Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,303 detections
Filters
Last updated
All Time
Detection languages
2,251
22
21
7
2
Contributors
910
584
506
125
48
Categories
20,427
11,813
5,871
5,145
4,864
2,303
Platforms
2,190
209
168
62
61
Products / Services
2,250
2,159
163
32
31
MITRE Techniques
713
422
384
187
184
CVEs
17
12
12
12
10
IDS Classtypes
995
426
281
190
98
IDS Protocols
1,291
401
281
117
45
This rule detects HTTP traffic where a response from a Google Cloud Storage bucket (storage.googleapis.com) initiates a redirect via meta-refresh or JavaScript to a Vercel-hosted domain. This pattern is indicative of phishing infrastructure, where attackers leverage legitimate, trusted storage platforms to redirect users to malicious landing pages.
This rule detects HTTP traffic where a response from a Google Cloud Storage bucket (storage.googleapis.com) initiates a redirect via meta-refresh or JavaScript to a Vercel-hosted domain. This pattern is indicative of phishing infrastructure, where attackers leverage legitimate, trusted storage platforms to redirect users to malicious landing pages.
This rule detects HTTP traffic where a response from a Google Cloud Storage bucket (storage.googleapis.com) initiates a redirect via meta-refresh or JavaScript to a Vercel-hosted domain. This pattern is indicative of phishing infrastructure, where attackers leverage legitimate, trusted storage platforms to redirect users to malicious landing pages.
This rule detects HTTP traffic where a response from a Google Cloud Storage bucket (storage.googleapis.com) initiates a redirect via meta-refresh or JavaScript to a Vercel-hosted domain. This pattern is indicative of phishing infrastructure, where attackers leverage legitimate, trusted storage platforms to redirect users to malicious landing pages.
Detects outbound HTTP requests to the Telegram Bot API associated with the malicious 'indexed-btree' npm package. The rule specifically monitors for hardcoded Telegram bot tokens and chat IDs used for data exfiltration.
Detects specific command-and-control (C2) communication patterns associated with the VelvetCake malware. The rules identify initial authentication with a hardcoded password string, module enumeration requests, and session termination signals transmitted over TCP.
Detection of network traffic associated with VelvetCake (Konni) malware, identifying communication with known hardcoded C2 infrastructure, domain lookups, and exfiltration attempts via HTTP/TLS and raw TCP protocols.
Detection of network traffic associated with VelvetCake (Konni) malware, identifying communication with known hardcoded C2 infrastructure, domain lookups, and exfiltration attempts via HTTP/TLS and raw TCP protocols.
Detects network activity (TCP, DNS, TLS, HTTP) associated with the UNC6240 threat actor's infrastructure, specifically targeting communications with known malicious IP addresses and domains used in a campaign leveraging PeopleSoft-related lures.
Detects network activity (TCP, DNS, TLS, HTTP) associated with the UNC6240 threat actor's infrastructure, specifically targeting communications with known malicious IP addresses and domains used in a campaign leveraging PeopleSoft-related lures.
Detects established, bidirectional TCP connections between internal hosts and known infrastructure associated with the SIDEEYE backdoor on specific control and data ports (3333 and 3334).
Detects established, bidirectional TCP connections between internal hosts and known infrastructure associated with the SIDEEYE backdoor on specific control and data ports (3333 and 3334).
Detects unauthorized outbound HTTP requests to the Telegram Bot API (api.telegram.org) utilizing hardcoded credentials, specific chat IDs, or standard Bot API communication patterns (sendMessage/sendDocument) which are often used by malware for data exfiltration and command-and-control communication.
Detects network traffic associated with the NPM Btree malware campaign, specifically identifying command-and-control (C2) polling activities directed toward blockchain RPC endpoints like Alchemy and Infura. The rules monitor for specific API keys, C2 smart contract addresses via 'eth_call' JSON-RPC requests, and overall traffic patterns to known malicious infrastructure.
Detects network traffic indicating the use of Slack APIs as a command and control (C2) channel or for exfiltration. The rules monitor for specific TLS SNI strings, hardcoded Slack bot tokens, and specific channel IDs associated with the 'indexed-btree' malware campaign, which utilizes Slack as a C2 platform.
Detects network activity associated with a malicious npm package campaign leveraging Sepolia Ethereum testnet RPC endpoints (Alchemy and Infura) for command-and-control (C2) communication. The detection looks for JSON-RPC 'eth_call' requests and specific contract address references characteristic of this campaign.
Detects network traffic exhibiting beaconing patterns to 'dl.google.com' that may be indicative of Xray-core C2 tunneling disguised as legitimate Google traffic. The rule uses a threshold to identify consistent connection attempts.
Detection of suspicious network traffic directed toward Slack APIs, characterized by the use of hardcoded Slack bot tokens and specific communication patterns associated with the 'indexed-btree' npm malware family, indicating potential C2 communication or data exfiltration.
Detects outbound network traffic attempting to exfiltrate data to Slack or Telegram APIs using hardcoded bot tokens or channel identifiers associated with the 'indexed-btree' malware campaign.
Detects outbound HTTP POST requests to the Polygon blockchain using the 'eth_call' JSON-RPC method, specifically targeting a known smart contract address associated with EtherHiding-style C2 infrastructure. This behavior indicates an adversary utilizing decentralized blockchain storage or services as an unconventional command-and-control channel to resolve malicious configurations or payloads.
This rule detects outbound HTTP requests to the blogspot.com domain, which is often used by malware for command-and-control (C2) communication, staging, or as an initial check-in mechanism. Attackers frequently abuse legitimate blogging platforms to host malicious content and evade network-based detections that might otherwise flag unknown or suspicious domains.
Page 35 of 110