Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,303 detections
Filters
Last updated
All Time
Detection languages
2,251
22
21
7
2
Contributors
910
584
506
125
48
Categories
20,396
11,792
5,863
5,144
4,864
2,303
Platforms
2,190
209
168
62
61
Products / Services
2,250
2,159
163
32
31
MITRE Techniques
713
422
384
187
184
CVEs
17
12
12
12
10
IDS Classtypes
995
426
281
190
98
IDS Protocols
1,291
401
281
117
45
Detects outbound HTTP GET requests to google.com that utilize a bare 'Mozilla/5.0' User-Agent header, which is indicative of the TOKYOCORE malware performing network connectivity checks. This behavior is atypical for standard browsers and can be used to identify potential beaconing activity.
This rule monitors outbound TLS traffic for Server Name Indication (SNI) fields matching known C2 or phishing domains associated with the JadeProx activity. This indicates a potential connection from an internal host to malicious infrastructure.
Detects HTTP traffic patterns characteristic of suo5 and Neo-reGeorg web shell tunnels. These tools facilitate bidirectional communication through JSP endpoints (e.g., /jmx/suo5.jsp, /common/themes/top_css.jsp) by utilizing hardcoded proxy identifiers in HTTP headers. This behavior is indicative of a compromised web server acting as a pivot point for command-and-control operations.
Detects high-frequency HTTP GET request patterns indicative of bulk vulnerability scanning using the Nuclei scanner against public-facing web services. The rule triggers when a source IP initiates 250 or more requests within a 300-second window, excluding pre-authorized scanner source IP addresses.
This rule detects HTTP response bodies containing indicators associated with SourTrade malvertising campaigns, specifically JSON configuration fields and a base64-encoded Windows PE executable header (MZ/TVqQAAMAAAAEAAAA).
This rule monitors DNS queries for the domain 'veyko-service.org', which is identified as being associated with the NodeSnake RAT (Remote Access Trojan). The detection indicates potential command-and-control (C2) activity where an infected host attempts to reach a malicious infrastructure domain.
Detects outbound HTTP POST requests directed to Discord webhooks containing specific indicators associated with the TOKYOCORE ransomware, specifically identifying a unique User-Agent and a hardcoded exfiltration/C2 string in the request body.
Detects HTTP GET requests to a known malicious endpoint attempting to download a file named 'update_ms.msi', associated with the Chaos msaRAT trojan.
This rule detects potential command and control (C2) beaconing activity associated with the AdaptixC2 framework. It identifies HTTP requests containing a specific 'X-Beacon-Id' header combined with known C2 URI patterns and a specific User-Agent string commonly observed in AdaptixC2 traffic.
Detects network traffic consistent with the SleeperGem loader communicating with a Forgejo instance hosted on git.disroot.org. The detection looks for GET requests containing specific path patterns (e.g., '/git-ecosystem/', '/raw/branch/main/') and file extensions (deploy.sh or git-credential-manager), along with a 'Git' user-agent, which is characteristic of the loader's C2 retrieval activity.
Detects DNS queries matching known malicious infrastructure domains identified in SourTrade malvertising campaigns. These domains are often used by threat actors to host malicious payloads or C2 infrastructure.
Detects a multi-stage network activity pattern characteristic of 'SourTrade' cloaking. The rule tracks an initial HTTP request with a referral to a known lookalike crypto/trading domain, followed by the fetching of a client-side JavaScript fingerprinting script, and finally, a subsequent HTTP response that appears to be a near-empty decoy page (used to mask malicious content from crawlers).
Detects HTTP request attempts to exploit WordPress vulnerabilities (associated with 'wp2shell' activity) targeting the 'author_exclude' or 'author__not_in' parameters with SQL injection payloads, such as sleep() functions or comment injection characters.
This rule detects the initial WebSocket handshake request used by the INTERLOCK NodeSnake RAT for beaconing. It looks for a GET request containing a 'Sec-WebSocket-Key' header and a specific URI pattern (?v=n;) common to the RAT's communication profile.
This rule detects UDP traffic patterns characteristic of the msaRAT C2 handshake. It specifically identifies initial WebRTC DataChannel connection frames containing the 0xFE marker combined with ChaCha-Poly1305 encryption indicators within the expected packet size range.
This rule detects DNS queries for the domain 'xoredo-srv.com', which is associated with the INTERLOCK NodeSnake RAT for command and control communications.
This rule detects unauthenticated HTTP requests to the WordPress REST API batch endpoint (/wp-json/batch/v1). Such requests are characteristic of attempts to exploit the wp2shell vulnerability (CVE-2026-63030), where attackers leverage the batch API to execute unauthorized actions without proper authentication headers (Cookie or Authorization).
Detects DNS queries matching the pattern used by the CAV3RN C2 infrastructure. The rule identifies specific subdomains under 'cloudlanecdn.com' that follow a structured format consistent with C2 configuration recovery and heartbeat beacons, specifically looking for a hex-encoded timestamp pattern.
Detects HTTP GET requests associated with the Blind Eagle (APT-C-36) campaign JC-46, specifically targeting GitHub for payload delivery and fetching dropper files (such as .vbs, .bat, .js, or .pif) from known command-and-control staging infrastructure.
Detects specific WebSocket JSON-formatted C2 agent registration and profiling traffic associated with the TAG-195/TinyEgg campaign. The rules look for specific registration markers (agent_register, request_register) and host profiling data (hostname, username, OS, domain, isAdmin status) characteristic of this threat actor's C2 communication.
This rule detects network traffic patterns characteristic of the 'ChonkyChicken' malware using a 'proxy_request' method within a JSON payload, suggesting the initiation of command-and-control (C2) communication or traffic relaying through the infected host.
Page 85 of 110