Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,303 detections
Filters
Last updated
All Time
Detection languages
2,251
22
21
7
2
Contributors
910
584
506
125
48
Categories
20,396
11,792
5,863
5,144
4,864
2,303
Platforms
2,190
209
168
62
61
Products / Services
2,250
2,159
163
32
31
MITRE Techniques
713
422
384
187
184
CVEs
17
12
12
12
10
IDS Classtypes
995
426
281
190
98
IDS Protocols
1,291
401
281
117
45
Detects outbound HTTP POST requests containing JSON-RPC 'eth_call' methods, which are indicative of EtherHiding activity where blockchain infrastructure is abused for command and control or data retrieval.
Detects network traffic originating from the internal network directed towards a specific IP range associated with known PureRAT command and control infrastructure.
Detects outbound network traffic established to an *.ngrok.io domain, which is frequently used by adversaries to create secure tunnels for command and control (C2) or unauthorized data exfiltration.
Detects periodic, repetitive TLS network connections from internal hosts to external destinations using threshold-based analysis. This pattern is indicative of potential command-and-control (C2) beaconing, which may be used for exfiltrating stolen credentials or sensitive data from build or developer environments.
Detects sequential HTTP GET requests for specific SVG assets (barr.svg followed by lg.svg) associated with the Kratos V1 phishing kit landing page, indicating potential interaction with a phishing site.
Detects outbound network traffic to a specific .onion domain associated with underground ransomware or crypter sales. This suggests potential interaction with C2 or malicious infrastructure hosted via the Tor network.
Detects outbound network traffic containing the specific string 'Secret: ' using raw TCP, often indicative of data exfiltration or unauthorized command-and-control communication via tunneling tools like netcat or ngrok.
This rule monitors for a high volume of WebDAV PROPFIND HTTP requests directed toward a specific domain associated with malware staging activities. The detection threshold is set to 50 requests within a 300-second window, which is indicative of automated attempts to enumerate or download malicious content using the WebDAV protocol.
Detects outbound TCP network traffic originating from internal assets to known hardcoded IP addresses and ports associated with PureRAT and DlrtyGames RAT malware families, indicating active command and control (C2) communication.
Detects HTTP POST requests directed at known Kratos Phishing-as-a-Service (PhaaS) URI paths, specifically 'PTT', 'SOft', or 'mini.php'. These paths are commonly associated with credential exfiltration activities.
This rule detects unauthorized or suspicious access to the Komari remote administration panel over unencrypted HTTP. Detecting such access is critical as it indicates potential management interface exposure or unauthorized administrative activity within the network.
Detects DNS query attempts to a known malicious IP address (179.43.166.242) associated with the CrashStealer malware campaign, indicating potential command-and-control communication.
Detects HTTP POST requests indicative of credential exfiltration associated with the Kratos phishing kit. The rule monitors for specific endpoint patterns (e.g., next.php, nex.php, n3xt.php, or officers*eur.php) commonly utilized by this kit to receive stolen credentials.
Detects HTTP GET requests for specific static assets (dsa.svg, sid.gif, imag.jpg) known to be associated with the Kratos V2 phishing kit, which is often used in credential harvesting campaigns.
Detects HTTP traffic originating from external sources that contains response body patterns associated with a DEBULL-themed phishing lure. This rule specifically identifies content indicators related to device-code broker phishing, where a user is tricked into navigating to a malicious URL (debull.app) to authorize access or provide credentials.
Detects network traffic characterized by a specific rotating domain generation algorithm (DGA) pattern using .xyz TLD with a 10-digit timestamp, in combination with a specific URI structure containing 'script?id=' and the suspicious 'tag=WinUpdateHelper' parameter. This behavior is indicative of C2 communication.
Detects incoming HTTP requests directed at the Nacos server application path that contain specific identifiers indicative of an exploitation attempt for CVE-2021-29441. This vulnerability allows an attacker to bypass authentication mechanisms.
Detects network traffic (DNS, TLS SNI, and HTTP Host header) to the domain 'couldinstallup.com', which is associated with Command and Control (C2) activity by the threat group Mustang Panda.
Detects specific URI patterns associated with the DEBULL (also known as CloakGuard) Phishing-as-a-Service (PhaaS) platform. These URI paths are commonly used by attackers managing phishing campaigns, including administrative authentication or deployment script execution on compromised infrastructure acting as a phishing panel.
Detects HTTP POST requests containing 'poll_auth_broker_token' and 'device_code' parameters, which are characteristic of malicious OAuth 2.0 device authorization grant flows commonly used in phishing campaigns.
This rule detects HTTP POST requests to known phishing domains (frenksv.sbs, debull.app) which include specific parameters indicative of an attempt to initiate the OAuth 2.0 device authorization grant flow ('get_auth_broker_device_code'). This pattern is associated with phishing campaigns aiming to hijack a user's session by tricking them into authorizing a malicious application, eventually leading to the theft of application access tokens.
Page 87 of 110