Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,158 detections
Filters
Last updated
All Time
Detection languages
2,304
1,070
640
289
288
Contributors
918
814
769
696
224
Categories
20,460
11,847
5,879
5,158
4,866
Platforms
2,861
2,017
816
524
213
Products / Services
1,339
1,144
831
576
366
MITRE Techniques
1,825
1,307
787
747
577
CVEs
9
7
7
6
6
IDS Classtypes
538
151
101
57
48
IDS Protocols
375
373
132
64
42
Identifies network connections to Telegram domains used by Vidar to read the C2 IP address dynamically from the profile description, specifically when initiated by AutoIt3.exe.
Hunts for the malware using the Windows API GetAdaptersAddresses to compile the host's IPv4 configurations for exfiltration. Specifically targets a process named "Подтверждение заказа продукции ЦАИ.exe" making this API call.
Detects network activity and DNS lookups associated with the domain 'loopedin.io', which has been identified as a second-hop open-redirect service used in forged healthcare-themed phishing campaigns. The rule specifically monitors connections from common web browsers to facilitate the identification of redirected user traffic.
This rule monitors network traffic for outbound connections to a specific remote IP address (38.60.253.35) on port 8084. This pattern is indicative of communication with a known command-and-control server or malicious infrastructure.
Detects an AI agent (manipulated by a poisoned recommendation prompt) attempting to access internal Cloud Metadata endpoints (e.g., AWS IMDS, Azure IMDS) to steal underlying infrastructure tokens.
Detects bulk domain group membership enumeration via LDAP
This rule detects the execution of processes containing the string "zuidrt" or the execution of 'mshta.exe', followed by a network connection to the known XenoRAT C2 IP address 185.235.137.106. This correlation aims to identify XenoRAT payload execution and subsequent communication with its command and control server, as observed in Operation XENOFISCAL.
Detects outbound network connections to specific known malicious egress IP addresses associated with Operation Escaneo, utilizing the Wget user agent to request the '/pwned' resource over port 8888, indicative of SOCKS5-tunneled data exfiltration.
Detects SMTP connections originating from the persistent Gamaredon operator subnet (194.58.66.0/24) on port 25.
Detects a specific C2 fallback mechanism used by Gamaredon, where the malware fails to resolve Cloudflare and then shifts to making multiple network connections to .ru or .su domains within a short time frame (more than 3 connections per minute). The connections are initiated by 'wscript.exe' or 'mshta.exe'. This pattern indicates a potential attempt to establish communication with a fallback command and control server.
Detects a non-browser mailbox collection or archive utility connecting directly to an IP address while RemoteUrl is empty. This behavior is suspicious as legitimate email clients typically use hostnames. The rule filters out common browsers and svchost.exe and looks for keywords in the command line indicative of mailbox or archive activity (e.g., .pst, .ost, Aspose.Email, mailbox, archive). This suggests an attempt to exfiltrate or collect email data, potentially bypassing DNS resolution for C2 or evasion.
Detects HTTP network connections to the specific URI path and parameters used by the OnyxC2 stealer for C2 beaconing and data exfiltration.
Detects HTTPS POST requests to known attacker-controlled infrastructure associated with the BadBlocker campaign (e.g., Unistream SDK, adblock-for-youtube domains). These requests often originate from browser extensions via injected scripts, facilitating the potential exfiltration of sensitive browser session data or credentials.
Detects the 'Adblock for YouTube' browser extension (cmedhionkhpnakcndndgjdbohmhepckk) initiating network connections to api.adblock-for-youtube.com to fetch scriptlets. This behavior is associated with bypassing URL validation to enable script injection on non-YouTube domains.
Detects behavior associated with the 'Adblock for YouTube' browser extension (ID: cmedhionkhpnakcndndgjdbohmhepckk) involving the injection of arbitrary JavaScript into the MAIN world of web pages. This occurs via remotely fetched script rules and the use of 'trusted-create-element' or similar methods to bypass browser sandboxing for script tag insertion and DOM access.
Detects anomalous WebSocket connections that transmit DOM serialization data using the rrweb library. This activity is indicative of a Browser-in-the-Middle (BitM) phishing framework, where an attacker records and relays a live, authenticated browser session from a victim to an adversary-controlled server.
Detects behavior indicative of the 'Adblock for YouTube' browser extension (or associated malicious variants) fetching rule configuration files from 'api.adblock-for-youtube.com', followed by suspicious outbound network traffic to non-Google/YouTube domains. This pattern suggests the extension is performing unauthorized data exfiltration, such as harvesting session cookies or credentials via injected scripts.
Detects outbound network connections or DNS lookups to domains associated with the Bluekit Phishing-as-a-Service (PhaaS) platform. This activity often indicates communication with decentralized peer-to-peer phishing infrastructure or Command and Control (C2) domains utilized for phishing campaigns.
Identifies outbound traffic to specific task dispatch endpoints.
Detects Browser-in-the-Middle (BitM) phishing attacks, such as Bluekit, that utilize the rrweb library for real-time DOM serialization and WebSocket streaming to capture user sessions. The rule correlates the presence of the rrweb library in HTTP traffic with WebSocket communication patterns containing session handshakes and serialized DOM payloads.
Outbound network connections from a sideloaded process context to Alibaba Cloud IPs.
Page 128 of 246