/octet-stream bodies. Requires both requests (flowbits) and exact path endings to limit false positives. SIDs made unique.
Detects the Mir0Auth phishing kit sequence within a single HTTP flow: POST /task_queue.cs beacon followed by POST /context.go device-code request, both with application/octet-stream bodies. Requires both requests (flowbits) and exact path endings to limit false positives. SIDs made unique.
Detects repeated octet-stream POST polling of /window.rs (5+ in 20s, alerting once per window), matching the ~3s Mir0Auth session polling while the victim completes device login. SID de-duplicated from another rule.
Detects repeated octet-stream POST polling of /window.rs (5+ in 20s, alerting once per window), matching the ~3s Mir0Auth session polling while the victim completes device login. SID de-duplicated from another rule.
Detects bursts (3+ in 60s) of octet-stream POSTs to URI paths ending in .cs/.go/.rs, matching Mir0Auth XOR-obfuscated C2. Path must be a single short segment and the threshold is raised to cut noise from dev/API traffic.
Detects P7 DarkSword implant C2 beaconing: HTTP/1.0 JSON POSTs to /beacon, /event or /a with the hardcoded iPhone OS 18_5 Safari 18.5 User-Agent. Requires the full combination of protocol version, method, URI, UA and content type, and alerts only after 3 matching requests from one source within 120 seconds (detection_filter) to suppress one-off matches.
Page 3 of 110