Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,303 detections
Filters
Last updated
All Time
Detection languages
2,251
22
21
7
2
Contributors
910
584
506
125
48
Categories
20,427
11,813
5,871
5,145
4,864
2,303
Platforms
2,190
209
168
62
61
Products / Services
2,250
2,159
163
32
31
MITRE Techniques
713
422
384
187
184
CVEs
17
12
12
12
10
IDS Classtypes
995
426
281
190
98
IDS Protocols
1,291
401
281
117
45
Detects outbound TCP traffic originating from the internal network destined for a known RMRLX RAT command and control (C2) server on port 4561. This signature identifies the client-side 'hello' beaconing behavior characteristic of this specific malware.
This rule detects outgoing HTTP POST requests that contain a ZIP file with a filename prefix of 'StolenData_' in the request body. This is a known behavior of the TokenGrabber stealer family, which exfiltrates collected victim data (e.g., browser credentials, session tokens) to a remote server, often via a Discord webhook or similar infrastructure.
Detects HTTP connections between internal hosts and suspected C2 infrastructure associated with the Operation SilkParasite campaign. The rule specifically monitors for connections to known malicious IPs and identifies the retrieval of a cloned RTX Corporation homepage content, which acts as a decoy for the SpiceRAT malware.
Detects network traffic involving TLS certificates or Server Name Indication (SNI) values that attempt to impersonate the Uzbekistan state railway authority (azure.uzrailwaystax.com). The rules also flag connections associated with certificates issued by 'TLC DV TLS CA' and known C2 infrastructure using the spoofed railway certificate.
Detects network communication with infrastructure identified as SilkParasite command and control by matching specific TLS certificate subjects and SHA-256 fingerprints associated with SpiceRAT.
This rule detects attempts to exploit CVE-2021-33044 in Dahua devices, specifically targeting the NetKeyboard clientType during the global.login RPC request. This vulnerability allows an unauthenticated remote attacker to bypass authentication mechanisms.
Detects outbound HTTP requests from endpoints to a known C2 infrastructure associated with mobile device spyware. The rule identifies two specific stages: polling for new commands using a GET request and posting command execution results using a POST request, both targeting an MDM-mimicking API structure.
Detects cleartext HTTP POST requests to specific URI endpoints (/api/v1/devices/register or /api/v1/devices/heartbeat) known to be used by the Corp_MDM Android spyware for C2 communication, registration, or heartbeat signals.
Detects cleartext HTTP POST requests to specific URI endpoints (/api/v1/devices/register or /api/v1/devices/heartbeat) known to be used by the Corp_MDM Android spyware for C2 communication, registration, or heartbeat signals.
This rule monitors for outbound TCP and HTTP traffic to a known malicious infrastructure hosting a fake or compromised 'Corp MDM' (Mobile Device Management) admin panel, which serves as a Command and Control (C2) channel for spyware.
Detects an Android device registration attempt to a known malicious C2 IP address using parameters characteristic of a mobile device management (MDM) implant. The rule looks for a POST request to a specific registration endpoint containing device identifiers like deviceId, manufacturer, model, and osVersion.
Detects an Android device registration attempt to a known malicious C2 IP address using parameters characteristic of a mobile device management (MDM) implant. The rule looks for a POST request to a specific registration endpoint containing device identifiers like deviceId, manufacturer, model, and osVersion.
Detects an Android device registration attempt to a known malicious C2 IP address using parameters characteristic of a mobile device management (MDM) implant. The rule looks for a POST request to a specific registration endpoint containing device identifiers like deviceId, manufacturer, model, and osVersion.
Detects outbound network traffic and HTTP requests originating from the internal network destined for a known malicious infrastructure associated with 'Corp MDM'. The traffic includes C2 communication patterns, specific API URI paths, and potential login interactions on non-standard ports, consistent with phishing, malware delivery, or unauthorized administrative access.
Detects outbound network traffic and HTTP requests originating from the internal network destined for a known malicious infrastructure associated with 'Corp MDM'. The traffic includes C2 communication patterns, specific API URI paths, and potential login interactions on non-standard ports, consistent with phishing, malware delivery, or unauthorized administrative access.
Detects HTTP beaconing and command-and-control (C2) communication patterns consistent with the 'Corp_MDM' Android spyware, specifically heartbeat check-ins, command polling, and result reporting to a known malicious C2 IP address.
Detects HTTP beaconing and command-and-control (C2) communication patterns consistent with the 'Corp_MDM' Android spyware, specifically heartbeat check-ins, command polling, and result reporting to a known malicious C2 IP address.
Detects HTTP beaconing and command-and-control (C2) communication patterns consistent with the 'Corp_MDM' Android spyware, specifically heartbeat check-ins, command polling, and result reporting to a known malicious C2 IP address.
Detects HTTP beaconing and command-and-control (C2) communication patterns consistent with the 'Corp_MDM' Android spyware, specifically heartbeat check-ins, command polling, and result reporting to a known malicious C2 IP address.
Detects network communication associated with the SectopRAT/ArechClient2 remote access trojan, specifically identifying its characteristic length-prefixed, AES-encrypted command-and-control handshake on non-standard ports. The rule matches traffic containing a specific length-prefixed packet structure starting with null bytes, typically seen during C2 check-in.
Detects network activity related to the SectopRAT malware downloading a secondary module named 'WbElevation.dll' from a known command and control (C2) server. This module is typically associated with browser credential theft functionality.
Page 30 of 110