Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,155 detections
Filters
Last updated
All Time
Detection languages
2,301
1,070
640
289
288
Contributors
918
814
769
696
224
Categories
20,456
11,839
5,876
5,155
4,865
Platforms
2,858
2,017
816
524
213
Products / Services
1,336
1,144
831
576
366
MITRE Techniques
1,822
1,307
787
747
577
CVEs
9
7
7
6
6
IDS Classtypes
538
151
101
57
48
IDS Protocols
375
373
132
64
42
Detects the Sauron Loader execution chain, which involves a specific process (rnpkeys.exe, rnp.dll, or tdwp.dll) performing a network request (beacon), followed by the creation of a new file (executable, script, or library), and the subsequent execution of that same file. This pattern is characteristic of operator-issued download-and-run tasking.
Detects network communication to a known malicious IP address (45.32.253.166) associated with the PIVOTPIPE RAT using Cobalt Strike C2 beaconing patterns. The rule identifies TCP connections, HTTP GET requests for beacon check-ins, and HTTP POST requests for task responses.
Detects SMB traffic targeting the IPC$ share within the internal network, which is a common behavior of PIVOTPIPE lateral movement techniques using SMB named pipes for peer-to-peer (P2P) beacon communication.
Detects network connection events initiated by known beaconing-related process names. These processes are associated with command and control infrastructure or pivot nodes often used by adversaries for post-compromise activity.
Detects network traffic involving TLS certificates or Server Name Indication (SNI) values that attempt to impersonate the Uzbekistan state railway authority (azure.uzrailwaystax.com). The rules also flag connections associated with certificates issued by 'TLC DV TLS CA' and known C2 infrastructure using the spoofed railway certificate.
Detects network connection attempts to 'third-party.com', which was historically a common documentation placeholder domain but has since been acquired by attackers to serve malicious infrastructure. This rule flags processes interacting with this domain, identifying potential exploitation via copy-pasted code or documentation examples.
Detects potential DNS tunneling or Command and Control (C2) communication patterns. The rule calculates subdomain entropy to identify unusually long or randomized subdomain labels, monitors for excessive DNS query volume per client, and flags the use of specific record types (TXT, NULL) often associated with C2 frameworks like dnscat2 or iodine.
Detects network connections originating from or connecting to hosts that utilize known Cobalt Strike default JA3 or JA3S TLS fingerprints. These fingerprints are indicative of Cobalt Strike's default beacon communication patterns.
Detects network communication to a suspicious staging domain (pdf.gusercontent.com) that mimics legitimate services. This traffic is associated with the 'onInstalled' event handler of a malicious browser extension, often used to signal a successful infection or initiate secondary payload delivery.
Detects network communication to a suspicious staging domain (pdf.gusercontent.com) that mimics legitimate services. This traffic is associated with the 'onInstalled' event handler of a malicious browser extension, often used to signal a successful infection or initiate secondary payload delivery.
Detects network communication to a suspicious staging domain (pdf.gusercontent.com) that mimics legitimate services. This traffic is associated with the 'onInstalled' event handler of a malicious browser extension, often used to signal a successful infection or initiate secondary payload delivery.
Detects an account takeover chain where a device loads a malicious JavaScript component ('load-addon.js') in a browser session, followed by repeated attempts to bypass bot detection mechanisms (targeting Google's 'errors/robot.png') as the payload attempts to force authentication challenges or password resets.
Detects an account takeover chain where a device loads a malicious JavaScript component ('load-addon.js') in a browser session, followed by repeated attempts to bypass bot detection mechanisms (targeting Google's 'errors/robot.png') as the payload attempts to force authentication challenges or password resets.
Detects host and browser fingerprinting reconnaissance behavior associated with the Macfinger/ClickFix infection chain. The rule identifies multiple disparate indicators (ClickFix tracker domain, ipinfo.io geolocation lookups, and known AMOS C2 IP contact) occurring on the same device within a 15-minute window, effectively reducing noise from isolated or benign network lookups.
Detects network activity associated with the 'ClickFix' social engineering campaign, specifically targeting the 'Macfinger' variant. This involves detecting the fetching of obfuscated tracker JavaScripts (t.js), the delivery of deceptive 'Bot Protection' overlay HTML prompts used to trick users into executing malicious code, and network connections to known C2 infrastructure.
Detects network activity associated with the 'ClickFix' social engineering campaign, specifically targeting the 'Macfinger' variant. This involves detecting the fetching of obfuscated tracker JavaScripts (t.js), the delivery of deceptive 'Bot Protection' overlay HTML prompts used to trick users into executing malicious code, and network connections to known C2 infrastructure.
Detects network activity indicating interaction with known Adversary-in-the-Middle (AiTM) phishing infrastructure. This includes direct outbound connections to specific suspicious IP addresses and the identification of proxied Microsoft 365 OAuth authorization flows redirected to non-Microsoft hosts.
Detects network communication to a suspicious staging domain (pdf.gusercontent.com) that mimics legitimate services. This traffic is associated with the 'onInstalled' event handler of a malicious browser extension, often used to signal a successful infection or initiate secondary payload delivery.
Detects network communication to a suspicious staging domain (pdf.gusercontent.com) that mimics legitimate services. This traffic is associated with the 'onInstalled' event handler of a malicious browser extension, often used to signal a successful infection or initiate secondary payload delivery.
Detects network communication to a suspicious staging domain (pdf.gusercontent.com) that mimics legitimate services. This traffic is associated with the 'onInstalled' event handler of a malicious browser extension, often used to signal a successful infection or initiate secondary payload delivery.
Detects an account takeover chain where a device loads a malicious JavaScript component ('load-addon.js') in a browser session, followed by repeated attempts to bypass bot detection mechanisms (targeting Google's 'errors/robot.png') as the payload attempts to force authentication challenges or password resets.
Page 34 of 246