Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,303 detections
Filters
Last updated
All Time
Detection languages
2,251
22
21
7
2
Contributors
910
584
506
125
48
Categories
20,425
11,812
5,870
5,145
4,864
2,303
Platforms
2,190
209
168
62
61
Products / Services
2,250
2,159
163
32
31
MITRE Techniques
713
422
384
187
184
CVEs
17
12
12
12
10
IDS Classtypes
995
426
281
190
98
IDS Protocols
1,291
401
281
117
45
Detects OAuth 2.0 authorization requests sent to login.microsoftonline.com using the 'prompt=none' parameter, where the redirect_uri domain is not a trusted Microsoft property. This is a common indicator of consent phishing or malicious OAuth application abuse where an attacker attempts to redirect authorization tokens to an adversary-controlled endpoint.
Detects network traffic associated with Mirage2FA Phishing-as-a-Service (PhaaS), including HTTP requests to specific URI patterns characteristic of their backend loader and DNS queries to known malicious domain families (cheecker.store and volatilesour.store), as well as direct TCP connections to identified hosting infrastructure.
This rule detects potential Adversary-in-the-Middle (AiTM) phishing kit exfiltration behavior. It correlates the initial victim geolocation lookup via 'api.ipgeolocation.io' with subsequent data exfiltration to the Telegram Bot API ('api.telegram.org') originating from the same host, indicating an automated sequence where victim context is gathered and then exfiltrated by the phishing kit.
This rule detects a two-stage network redirect sequence indicative of an Adversary-in-the-Middle (AiTM) phishing campaign. The first stage identifies traffic interacting with a Google Ads click-tracker, and the second stage identifies a subsequent request to an AWS S3 bucket, often used to host malicious landing pages or phishing proxies.
This rule set detects multi-stage network patterns indicative of AiTM phishing campaigns. It identifies common redirection techniques, including lookalike domains hosting Microsoft OAuth authorize URLs, DNS resolution of Google ad-tech infrastructure followed by novel domains, malicious use of Google Meet and Google Ads click-tracking endpoints as phishing hops, and references to AWS S3-hosted intermediate landing pages.
Detects network activity associated with Adversary-in-the-Middle (AiTM) phishing kits. This includes detection of kit-specific fingerprinting scripts (class_identifier.php), use of specific server banners (openresty), unauthenticated geolocation lookups (api.country.is), setting of geolocation cookies, and proxying of requests to Microsoft OAuth endpoints.
Detects communication patterns associated with the OnyxC2 malware, including host-fingerprint synchronization over HTTP, potential reverse SOCKS5 proxy tunnel initialization, and inbound HTTP responses containing command tasking such as cmd.exe.
Detects high-frequency, unauthenticated Redis PING/AUTH attempts indicative of a reconnaissance scan against the Redis service. This activity typically represents an adversary performing mass fingerprinting or attempting to identify unsecured Redis instances.
Detects attempts to execute arbitrary JavaScript code on a MongoDB server using the deprecated eval command or patterns consistent with sandbox escape techniques (probing for process, load, and require functions).
Detects attempts to bypass the Redis Lua scripting environment sandbox by injecting 'require' and 'dofile' commands within an 'EVAL' request. These commands are typically used to load external modules or files, which, if successful, could allow an attacker to achieve arbitrary code execution on the server hosting the Redis instance.
Detects unauthorized attempts to access the Marimo Notebook terminal via a WebSocket connection, indicative of an exploit attempt targeting CVE-2026-39987.
Detects a multi-stage phishing redirect chain used in 'EvilTokens' attacks. The rule identifies communication with common serverless hosting platforms (Vercel, Cloudflare Workers, AWS Lambda/Execute-API) followed by interaction with anti-bot/CAPTCHA gates (Cloudflare Turnstile, hCaptcha, Google reCAPTCHA) and finally reaching known Microsoft device code phishing endpoints (/devicelogin or /common/oauth2/deviceauth).
Detects outbound network traffic from internal hosts to a known Cobalt Strike-compatible C2 server at 45.32.253.166 on port 8088. This activity is indicative of a compromised host establishing a command-and-control connection.
Detects internal SMB traffic indicative of P2P beaconing using the IPC$ named pipe, which is often a sign of lateral movement or command-and-control communication between compromised hosts.
Detects network traffic associated with PIVOTPIPE Cobalt Strike beacon activity communicating with a known suspicious external IP address on port 8088. This includes generic TCP, HTTP-based beaconing, and TLS-encrypted C2 sessions.
Detects outbound HTTP requests where the user-agent starts with 'PHP/' and the URI contains the path for the Admin Menu Editor Pro plugin, suggesting communication between a trojanized WordPress plugin and a remote command-and-control server.
Detects HTTP responses containing a file named 'ClaudeDesktop.exe' served from paths containing '/artifacts/' on the 'claude.ai' host where the request referrer is not 'claude.ai' or 'anthropic.com', suggesting a malvertising or supply chain delivery attempt of a malicious installer.
Detects HTTP responses containing a file named 'ClaudeDesktop.exe' served from paths containing '/artifacts/' on the 'claude.ai' host where the request referrer is not 'claude.ai' or 'anthropic.com', suggesting a malvertising or supply chain delivery attempt of a malicious installer.
Detects outbound network traffic from internal hosts to public Telegram Bot API or Slack webhooks, indicative of potential data exfiltration by the npm indexed-btree malware or similar malicious actors utilizing these services for command and control or exfiltration.
Detects potential Command and Control (C2) beaconing activity associated with Xray-core, where the TLS Server Name Indication (SNI) field is spoofed to 'dl.google.com' to masquerade malicious traffic as legitimate Google-related traffic.
Detects sustained outbound TCP communication patterns indicative of Xray-core proxy or tunneling activity. The rule monitors for high-frequency established TCP sessions originating from the internal network, which is a common behavior for tools used to maintain persistent network tunnels or proxy command-and-control traffic.
Page 40 of 110