Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,303 detections
Filters
Last updated
All Time
Detection languages
2,251
22
21
7
2
Contributors
910
584
506
125
48
Categories
20,396
11,792
5,863
5,144
4,864
2,303
Platforms
2,190
209
168
62
61
Products / Services
2,250
2,159
163
32
31
MITRE Techniques
713
422
384
187
184
CVEs
17
12
12
12
10
IDS Classtypes
995
426
281
190
98
IDS Protocols
1,291
401
281
117
45
Detection of network communications associated with the TAG-195 campaign, specifically targeting the 'ClickFix' social engineering lure. The rules identify TLS SNI, DNS queries, and HTTP requests involving known C2/staging domains 'screenly.cam' and 'xtrafftrck.net', as well as specific payload retrieval patterns for OCX files and 'curl' usage involving the infrastructure IP 70.34.205.43.
Detects network indicators related to the BlueNoroff ClickFix Kit, specifically targeting malicious TURN relay domains (edensun.xyz) used for WebRTC-based webcam exfiltration and Command and Control (C2) traffic involving Socket.IO signals that trigger malicious UI modals.
Detects multiple repeated web requests targeting WordPress 'author_exclude' or '/wp/v2/batch' endpoints that contain suspicious time-based SQL injection payloads. The rule specifically looks for patterns attempting to leverage SLEEP() functions to infer database information.
Detects network traffic indicating msaRAT behavior where a host initiates a STUN/TURN token request to a Cloudflare Workers (.workers.dev) domain. The rule identifies suspicious characteristics including spoofed Microsoft-related Origin or Referer headers and a HeadlessChrome User-Agent, commonly used by automated C2 communication.
Detects HTTP response bodies containing specific combinations of advertising tracking markers (Google gtag, Meta fbq, and Twitter twq) alongside known path indicators like '/config' or 'sw.js', which are characteristic of SourTrade malvertising landing pages.
Detects a specific DNS AAAA record response containing a hardcoded sentinel value (2001:4998:44:3507::8000) associated with the CAV3RN framework, which signals a failed configuration recovery process.
Detects the HTTP POST exfiltration pattern used by the mrmustard stealer to send harvested credentials/host data to its C2 endpoint at metrics.femboy.energy/v1/collect.
Detects outbound HTTP POST requests to a Polygon blockchain JSON-RPC endpoint containing the eth_call method and a specific hardcoded smart contract address and function selector associated with the TELEPUZ malware command-and-control communication.
Detects established TLS connections to known malicious infrastructure associated with PureRAT and DlrtyGames RAT. The rules identify suspicious patterns such as connections without a Server Name Indication (SNI) and specific JA3 hashes indicative of malware beacons.
This rule detects a specific WebSocket handshake pattern associated with the NodeSnake RAT. It specifically identifies an HTTP GET request containing a 'Sec-WebSocket-Key' header and a specific URI query parameter '?v=4|3b|', which indicates beaconing activity characteristic of this RAT's communication channel.
This rule detects DNS queries for the domain 'terezo-kb.org', which is associated with the NodeSnake Remote Access Trojan (RAT), often utilized by the INTERLOCK ransomware group for command and control (C2) communication.
Detects outbound HTTP requests to a specific Telegram channel (chanadarkpart) commonly associated with the TELEPUZ malware (used by SCMBANKER), indicating a potential command-and-control (C2) dead-drop resolver communication attempt.
This rule detects a specific HTTP request pattern targeting the WordPress REST API batch endpoint. It identifies a malformed sub-request path containing a path string formatted as 'http://:', which is indicative of a 'route confusion' attempt, potentially leading to unauthorized operations or SSRF (Server-Side Request Forgery) within the WordPress environment.
This rule detects network traffic patterns associated with BlueNoroff ClickFix C2 communications. It specifically identifies GET requests to endpoints containing an 'ft?id=' parameter followed by a base64-encoded string, which indicates the delivery of encrypted tasking parameters to an infected system.
Detects network activity associated with BlueNoroff ClickFix campaigns, specifically targeting the download of suspicious Windows PE files from typosquatted CDN/payload URIs. The rule uses session tracking to correlate the initial URI request with the subsequent retrieval of executable content.
This rule detects network traffic patterns where an internal host initiates an HTTP connection to a specific Steam Community profile, which is used as a dead-drop resolver by the TELEPUZ malware (associated with the CLICKFIX-VIDAR campaign) to retrieve secondary command-and-control infrastructure information.
This rule detects network activity associated with a phishing campaign impersonating the RENAPO CURP lookup service. It monitors for TLS SNI and HTTP Host headers containing the typosquatted domain 'gobf.mx', as well as HTTP responses containing specific keywords related to the Mexican CURP registration form originating from this domain.
Detects network communication associated with the Blind Eagle (APT-C-36) threat actor's use of AsyncRAT. This rule identifies DNS queries for a specific DuckDNS domain, matching TLS SNI for the same domain, and network connections to a known historic C2 IP address historically used via a shared VPN egress.
Detects outbound TLS traffic directed toward ngrok.io infrastructure originating from Azure Container Instances. Ngrok is frequently used by adversaries to establish reverse proxies and tunnels to maintain persistent command-and-control access to compromised cloud-hosted containers.
Detects unauthenticated HTTP POST requests targeting the /api/v1/validate/code endpoint in Langflow, which is indicative of an exploitation attempt associated with CVE-2025-3248.
Detects DNS queries for the Twilio TURN relay domain 'global.turn.twilio.com', which is associated with msaRAT C2 activity. This indicator is low-confidence and intended to be used as part of a correlation with other behaviors like loopback C2 traffic or suspicious DevTools usage.
Page 86 of 110