Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,303 detections
Filters
Last updated
All Time
Detection languages
2,251
22
21
7
2
Contributors
910
584
506
125
48
Categories
20,427
11,813
5,871
5,145
4,864
2,303
Platforms
2,190
209
168
62
61
Products / Services
2,250
2,159
163
32
31
MITRE Techniques
713
422
384
187
184
CVEs
17
12
12
12
10
IDS Classtypes
995
426
281
190
98
IDS Protocols
1,291
401
281
117
45
Detects network traffic associated with NarwhalRAT malware utilizing the pCloud API as a command-and-control (C2) channel or dead-drop resolver. The rule monitors both HTTP requests containing specific folder identifiers and authentication parameters, as well as TLS SNI indicating connections to api.pcloud.com.
Detects outbound TCP traffic originating from the internal network destined for a known malicious IP associated with Meterpreter Java payload retrieval and post-exploitation Command and Control (C2) activity, potentially related to PaperCut vulnerability exploitation.
This rule detects network traffic patterns indicative of a reverse shell established by DSCourier, a tool or script that leverages the ConfigurationRemotingServer interface to facilitate interactive command execution on a remote host.
Detects specific FTP commands (STOR, RETR, TYPE I) and passive mode responses directed to or originating from identified malicious IP addresses associated with the LucidRook threat actor. This rule monitors for potential file exfiltration, payload retrieval, and command-and-control communication over the FTP protocol.
Detects outbound network traffic associated with identified ClickFix CPaaS payload domains and associated API endpoints. The rule monitors for specific malicious domain contact (comicstar.lat, babybon.cfd, merkantalolol.asia) and the use of the '/api/index.php?a=init' endpoint, which is indicative of the ClickFix payload delivery mechanism.
Detects rapid TCP connection attempts to port 445 (SMB) from a single source IP address, indicative of network scanning or reconnaissance activities typically used by the DragonForce ransomware or similar automated threats for lateral movement.
Detects outbound HTTP requests to 'relay.php' containing a static authorization bearer token 'crpx0_c2_2026', which is associated with the command and control activity of the CRPx0 ransomware family.
Detects network traffic associated with the AdaptixC2 framework agent check-in process. The rule looks for specific HTTP GET request patterns, including URI paths commonly used by the agent, session-related cookies, and Content-Type headers set to application/octet-stream.
Detects network traffic associated with NGate Android malware communicating with its Command and Control (C2) server. The rule monitors for specific HTTP POST patterns, including an 'okhttp' user-agent and binary body content characteristic of NFC relay relay attempts used for fraudulent payment activities.
Detects outbound HTTP POST requests directed towards Internet Computer Protocol (ICP) canister gateways (e.g., icp0.io, ic0.app) containing specific API path patterns (/api/v2/canister/) used for executing queries or calls. The rule specifically flags traffic lacking common browser-like User-Agent strings, which is a common indicator of automated command-and-control beacons using these services as proxy infrastructure.
This rule detects outbound TLS traffic to the Solana mainnet beta RPC API endpoint (api.mainnet-beta.solana.com). Attackers may abuse legitimate public blockchain infrastructure as a command-and-control channel to bypass traditional network defenses or obfuscate communication.
Detects network beaconing activity associated with the TuxBot v3 IoT botnet. The rule identifies specific User-Agent strings (TuxBot/3, BusyBox wget, Wget/1.x), requests for .elf files, and connections to suspicious top-level domains frequently used for botnet command-and-control (C2) infrastructure.
This rule detects attempts to exploit a vulnerability in Cisco IOS XE devices (specifically related to CVE-2025-20188) by identifying suspicious Authorization headers containing JWT tokens ('Bearer eyJ...') targeted at the '/webui/' endpoint. This behavior is associated with Akira ransomware exploitation efforts against networking infrastructure.
Detects high-frequency connection attempts to SMB (445) or RDP (3389) ports originating from a single source, which is characteristic of the SoftPerfect Network Scanner (NetScan) tool performing reconnaissance or network discovery sweeps.
This rule detects network communication associated with the AMOS (Atomic macOS) Stealer malware. Specifically, it identifies inbound HTTP GET requests directed at the '/api/shell/agent' URI, which is used by the stealer to retrieve instructions or trigger remote shell operations from its command and control (C2) server.
Detects the presence of injected bot-protection tracker scripts characteristic of the Macfinger (ClickFix) attack campaign within served HTML content. The rule identifies specific patterns including DNS prefetching directives, site tracking parameters, and a specific GAnalytics tracker JavaScript reference, indicating an attempt to facilitate social engineering or malicious user interaction.
Detects the presence of injected bot-protection tracker scripts characteristic of the Macfinger (ClickFix) attack campaign within served HTML content. The rule identifies specific patterns including DNS prefetching directives, site tracking parameters, and a specific GAnalytics tracker JavaScript reference, indicating an attempt to facilitate social engineering or malicious user interaction.
Detects network traffic associated with AMOS (Atomic macOS) Stealer malware, identifying C2 beaconing and tasking requests. The rules specifically monitor POST requests to '/api/t' with JSON payloads and GET requests to '/api/shell/agent' over non-standard ports (excluding 80 and 443).
Detects network traffic associated with the 'ClickFix' technique, where malicious websites masquerade as legitimate CAPTCHA or bot-protection services to exfiltrate visitor telemetry via POST requests or fetch malicious script overlays.
Detects outbound network traffic matching TLS SNI patterns associated with the Sauron Loader malware, indicating command-and-control (C2) communication. The rule monitors for frequent connections to specific domains (namsb-show, quinlantours, virtual-magic, lahaina-shores) following a defined threshold.
This rule detects the two-stage network behavior of AMOS (Atomic macOS Stealer). First, it identifies the initial C2 registration beaconing to an '/api/t' endpoint. Subsequently, it monitors for an immediate follow-up TLS connection to 'ipinfo.io', which is commonly used by the malware for geolocation and victim system reconnaissance.
Page 36 of 110