Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,158 detections
Filters
Last updated
All Time
Detection languages
2,304
1,070
640
289
288
Contributors
918
814
769
696
224
Categories
20,460
11,847
5,879
5,158
4,866
Platforms
2,861
2,017
816
524
213
Products / Services
1,339
1,144
831
576
366
MITRE Techniques
1,825
1,307
787
747
577
CVEs
9
7
7
6
6
IDS Classtypes
538
151
101
57
48
IDS Protocols
375
373
132
64
42
Tracks browser network events fetching the dynamic malicious payload pipiteimosa.extension.js, specifically when initiated by Chrome or Microsoft Edge browsers. This activity is associated with the UnregStealer malware, which targets Brazilian banking credentials.
Identifies downstream ClickFix where users paste and execute PowerShell or CMD commands via the Explorer Run menu, specifically looking for commands that include Invoke-WebRequest, IEX, or mshta, and are associated with network connections to 'wigetticks.com' or 'wizzleticks.com'.
Detects PowerShell IEX validating the human-operated kill switch at the lnk1.txt endpoint, which is characteristic of the UnregStealer malware's communication with its C2 server.
Tracks browser network events where chrome.exe or msedge.exe are fetching a dynamic extension script named 'whitelist.extension.txt'. This activity is associated with the UnregStealer malware, which is known for human-operated browser credential theft.
Detects browser network events fetching secondary stage loaders from api.wizzleticks.com, specifically when initiated by cmd.exe, powershell.exe, or mshta.exe. This indicates a potential supply chain attack where a legitimate process is used to download and execute malicious content.
Detects mshta.exe downloading malicious HTA logic from the 'wizzleticks.com' domain. This activity is often associated with initial access or execution phases of an attack, where mshta is abused to fetch and execute remote scripts or HTA files.
Detects the loading of a compromised JavaScript file from a CDN (cdn-static.okendo.io/reviews-widget-plus/js/okendo-reviews.js) followed by the execution of mshta.exe on the same device within a 10-minute timeframe, indicating a potential supply chain attack by SmartApeSG.
Detects network connections or DNS queries to the specific link-aggregation domain 'fanlnk.to'. This domain is known to be abused by the threat actor SniperDz to mask the destination of malicious social media lures, often leading to phishing or malware delivery.
Detects suspicious activity involving the upload of multiple unique packages to common CI/CD package repositories (like npmjs, pypi, Artifactory, Nexus, Maven) from a single device within a short timeframe. This could indicate a compromised build server or developer account attempting to inject malicious dependencies into the software supply chain.
This rule detects potential exploitation attempts targeting REDCap, specifically looking for file events involving 'help.php' or 'Upgrade.php', or network events where the remote URL contains 'REDCAP-TOKEN'. These indicators suggest an attacker might be trying to exploit known vulnerabilities or exfiltrate data from a REDCap instance.
Detects node.exe launching with hardcoded easy-day-js C2 IP and port combinations passed as command-line arguments, indicative of the Mastra NPM supply chain compromise.
This rule detects network connections initiated by 'bun.exe' to specific IP address ranges (94.154.172.0/24 or 91.195.240.0/24) that have been identified as malicious command and control (C2) infrastructure. This indicates potential compromise of a system where 'bun.exe' is being used for malicious communication.
Detects connections to a known XenoRAT C2 IP address (185.235.137.106) originating from processes other than common web browsers (mshta.exe, chrome.exe, msedge.exe). This aims to identify potentially injected shellcode or RAT processes establishing command and control communications.
This rule detects network connections to FTP servers (port 21) where the remote URL contains keywords associated with NetWare or Novell, along with suspicious whitespace patterns. This could indicate an attempt to exploit a known vulnerability related to whitespace handling in NetWare FTP servers, potentially the 'Squidbleed' vulnerability.
Correlates Windows 365 or Citrix client execution with network share discovery commands by the same account on the same device within thirty minutes. This rule detects potential post-compromise activity where an attacker might be using a VDI session to enumerate network shares.
Detects a single process initiating SSH connections to a large number of distinct private IP addresses within a ten-minute window. This behavior can indicate automated lateral movement, credential spraying, or other malicious network reconnaissance activities.
Vapt Framework Markers
YARA-L
Detects the unique start and end markers (VAPTb3gin, VAPTfin) used by the VAPT autonomous framework to confirm exploit success across network or host logs.
This rule detects potential domain fronting activity used to hide Command and Control (C2) servers. It specifically looks for HTTP traffic where the TLS Server Name Indication (SNI) or HTTP Host header contains known domain fronting providers like cloudfront.net or azureedge.net, combined with a suspicious pattern in the HTTP Host header that includes an 8 or more character alphanumeric string followed by a top-level domain commonly associated with malicious activity (xyz, top, club, icu). This combination suggests an attempt to disguise C2 communications by routing them through legitimate content delivery networks.
Detects network connections to known SmartApeSG backend domains (wigetticks.com, wizzleticks.com) or specific regex pattern 'okendo-reviews.js$' associated with SmartApeSG C2 infrastructure.
Detects use of forged web cookies for bypassing authentication
Detects enumeration of Wi-Fi networks and saved profiles
Page 140 of 246