Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,303 detections
Filters
Last updated
All Time
Detection languages
2,251
22
21
7
2
Contributors
910
584
506
125
48
Categories
20,417
11,806
5,870
5,145
4,864
2,303
Platforms
2,190
209
168
62
61
Products / Services
2,250
2,159
163
32
31
MITRE Techniques
713
422
384
187
184
CVEs
17
12
12
12
10
IDS Classtypes
995
426
281
190
98
IDS Protocols
1,291
401
281
117
45
This rule detects high-frequency TCP SYN connection attempts originating from external networks targeting common administrative or tunneling ports (1723/PPTP, 1701/L2TP, 22/SSH) on internal systems. The detection uses a threshold of 100 connection attempts within 120 seconds, which is characteristic of automated reconnaissance and network scanning behavior.
Detects successful exploitation attempts targeting Vite development servers via chained access-control bypass vulnerabilities (CVE-2025-30208, CVE-2025-31125, CVE-2024-45811). The rule identifies malicious GET requests using the /@fs/ endpoint with specific query parameters, resulting in a successful HTTP 200 response, while originating from non-internal IP addresses.
Detects attempts to access sensitive files like environment variables (.env), cloud provider credentials (AWS/Azure), or Terraform state files via a web server interface, specifically targeting Vite development server deployments.
This rule detects inbound HTTP requests targeting a Vite development server that attempt to access the '.env' configuration file via the '//@fs/' path, which is a known technique for sensitive file exposure in misconfigured Vite environments.
This rule detects inbound HTTP requests targeting a Vite development server that attempt to access the '.env' configuration file via the '//@fs/' path, which is a known technique for sensitive file exposure in misconfigured Vite environments.
This rule detects inbound HTTP requests targeting a Vite development server that attempt to access the '.env' configuration file via the '//@fs/' path, which is a known technique for sensitive file exposure in misconfigured Vite environments.
Detects outbound network traffic to the Telegram Bot API where the request body contains keywords associated with cryptocurrency wallet software (e.g., MetaMask, Phantom, Tron). This behavior is indicative of a malicious script, possibly embedded in a Google Docs sidebar or similar web-based application, exfiltrating host/browser information or wallet-related data to an attacker-controlled Telegram bot.
Detects outbound network traffic (TCP and TLS) from internal hosts to known command and control (C2) infrastructure associated with the FamousSparrow threat actor and their SparroWocky malware suite.
Detects outbound TLS and HTTP traffic directed towards 'testing.perplexity.com', an unlocked test subdomain reportedly associated with the BragJack campaign for AI agent hijacking. This indicates potential interaction with an adversary-controlled or compromised infrastructure used to intercept or manipulate AI agent sessions.
Detects network activity (DNS queries, TLS SNI, and HTTP requests) directed towards the 'web12api.com' domain, as well as specific HTTP response structures commonly associated with adversary registration or command-and-control communication protocols.
Detects network communication with known Command and Control (C2) IP addresses associated with Phantom Stealer malware. This rule monitors both outbound connections from the internal network and inbound traffic from the identified malicious infrastructure.
Detects network communication to known malicious infrastructure associated with the SparroWocky malware, often used by the FamousSparrow threat actor. The rule monitors for established TCP or TLS-encrypted connections on ports 443 and 8080 directed toward specific IP addresses identified as part of the C2 infrastructure.
This rule detects HTTP POST requests to the Telegram Bot API where the request body contains specific action keywords (e.g., VIEW or MOBILE). This pattern is often indicative of C2 communication using legitimate Telegram infrastructure to control compromised systems.
Detects outbound network connections (both TCP and TLS) from internal hosts to known command-and-control (C2) infrastructure associated with the SparroWocky malware family. This rule monitors for established connections to a curated list of malicious IP addresses over ports 443 and 8080.
Detects outbound TLS connections from internal hosts to known IP addresses associated with the SparroWocky command-and-control infrastructure, including the specific byte sequence used during the TLS handshake to signal a ready state.
Detects network traffic on TCP port 3308 consistent with VectraRAT beaconing, utilizing MessagePack-over-TCP. The rule monitors for established connections to external networks with specific stream size and content characteristics typical of this C2 communication channel.
Detects network traffic on TCP port 3308 consistent with VectraRAT beaconing, utilizing MessagePack-over-TCP. The rule monitors for established connections to external networks with specific stream size and content characteristics typical of this C2 communication channel.
Detects network traffic on TCP port 3308 consistent with VectraRAT beaconing, utilizing MessagePack-over-TCP. The rule monitors for established connections to external networks with specific stream size and content characteristics typical of this C2 communication channel.
Detects network traffic on TCP port 3308 consistent with VectraRAT beaconing, utilizing MessagePack-over-TCP. The rule monitors for established connections to external networks with specific stream size and content characteristics typical of this C2 communication channel.
Detects HTTP GET requests to '/api.php?t=' containing a 13-digit timestamp identifier, followed by a response body containing 'download_link'. This pattern is indicative of the SilverFox malware relaying instructions or stage-two payload delivery.
Detects a host making 3 or more outbound connections within 5 minutes to AWS-hosted IP addresses known to host NJRAT C2 infrastructure from the GTA6 lure campaign, consistent with periodic RAT beaconing rather than a one-off incidental connection.
Page 68 of 110