Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,303 detections
Filters
Last updated
All Time
Detection languages
2,251
22
21
7
2
Contributors
910
584
506
125
48
Categories
20,401
11,795
5,864
5,145
4,864
2,303
Platforms
2,190
209
168
62
61
Products / Services
2,250
2,159
163
32
31
MITRE Techniques
713
422
384
187
184
CVEs
17
12
12
12
10
IDS Classtypes
995
426
281
190
98
IDS Protocols
1,291
401
281
117
45
Detects high-frequency, repeated exploitation attempts or IDS alerts referencing Siemens S7 CVEs directed at a single destination IP, potentially indicating iterative exploit development or automated vulnerability testing against Industrial Control System (ICS) hardware.
Detects outbound HTTP POST requests characterized by an 'application/octet-stream' content type, a specific URI structure consisting of three components (20-40 characters, alpha-numeric, 20-40 characters), and an encrypted payload. This behavioral pattern is associated with SynkLoader malware command-and-control (C2) communications.
Detects HTTP traffic directed to known abused web hosting platforms and SaaS site builders frequently used by the BengalSEO campaign to host search engine optimization (SEO) poisoning lures. These lures typically mimic service activation or support pages to trick users into downloading malicious content.
Detects outbound network traffic to the Telegram Bot API (api.telegram.org) via TLS SNI or HTTP requests, which is a common communication channel for Command and Control (C2) or management for Phishing-as-a-Service (PhaaS) platforms.
Detects network activity (DNS queries, TLS SNI, and HTTP Host headers) directed towards domains ending in the .vu Top-Level Domain (TLD). This is associated with NovaCookies phishing infrastructure which utilizes these TLDs for malicious redirection or staging.
Detects repeated attempts to establish S7comm connections to a Programmable Logic Controller (PLC) on port 102. This behavior is indicative of network reconnaissance or scanning targeting Industrial Control Systems (ICS).
Detects network activity (DNS, TLS SNI, and HTTP Host) associated with the SynkLoader malware's command-and-control infrastructure using the domain 'dondermicapp.net'.
Detects persistent outbound TCP connections to external infrastructure, which is indicative of a potential backconnect proxy or C2 communication tunnel. The rule uses a threshold to filter out transient connections.
This rule detects QUIC network traffic where the TLS certificate subject and issuer match specific patterns associated with 'RAT System' and 'RAT CA'. This signature indicates potential command-and-control (C2) communication utilizing self-signed certificates for authentication pinning in an attempt to masquerade or secure malicious traffic.
Detects network activity associated with the NovaCookies phishing campaign, specifically identifying HTTP redirects, TLS SNI connections, or HTTP host headers pointing to infrastructure utilizing .vu top-level domains.
This rule detects patterns characteristic of the ClearFake/EtherHiding campaign, specifically identifying the injection of malicious JavaScript within HTTP responses. The rule monitors for the creation of a script element and the use of base64-encoded javascript content, which is a known technique used in these attacks to facilitate drive-by compromises.
Detects outbound network connections from internal hosts to known IP addresses associated with Dark Caracal's GoCaracal malware command and control infrastructure.
Detects DNS queries for domains identified as part of the GoCaracal campaign, associated with the threat actor Dark Caracal. These domains are known to be used for the delivery and staging of SVG-based phishing attacks.
Detects Microsoft-branded phishing pages served from non-Microsoft domains, the subsequent credential submission, and the establishment of a WebSocket relay connection characteristic of the Mirage2FA Adversary-in-the-Middle (AiTM) toolkit. This rule correlates multiple stages of the phishing flow to identify active proxy-based credential and MFA bypass attempts.
Detects outbound HTTP POST requests to known SynkLoader C2 domains or URI patterns, characterized by 'application/octet-stream' Content-Type headers. The rule targets specific hardcoded domains used by the malware and a suspicious nested URI path pattern commonly associated with its beaconing behavior.
Detects HTTP traffic communicating with known domains (grove-12.com and trekmesh15.com) associated with the Codex ClickFix/AMOS campaign, specifically looking for indicators of payload staging or beaconing activity through specific URI patterns.
Detects network traffic consistent with SynkLoader malware communicating with its C2 infrastructure. The rule identifies suspicious TLS SNI requests to known hardcoded domains and HTTP POST requests using the application/octet-stream content type, which are characteristic of SynkLoader C2 beaconing.
Detects outbound HTTP POST requests with a specific URI pattern associated with C2Looper malware communication, indicating potential C2 activity or data exfiltration.
This rule monitors outgoing HTTP traffic for a specific numeric URI path pattern ( /49890878) which is characteristic of beaconing behavior to a command-and-control (C2) server. Such static, non-descriptive URI paths are frequently used by malware to maintain consistent connectivity to an adversary-controlled infrastructure.
Detects DNS queries containing high-entropy domain labels that exhibit patterns common to Domain Generation Algorithms (DGA). The rule triggers when a threshold of such suspicious queries is exceeded from a single source within a 60-second window, which is a common indicator of malware beaconing or C2 communication.
This rule detects potential command-and-control (C2) activity from the TWINLOOT malware, which utilizes Microsoft Teams TURN relay infrastructure to establish a reverse SOCKS5 tunnel. The detection identifies connections to 'worldaz-msit.relay.teams.microsoft.com' followed immediately by a SOCKS5 handshake pattern (05 01 00), indicating encapsulated tunneling within the relay communication.
Page 82 of 110