Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,158 detections
Filters
Last updated
All Time
Detection languages
2,304
1,070
640
289
288
Contributors
918
814
769
696
224
Categories
20,460
11,847
5,879
5,158
4,866
Platforms
2,861
2,017
816
524
213
Products / Services
1,339
1,144
831
576
366
MITRE Techniques
1,825
1,307
787
747
577
CVEs
9
7
7
6
6
IDS Classtypes
538
151
101
57
48
IDS Protocols
375
373
132
64
42
Detects potential Browser-in-the-Middle (BitM) phishing activity by identifying a client browser that fetches the 'rrweb' session-recording library followed by a WebSocket connection to a different origin within 5 minutes. This sequence is indicative of an attacker-controlled browser streaming the victim's DOM and interaction events to a phishing infrastructure.
Detects MFA authentication success from one IP address followed immediately by a session access attempt from a different IP address. This pattern is characteristic of Adversary-in-the-Middle (AiTM) phishing attacks, such as those using EvilProxy, Evilginx2, or similar phishing-as-a-service (PhaaS) platforms, where an adversary proxies the authentication flow to capture session tokens.
Detects browser-based WebRTC STUN traffic initiated from phishing landing pages used by the Bluekit PhaaS platform. The rule identifies suspicious STUN requests originating from browsers that exhibit a WebRTC IP mismatch when compared to the active HTTPS session IP, a technique used by attackers to de-anonymize security researchers and bypass automated analysis sandboxes.
This rule detects network connections and DNS requests to specific domains associated with Unistream SDK and other known BadBlocker malware infrastructure, often linked to malicious browser extensions such as Adblock for YouTube and related variants.
Detects network activity associated with the Turla group's STOCKSTAY malware infrastructure. This includes downloading MSI installers or server scripts from GitHub, as well as WebSocket C2 communications with the onrender.com platform.
Detects anomalous WebSocket connections on web pages that utilize the 'rrweb' session replay library, often used by phishing infrastructure such as the Bluekit Browser-in-the-Middle (AiTM) kit to capture and relay real-time victim input (keystrokes and mouse movements) to attacker-controlled consoles.
This rule detects network activity associated with the Bluekit PhaaS (Phishing-as-a-Service) BitM (Browser-in-the-Browser) C2 infrastructure. It monitors for connections to known malicious domains, the use of WebSocket upgrades over TLS, and the presence of 'rrweb' (a DOM recording library) in request URIs, which are indicative of browser-in-the-browser phishing C2 traffic.
Detects network communication associated with the Bluekit phishing framework and the use of the rrweb library to capture web sessions, including WebSocket upgrade attempts which may indicate unauthorized user activity monitoring or credential harvesting.
Detects outbound network connections to known blockchain API endpoints originating from developer scripting runtimes (e.g., node.exe, python.exe). This pattern is consistent with attackers using blockchain transactions as a dead-drop mechanism for retrieving encrypted second-stage payloads, a technique observed in supply chain attacks targeting developers.
Detects network connection attempts to the cloud Instance Metadata Service (IMDS) endpoint (169.254.169.254) initiated by processes that are not known cloud management agents or system utilities, which may indicate unauthorized credential or IAM role token theft.
Detects attempts by the Remcos RAT loader to perform WebRTC IP leakage by monitoring process command lines for keywords like 'webrtc', 'stun', 'turn', or 'ice' when initiated by common browsers (chrome.exe, firefox.exe, opera.exe) and having a parent process related to 'Remcos'. This indicates an attempt to gather victim IP addresses.
Detects outbound network connections to a known malicious IP (83.142.209.214) associated with Lambsys cryptominer activity. The rule specifically monitors for HTTP POST requests to '/status.php' or '/setup_status.php' using the default 'Go-http-client/1.1' User-Agent, indicating a C2 beaconing pattern.
Detects high-volume credential stuffing attacks targeting the WordPress 'wp-login.php' endpoint. The rule monitors for multiple geographically distinct source IP addresses submitting HTTP POST requests to the login page within a 2-minute window. It specifically identifies traffic patterns associated with common infostealer-harvested credential campaigns (such as Vidar, Stealc, or DanaBot) by matching a specific User-Agent string associated with the campaign.
This rule detects potential adversary-in-the-middle (AiTM) activity targeting FortiGate firewalls, specifically looking for internal authentication traffic (LDAP, Kerberos, LDAPS, MS-SQL) originating from a firewall management IP. The rule triggers if there are 5 such connections within 60 seconds, indicating a possible listening post or attempt to intercept credentials.
Identifies logins from known malicious VPN/Proxy exit nodes geolocated in Canada, specifically attempting to bypass geographic conditional access rules. This rule joins location data with threat intelligence indicators to detect suspicious access patterns.
Detects network connections originating from standard web browsers (Chrome, Edge, Brave, Chromium, Opera) to the domain 'perplexity-ai.online', which is indicative of potential command and control or unauthorized data exfiltration activity.
Identifies unauthorized attempts to leverage ssh-add or access the SSH agent socket to dump or forward local developer identities.
This rule detects outbound network connections to the typosquatted domain 'perplexity-ai.online'. This domain is associated with a malicious Chromium extension masquerading as a 'Search for Perplexity AI' tool, which uses this domain for search-traffic interception and command-and-control (C2) exfiltration.
Detects outbound SSH connections from common applications using libssh2 to external, non-standard or untrusted servers, followed by an anomalously large inbound TCP data transfer before authentication completes. This behavior is indicative of exploitation attempts targeting CVE-2026-55200, where a malicious SSH server triggers a heap overflow in the client via a malformed packet.
This rule detects potential SSH brute force attacks by identifying multiple failed password attempts from a single source IP address to a specific computer within a 5-minute window. It specifically looks for 'Failed password' messages in syslog entries from the 'sshd' process.
This rule detects multiple failed SSL login attempts from a single source IP to a destination IP within a 24-hour period. A threshold of 10 failed attempts is used to identify potential brute-force attacks or credential stuffing against SSL-enabled services.
Page 111 of 246