Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,303 detections
Filters
Last updated
All Time
Detection languages
2,251
22
21
7
2
Contributors
910
584
506
125
48
Categories
20,427
11,813
5,871
5,145
4,864
2,303
Platforms
2,190
209
168
62
61
Products / Services
2,250
2,159
163
32
31
MITRE Techniques
713
422
384
187
184
CVEs
17
12
12
12
10
IDS Classtypes
995
426
281
190
98
IDS Protocols
1,291
401
281
117
45
Detects network traffic consistent with the x47.c bot performing a SOCKS5 reverse-proxy handshake to a command-and-control (C2) server. The rule triggers on the specific 'REVERSE_PROXY|' string signature within established outbound TCP connections.
This rule detects outbound TLS traffic to the domain 'trace-flow.ru', which is associated with Max Messenger covert telemetry beaconing behavior. The rule inspects the Server Name Indication (SNI) field in the TLS handshake for the specific domain string.
This rule detects outbound TLS traffic to the domain 'trace-flow.ru', which is associated with Max Messenger covert telemetry beaconing behavior. The rule inspects the Server Name Indication (SNI) field in the TLS handshake for the specific domain string.
This rule detects outbound TLS traffic to the domain 'trace-flow.ru', which is associated with Max Messenger covert telemetry beaconing behavior. The rule inspects the Server Name Indication (SNI) field in the TLS handshake for the specific domain string.
Detects network traffic to the domain 'trace-flow.ru', which is associated with the 'Max Messenger' malware's concealed telemetry and C2 channel. The rules monitor for TLS connections to this domain, including instances where the certificate subject contains 'VK LLC' and 'Moscow'.
Detects network traffic to the domain 'trace-flow.ru', which is associated with the 'Max Messenger' malware's concealed telemetry and C2 channel. The rules monitor for TLS connections to this domain, including instances where the certificate subject contains 'VK LLC' and 'Moscow'.
Detects network traffic to the domain 'trace-flow.ru', which is associated with the 'Max Messenger' malware's concealed telemetry and C2 channel. The rules monitor for TLS connections to this domain, including instances where the certificate subject contains 'VK LLC' and 'Moscow'.
Detects high-frequency outbound TLS connections to 'api-gost.oneme.ru', which is indicative of potential bulk contact list uploading, possibly related to unauthorized data collection by the Max Messenger application.
Detects high-frequency outbound TLS connections to 'api-gost.oneme.ru', which is indicative of potential bulk contact list uploading, possibly related to unauthorized data collection by the Max Messenger application.
Detects high-frequency outbound TLS connections to 'api-gost.oneme.ru', which is indicative of potential bulk contact list uploading, possibly related to unauthorized data collection by the Max Messenger application.
Detects high-frequency outbound TLS connections to 'api-gost.oneme.ru', which is indicative of potential bulk contact list uploading, possibly related to unauthorized data collection by the Max Messenger application.
Detects large and sustained outbound TCP data transfers to external networks, which may indicate mass data exfiltration. The rule monitors established sessions and uses a threshold to identify unusual outbound traffic volume over an extended period.
Detects an attempt to exploit a quote-injection vulnerability within the SharePoint ToolPane.aspx page, specifically targeting the Register directive to bypass SafeControls restrictions. This pattern is commonly used for remote code execution or unauthorized application behavior modifications by manipulating server-side parsing.
Detects network activity associated with the ORAX control-plane panel and management service. The rule identifies HTTP traffic containing OraxManage or OraxRDP service strings, SignalR negotiate handshakes directed to common ORAX management ports, and connections to identified ORAX C2 infrastructure domains and IP addresses.
This rule detects interaction between an internal host and the Vapi.ai API, typically used for automating AI-based voice phishing (vishing) calls. It identifies the initiation of a call via POST requests to the Vapi.ai API and subsequent callbacks from Vapi.ai to an attacker-controlled webhook endpoint used for tracking call status.
This rule detects a specific HTTP request pattern associated with the JWR-family Phishing-as-a-Service (PhaaS) platform. The detection looks for a WebSocket handshake initiation (GET request with specific URI segments 'webSocket/QT/' and a known hardcoded string) and an 'Upgrade' header, which are indicative of a command-and-control (C2) channel establishment.
Detects network activity associated with the GhostCode phishing kit, including HTTP requests to specific access-prefixed subdomains and DNS lookups for those domains. Additionally, it detects HTTP responses containing specific spoofed browser tab titles often used in these phishing campaigns.
Detects potential reconnaissance activities targeting Redis services on port 6379, specifically looking for unauthenticated 'PING' commands and subsequent responses indicating either authentication requirements or an open, unauthenticated instance.
Detects HTTP requests targeting the /terminal/ws endpoint of a Marimo notebook application, which indicates an attempt to exploit CVE-2026-39987, a pre-authentication Remote Code Execution vulnerability involving WebSocket connections.
Detects network activity associated with the SilkParasite botnet. The rule identifies inbound/outbound HTTP heartbeat check-ins using a specific URI pattern (/ping?h=) and direct TCP connections to a known malicious C2 IP address.
Detects network activity associated with the Psychedelic Stealer malware command-and-control (C2) communication patterns. The rule identifies specific API endpoints used for task polling, heartbeat pings, check-ins, and task acknowledgement, as well as connections to a known malicious C2 infrastructure, all characterized by the presence of a specific 'X-API-Key' header.
Page 32 of 110