Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,303 detections
Filters
Last updated
All Time
Detection languages
2,251
22
21
7
2
Contributors
910
584
506
125
48
Categories
20,401
11,795
5,864
5,145
4,864
2,303
Platforms
2,190
209
168
62
61
Products / Services
2,250
2,159
163
32
31
MITRE Techniques
713
422
384
187
184
CVEs
17
12
12
12
10
IDS Classtypes
995
426
281
190
98
IDS Protocols
1,291
401
281
117
45
Detects malicious heartbeat check-ins to a C2 server endpoint '/api/bot/heartbeat' by monitoring for unauthorized exfiltration of hardware identifiers (Host/Device/HW ID) or potential remote task execution via Base64-encoded instructions in the response body, characteristic of ClickFix-related infostealer campaigns targeting macOS users.
Detects outbound HTTP POST requests associated with the ChainDrop/Shai-Hulud malware family. The rule looks for 'eth_call' JSON-RPC method calls targeting a specific Ethereum smart contract address known to be used for EtherHiding C2 infrastructure, where malicious payloads or commands are embedded within blockchain interactions.
Detects macOS infostealer malware using the curl utility to exfiltrate archived data (zip, tar, tgz, etc.) via multipart POST requests to specific known staging endpoints associated with the ClickFix campaign.
This rule detects suspicious outbound HTTP POST requests containing specific JSON fingerprint payloads associated with ClickFix campaigns. The fingerprint contains a mode set to 'php', typically delivered via hidden, auto-submitting forms on malicious domains to profile victims or deliver secondary payloads.
Detects DNS query bursts from a single source to a predefined set of domains mimicking passkey or single-sign-on (SSO) login portals. These domains are known to be part of the infrastructure used by the UNC6671 threat actor for credential harvesting activities.
This rule detects sustained network communication (at least 5 connections within a 300-second window) between internal hosts and a specific list of IP addresses identified by Unit 42 as malicious infrastructure used for AI token jacking. These servers operate as transfer stations, likely utilizing platforms like new-api or one-api to facilitate the illicit resale of stolen frontier-AI API keys. The rule incorporates an exclusion for internal security scanning and proxy infrastructure to minimize false positives, and it is specifically designed to flag exfiltration or unauthorized API usage patterns associated with stolen credentials (T1539) and potential proxy-based obfuscation of command and control or data relay (T1090).
UNC6671 - Outbound connection to known automated SaaS data exfiltration IP, excluding maintained allowlist of legitimate backup/sync/CDN and sanctioned bulk-transfer destinations
UNC6671 AiTM passkey/SSO lookalike domain DNS query
UNC6671 AiTM Phishing Infrastructure - Maintained IOC Dataset Match with TTL-Based Expiry (High Confidence)
Detects outbound HTTP POST requests associated with the ChainDrop/Shai-Hulud malware family. The rule looks for 'eth_call' JSON-RPC method calls targeting a specific Ethereum smart contract address known to be used for EtherHiding C2 infrastructure, where malicious payloads or commands are embedded within blockchain interactions.
Detects a specific fingerprinting activity by the ClickFix Traffic Direction System (TDS) within HTTP POST request bodies. The rule identifies the combination of 'mode:php', a 'MacIntel' platform string (spoof-check), and WebGL rendering fields ('webglVendor', 'webglRenderer') in a JSON-encoded body, which is characteristic of the macOS ClickFix infostealer campaign delivery.
Detects HTTP POST requests to an Apache Tomcat server containing a Java serialized-object header (AC ED 00 05) in a request body larger than 512 bytes, consistent with CVE-2026-34486 deserialization exploitation.
Detects network communication associated with the TOKYOCORE malware C2 infrastructure. The rule monitors for specific API endpoints (/api/victim/(log|data|command|archive)) combined with known malicious User-Agent strings (RansomAgent or fsociety/1.0), as well as suspicious multipart form data uploads that may indicate data staging or exfiltration.
Detects outbound FOFA asset-search traffic containing an exact title="Langflow" query directed at the FOFA API host (fofa.info), indicating reconnaissance for Langflow deployments.
Detects network activity associated with the Dolphin X malware, including DNS queries, TLS SNI requests, and direct TCP traffic to known C2 infrastructure patterns on specific ports.
Detects a suspicious proxy authentication negotiation pattern involving multiple HTTP 407 challenges followed by a WebSocket upgrade and the establishment of a SOCKS5 tunnel, indicative of the BridgeHead adversary toolset.
Detects outbound HTTPS traffic to api.telegram.org originating from non-standard or unsigned processes. This rule is designed to identify potential data exfiltration by malware (such as stealers or trojans) using the Telegram Bot API as a C2 or exfiltration channel. It relies on a companion rule to establish flowbits for legitimate client traffic.
Detects inbound HTTP requests targeting specific hosts (photo.pokok.edu.hk, pta.sfaeps.edu.hk) with URI patterns associated with exploitation campaigns targeting vulnerabilities including CVE-2018-11511, CVE-2021-24139, CVE-2021-31755, and CVE-2021-32305.
Detects high-frequency outbound HTTP traffic matching specific URI patterns associated with potential Adaptix C2 beaconing behavior. The rule uses a sliding window threshold (10 requests within 600 seconds) to identify repetitive check-in patterns, which is a common characteristic of malware command-and-control channels.
This rule detects potential command-and-control (C2) activity related to the NodeSnake RAT. It specifically identifies cleartext HTTP requests attempting to initiate a WebSocket upgrade (using the Sec-WebSocket-Key header) while the target host is specified as an IP address literal rather than a domain name, which is a common indicator of hardcoded or non-DNS-dependent C2 infrastructure.
Detects high-volume outbound SYN packet bursts from internal hosts to external networks, excluding known service ports. This behavior is indicative of a compromised host acting as part of a botnet conducting a SYN flood Denial of Service attack.
Page 84 of 110