Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,303 detections
Filters
Last updated
All Time
Detection languages
2,251
22
21
7
2
Contributors
910
584
506
125
48
Categories
20,417
11,806
5,870
5,145
4,864
2,303
Platforms
2,190
209
168
62
61
Products / Services
2,250
2,159
163
32
31
MITRE Techniques
713
422
384
187
184
CVEs
17
12
12
12
10
IDS Classtypes
995
426
281
190
98
IDS Protocols
1,291
401
281
117
45
Detects Odyssey Stealer malware communicating with a known C2 infrastructure using TLS and performing data exfiltration via HTTP requests to raw-IP destinations using disguised file names such as analytics.gif, pixel.png, and content.js.
Detects network activity associated with the 'ClickFix' campaign, specifically targeting the domain 'mnl.ac' and its associated infrastructure (IPs 149.255.35.135 and 45.74.7.27). The rules monitor for DNS queries, HTTP requests to fetch configuration files (configuration.ps1), and general outbound TCP connections that characterize the staging phase of the ClickFix PowerShell execution chain.
This rule detects potential Device Code Phishing (OAuth 2.0 device authorization) attempts by monitoring HTTP requests to the Microsoft device authorization endpoint (login.microsoftonline.com/common/oauth2/deviceauth) that originate from a suspicious referrer domain ending in .de. This behavior is indicative of an attacker-controlled landing page directing users to authenticate their device.
This rule detects potential Device Code Phishing (OAuth 2.0 device authorization) attempts by monitoring HTTP requests to the Microsoft device authorization endpoint (login.microsoftonline.com/common/oauth2/deviceauth) that originate from a suspicious referrer domain ending in .de. This behavior is indicative of an attacker-controlled landing page directing users to authenticate their device.
Detects network traffic patterns associated with the Kimsuky threat group utilizing raw.githubusercontent.com as a dead-drop resolver. The rule specifically identifies the retrieval of configuration files (.ini) and victim-specific data files (.dat) containing MachineGuid identifiers, which are characteristic of Kimsuky's command and control (C2) operations.
This rule detects DNS queries directed at known OAST (Out-of-band Application Security Testing) domains, such as 'dnslog.ink' and 'digimg.store', which are commonly used in the 'LucidPawn' framework for verifying external connectivity or exfiltrating data during initial discovery and post-exploitation phases.
Detects network activity associated with the 'ClickFix' campaign, specifically targeting DNS queries, TLS SNI, HTTP Host headers, and direct IP connections to known malicious infrastructure domains (cdnsuicaches.com, mnl.ac) and exfiltration endpoints (23.227.198.199).
Detects network activity associated with the 'ClickFix' campaign, specifically targeting DNS queries, TLS SNI, HTTP Host headers, and direct IP connections to known malicious infrastructure domains (cdnsuicaches.com, mnl.ac) and exfiltration endpoints (23.227.198.199).
Detects network activity associated with the 'ClickFix' campaign, specifically targeting DNS queries, TLS SNI, HTTP Host headers, and direct IP connections to known malicious infrastructure domains (cdnsuicaches.com, mnl.ac) and exfiltration endpoints (23.227.198.199).
Detects network indicators associated with the StealC information stealer, including DNS lookups for identified C2 domains, HTTPS traffic to known C2 endpoints, and suspicious POST requests using multipart/form-data indicative of credential or session data exfiltration.
Detects network activity associated with the 'ClickFix' campaign, specifically targeting the cdnsuicaches[.]com domain. The rules identify the initial DNS query, the subsequent TLS SNI connection, and the retrieval of malicious JavaScript containing the 'cookie-captcha-complete' overlay signature. This behavior is indicative of a browser-based social engineering attack.
Detects network beaconing and communications associated with the NetSupport Manager remote access tool. The rules monitor for outbound connections to a known actor-controlled IP/domain and identify unauthorized client responses containing a specific license serial number.
This rule detects network traffic patterns associated with the RatHat Android malware. Specifically, it monitors for HTTP requests targeting the '/api/sapp' or '/api/bapp' URIs, which are used by this malware for C2 evasion or to retrieve its block list.
This rule detects network traffic indicative of the HEAVYGRAM malware beaconing to Telegram's API. It identifies HTTP requests to api.telegram.org containing specific URI strings and parameters, which suggests the bot is performing check-in activities or sending status updates via a Telegram bot channel.
Detects network activity associated with the HEAVYGRAM PowerShell implant, specifically identifying outbound traffic to the Telegram Bot API (api.telegram.org). The rule looks for established connections and HTTP requests containing Telegram bot-specific URI patterns ('/bot', '/getUpdates') coupled with a 'WindowsPowerShell' user agent, indicating an automated beaconing mechanism used for command and control.
This rule detects potential exfiltration of sensitive files, specifically 'cert.pem' and 'private.key', via HTTP POST requests to the '/api/adbk/upload' endpoint. This pattern is characteristic of the RatHat malware attempting to exfiltrate device credentials to a Command and Control (C2) server.
This rule detects SQL injection attempts targeting the BuddyBoss members REST endpoint, specifically identifying exploitation patterns associated with the 'sqlmap' tool. The rule monitors for specific URL parameters including 'member_type', 'search_terms', and 'scope' in combination with an 'sqlmap' user-agent, indicating an automated exploitation attempt against the application.
Detects outbound network traffic consistent with the Chisel proxy/tunneling tool establishing a connection to an external VPS associated with the Miku threat actor. The rule monitors for established TCP connections to a specific remote IP address on port 443, utilizing a threshold to reduce noise by ensuring multiple connection attempts occur.
Detects the initialization of an FRP (Fast Reverse Proxy) protocol connection, characterized by a specific 3-byte null sequence followed by the 'frp' string marker in the packet header. This pattern is often associated with the RatHat malware using FRP to establish covert reverse tunnels for command-and-control communication.
This rule detects potential credential exfiltration by the RatHat malware, which attempts to upload 'cert.pem' and 'private.key' files to a remote server using a POST request to '/api/adbk/upload'.
Detects network beaconing and command-and-control (C2) communication patterns consistent with the HEAVYGRAM backdoor, which utilizes the Telegram Bot API for remote interaction. This rule monitors for encrypted SNI traffic directed at api.telegram.org, as well as specific HTTP polling and command execution patterns (e.g., /getUpdates, /bot<token>/) indicating automated interaction with a Telegram bot controlled by an adversary.
Page 56 of 110