Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,303 detections
Filters
Last updated
All Time
Detection languages
2,251
22
21
7
2
Contributors
910
584
506
125
48
Categories
20,427
11,813
5,871
5,145
4,864
2,303
Platforms
2,190
209
168
62
61
Products / Services
2,250
2,159
163
32
31
MITRE Techniques
713
422
384
187
184
CVEs
17
12
12
12
10
IDS Classtypes
995
426
281
190
98
IDS Protocols
1,291
401
281
117
45
Detects the presence of injected 'ganalytics-tracker-js' script on compromised webpages and the subsequent browser-initiated requests for the malicious 't.js' script. This is associated with ClickFix attack campaigns where users are socially engineered into executing malicious code.
Detects HTTP POST requests to a /collect endpoint containing visitorId and stage parameters, which is characteristic of ClickFix-style fake bot-protection overlays used to trick users into executing malicious scripts under the guise of security verification.
This rule detects two-stage suspicious network activity: first, a POST request to a known Sauron Loader C2 endpoint ('/api/t'), and second, a subsequent TLS connection to 'ipinfo.io' used for geolocation. The correlation is achieved using flowbits to track the infection lifecycle.
Detects DNS lookup queries and HTTP POST beaconing attempts directed at known Sauron Loader C2 fallback infrastructure. The rule tracks specific domains associated with the malware's encrypted registration and command-and-control behavior.
Detects DNS lookup queries and HTTP POST beaconing attempts directed at known Sauron Loader C2 fallback infrastructure. The rule tracks specific domains associated with the malware's encrypted registration and command-and-control behavior.
Detects network beaconing activity associated with the Sauron Loader malware. The rule monitors HTTPS traffic for specific domain patterns and suspicious TLV (Type-Length-Value) protocol structures, as well as recurring beaconing cadence to identified C2 infrastructure.
Detects network beaconing activity associated with AMOS Stealer command-and-control communication. The rule identifies HTTP POST requests to the '/api/t' path with a JSON content type over port 8133, using a threshold to identify sustained communication patterns.
Detects outbound HTTP requests to a known domain associated with 'ClickFix' campaign activity. The rule identifies attempts to fetch a specific JavaScript tracker file, which is often used in social engineering campaigns to trick users into executing malicious commands in their shell or console.
Detects HTTP POST requests to '/api/credentials' over a non-standard port (8133) typical of AMOS (Atomic macOS Stealer) command and control traffic. The rule specifically looks for established network connections originating from the local network and targeting external hosts, flagging multiple occurrences within a 30-second window.
Detects HTTP POST requests to '/api/credentials' over a non-standard port (8133) typical of AMOS (Atomic macOS Stealer) command and control traffic. The rule specifically looks for established network connections originating from the local network and targeting external hosts, flagging multiple occurrences within a 30-second window.
This rule detects outgoing HTTP POST requests to the 'velvet-otter-glagceis.life' domain path '/collect'. The request body contains indicators of victim fingerprinting, specifically looking for 'visitorId' and 'events' fields, characteristic of the Macfinger/ClickFix campaign used for gathering visitor telemetry for malicious purposes.
Detects network activity associated with the Sauron Loader, including TLS connections to specific C2 domains and repeated HTTPS POST requests to api.* subdomains indicating beaconing or polling behavior.
Detects outbound TLS traffic where the Server Name Indication (SNI) matches known command-and-control (C2) domains associated with the Sauron Loader malware. This indicates a compromised host attempting to communicate with malicious infrastructure.
Detects network traffic consistent with AMOS Stealer command-and-control (C2) activity, specifically HTTP POST requests to the path '/api/t' on non-standard TCP port 8133. The rule includes a threshold to mitigate noise from single connections.
Detects DNS queries and TLS SNI traffic directed towards known domain names associated with the Sauron Loader command-and-control infrastructure. This rule identifies outbound communication attempts using hardcoded beaconing domains.
This rule detects known command-and-control (C2) domains associated with the Sauron Loader malware family, specifically by inspecting TLS Server Name Indication (SNI) fields. It also monitors for patterns of repeated connections to domains prefixed with 'api.' over established TLS sessions, which may indicate beaconing behavior characteristic of C2 activity.
Detects network activity associated with the AMOS (Atomic Stealer) malware, specifically identifying C2 registration, heartbeats, or credential exfiltration attempts over the non-standard port 8133 using HTTP patterns matching its known API endpoints.
Detects outbound HTTP POST requests characteristic of the Sauron Loader malware, utilizing a specific, randomized URI path structure and a known malicious User-Agent string to establish C2 communication.
Detects outbound HTTP POST requests characteristic of the Sauron Loader malware, utilizing a specific, randomized URI path structure and a known malicious User-Agent string to establish C2 communication.
Detects outbound network traffic from internal hosts to known domains associated with the Sauron Loader malware family. These alerts monitor for TLS connections where the Server Name Indication (SNI) matches domains identified as part of the malware's C2 infrastructure.
Detects network activity associated with the SloppyRAT malware, specifically identifying C2 authentication attempts via HTTP POST requests containing specific headers and user-agent strings, as well as TLS connections to known malicious domains and IP addresses.
Page 37 of 110