Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,303 detections
Filters
Last updated
All Time
Detection languages
2,251
22
21
7
2
Contributors
910
584
506
125
48
Categories
20,417
11,806
5,870
5,145
4,864
2,303
Platforms
2,190
209
168
62
61
Products / Services
2,250
2,159
163
32
31
MITRE Techniques
713
422
384
187
184
CVEs
17
12
12
12
10
IDS Classtypes
995
426
281
190
98
IDS Protocols
1,291
401
281
117
45
This rule detects outbound TLS connections to suspicious domain names characteristic of the Koktevrat malware's DGA. The rule identifies SNI strings that match a specific regex pattern (8-16 alphanumeric characters followed by .icu or .cfd TLDs), which is indicative of automated C2 communication.
Detects outbound network communication patterns (DNS lookups and TLS SNI traffic) associated with the Koktevrat Android RAT. The rule monitors for connections to known malicious domains used for command-and-control (C2) operations.
Detects high-frequency connection attempts to PPTP (1723) and L2TP (1701) VPN ports from an external source, indicative of automated scanning or vulnerability discovery activity.
This rule detects HTTP requests directed at suspicious URI patterns associated with 'LeakySensey' logs. It specifically monitors for attempts to access transaction or compromise log endpoints, which could indicate an attacker attempting to enumerate leaked data or verify compromised credentials from an exposed log repository.
This rule detects HTTP requests directed at suspicious URI patterns associated with 'LeakySensey' logs. It specifically monitors for attempts to access transaction or compromise log endpoints, which could indicate an attacker attempting to enumerate leaked data or verify compromised credentials from an exposed log repository.
Detects anomalous TLS traffic characterized by an empty Server Name Indication (SNI) field in the TLS handshake, combined with a high frequency of such connections. This behavior is indicative of certain proxy protocols like Xray VLESS with REALITY, which are often used to evade Deep Packet Inspection (DPI) and traffic shaping policies by disguising C2 or tunneling traffic as legitimate-looking TLS connections.
This rule detects high-frequency TCP SYN connection attempts originating from external networks targeting common administrative or tunneling ports (1723/PPTP, 1701/L2TP, 22/SSH) on internal systems. The detection uses a threshold of 100 connection attempts within 120 seconds, which is characteristic of automated reconnaissance and network scanning behavior.
This rule detects potential Adversary-in-the-Middle (AiTM) activity by monitoring for a two-stage pattern: a SignalR negotiation POST request followed by a WebSocket upgrade request to a suspicious domain structure. The pattern specifically targets lookalike domains featuring a random subdomain of at least 12 alphanumeric characters, which is indicative of ORAX-style AiTM infrastructure.
Detects outbound TLS traffic behavior consistent with the WaterPlum RAT, characterized by periodic, low-volume connections to non-CDN/cloud providers. The rule identifies potential beaconing activity by monitoring TLS SNI fields against a list of known legitimate service providers and applying a frequency threshold.
This rule detects network traffic directed at the Telegram Bot API (api.telegram.org) where the request URI indicates a bot action ('/bot' followed by 'sendMessage') and the HTTP request body contains the keyword 'VIEW'. This pattern is commonly associated with C2 beacons using Telegram as an intermediary service to send status or command results from compromised hosts.
Detects network traffic associated with the SparroWocky/FamousSparrow C2 framework, including HTTP CONNECT proxy tunneling, SOCKS5 handshakes, and established TLS sessions to known malicious infrastructure.
This rule detects network activity associated with the PlugX RAT, specifically monitoring for DNS lookups of 'images.hcgtest.net', direct IP connections to '104.21.77.221', and HTTP requests to '/download/ar96rhqjgw2' using a user-agent containing 'curl'. This pattern indicates a compromised host attempting to download a PlugX archive.
Detects a specifically malformed IPv6 Routing Header (type 0) with a 'segments_left' value of 255 preceding an Authentication Header (AH). This signature targets an exploit pattern known as 'DirtyAH6', which aims to trigger a remote kernel crash or potential remote code execution on vulnerable systems by manipulating IPv6 header processing.
Detects high-frequency SCTP ASCONF/ADD-IP chunk packets originating from external networks. This behavior is indicative of a Denial-of-Service (DoS) exploit attempt targeting a vulnerability (CVE-2026-74469) related to DiagSpill transport_count integer wraparound.
Detects high-frequency SCTP ASCONF/ADD-IP chunk packets originating from external networks. This behavior is indicative of a Denial-of-Service (DoS) exploit attempt targeting a vulnerability (CVE-2026-74469) related to DiagSpill transport_count integer wraparound.
Detects high-frequency SCTP ASCONF/ADD-IP chunk packets originating from external networks. This behavior is indicative of a Denial-of-Service (DoS) exploit attempt targeting a vulnerability (CVE-2026-74469) related to DiagSpill transport_count integer wraparound.
This rule detects a high volume of SCTP traffic targeted at internal systems, characterized by mass endpoint creation. This behavior is indicative of an exploit attempt against the 'sctp_diag' kernel component (CVE-2026-74469), which can lead to an out-of-bounds (OOB) write condition, potentially resulting in system instability or denial of service.
This rule detects a high volume of SCTP traffic targeted at internal systems, characterized by mass endpoint creation. This behavior is indicative of an exploit attempt against the 'sctp_diag' kernel component (CVE-2026-74469), which can lead to an out-of-bounds (OOB) write condition, potentially resulting in system instability or denial of service.
This rule detects a high volume of SCTP traffic targeted at internal systems, characterized by mass endpoint creation. This behavior is indicative of an exploit attempt against the 'sctp_diag' kernel component (CVE-2026-74469), which can lead to an out-of-bounds (OOB) write condition, potentially resulting in system instability or denial of service.
Detects outbound HTTP GET requests to a specific C2 domain 'luizestrelhashapr.online' masquerading as CSS file fetches. The request pattern uses a specific path '/google_api/' followed by predefined alphanumeric filenames, consistent with the KREMLIN malware browser extension's C2 polling mechanism.
Detects HTTP requests containing malicious JDBC strings targeting PaperCut NG/MF print management software, which are indicative of attempts to exploit authentication bypass and remote code execution vulnerabilities (CVE-2026-81578, CVE-2026-82078).
Page 55 of 110