Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,303 detections
Filters
Last updated
All Time
Detection languages
2,251
22
21
7
2
Contributors
910
584
506
125
48
Categories
20,427
11,813
5,871
5,145
4,864
2,303
Platforms
2,190
209
168
62
61
Products / Services
2,250
2,159
163
32
31
MITRE Techniques
713
422
384
187
184
CVEs
17
12
12
12
10
IDS Classtypes
995
426
281
190
98
IDS Protocols
1,291
401
281
117
45
Detects anomalous C2 traffic associated with SectopRAT that leverages JSON-RPC 'eth_call' methods on 'binance.org'. The detection monitors for a specific POST request pattern followed by a response containing 'START' and 'FINISH' markers within the result field, indicating command-and-control communication disguised as blockchain interactions.
This rule detects network communication (DNS queries and TLS connections) to known actor-controlled Slack workspace subdomains, as well as the presence of a specific hardcoded public key in Slack API traffic, suggesting the use of Slack as a Command and Control (C2) channel.
Detects HTTP GET requests to external services 'trycloudflare.com' or 'workers.dev' that return a file content starting with the 'MZ' and 'PE' header signatures within the first 256 bytes, indicating a Windows executable payload download often associated with AvisLoader activity.
Detects a sequence of Tox P2P protocol packets consisting of a Cookie Request, Cookie Response, and Crypto Handshake within a single network flow. This pattern is indicative of the Tox P2P protocol, which is sometimes abused by malware (e.g., AvisLoader) for command-and-control (C2) communications to evade traditional network inspection.
Detects unauthenticated or unauthorized access attempts to critical Oracle PeopleSoft PeopleTools endpoints (such as PSIGW, PSC, or PORTAL). These detections trigger when suspicious requests are made to these sensitive paths without expected authentication headers or session tokens, potentially indicating an exploitation attempt as described in CVE-2026-35273.
Detects an unauthenticated remote code execution (RCE) attempt against Langflow via the /api/v1/validate/code endpoint. The rule monitors for POST requests containing code execution patterns such as eval, exec, os.system, or subprocess, indicating an attacker attempting to leverage the vulnerability to execute arbitrary commands.
This rule monitors for network traffic directed to 'gitnow.dev' using TLS SNI or HTTP headers consistent with WebSocket upgrades. This domain is associated with 'ClickFix' social engineering campaigns where attackers instruct users to copy and paste malicious code into a terminal to establish a reverse-tunnel C2 connection.
Detects anomalous DNS queries with high-entropy or encoded labels that exceed 40 characters in size, potentially indicating DNS tunneling used for Command and Control (C2) communication.
Detects network activity associated with NetSupport Manager remote access software, specifically targeting DNS lookups, TLS SNI connections, and direct TCP beaconing to a known-malicious infrastructure IP. This rule is designed to identify unauthorized use of legitimate remote support tools for command and control purposes.
This rule detects network traffic indicative of the SCKIT MemTensor worm establishing a command-and-control (C2) beacon. The detection identifies TLS connections where the Server Name Indication (SNI) matches a specific pattern of a 12-character hexadecimal string followed by .skyleen.fr.
Detects network activity associated with the GHAPPIER implant beaconing to a hardcoded command and control (C2) server. The rule monitors for established TCP connections on port 15152 that contain specific JSON status indicators and the string 'ghappier' in the payload, which are characteristic of this malware's communication protocol.
Detects outbound HTTP GET requests containing a .ps1 file extension in the URI, originating from a host without a specified User-Agent, and targeting domains other than Microsoft or Windows Update. This pattern is characteristic of a persistence mechanism executing a PowerShell script to download a secondary payload (e.g., via Net.WebClient).
Detects repeated TLS connections to a known suspicious IP address that masquerades as gitlab.com using the TLS Server Name Indication (SNI) extension. This pattern is indicative of potential command and control (C2) traffic from compromised or unauthorized GitRunner infrastructure.
Detects HTTP and TLS traffic patterns indicative of data exfiltration to Slack, specifically targeting hardcoded Slack API tokens, Slack channel IDs in HTTP request bodies, or traffic directed to hooks.slack.com, commonly associated with malicious npm packages.
Detects network traffic from internal hosts interacting with Ethereum Sepolia testnet contracts via common blockchain infrastructure providers (Alchemy, Infura) or JSON-RPC calls. These patterns are characteristic of 'indexed-btree' malware utilizing decentralized blockchain technology for command-and-control polling.
Detects outbound network connections (HTTP/TLS) from internal hosts to a known malicious IP address associated with Adversary-in-the-Middle (AiTM) phishing infrastructure, specifically targeting Microsoft 365 credential and session cookie theft.
Detects outbound network connections (HTTP/TLS) from internal hosts to a known malicious IP address associated with Adversary-in-the-Middle (AiTM) phishing infrastructure, specifically targeting Microsoft 365 credential and session cookie theft.
This rule detects network traffic patterns indicative of Xray-core C2 tunnels using a spoofed 'dl.google.com' TLS SNI value. This activity is associated with the Aur0ra/Black Basta playbook, where Xray-core is sideloaded into legitimate processes to exfiltrate or tunnel traffic while mimicking Chrome browser TLS behavior.
Detects HTTP POST requests containing potential credential exfiltration indicators, specifically targeting the '/google.php' endpoint with 'do=login&', 'user=', and 'pass=' parameters. This pattern is associated with FlowerStorm (Storm-1167) AiTM phishing kits.
Detects outbound network traffic from internal hosts to known ClickFix campaign command-and-control infrastructure, identified by specific malicious domains (grandenoid.org, mootornot.com) and associated IP addresses.
Detects a specific network handshake pattern characterized by the string 'REVERSE_PROXY|' within the first 16 bytes of an established TCP connection, consistent with the x47.c Fast-Flux botnet command and control (C2) communication protocol.
Page 31 of 110