Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,155 detections
Filters
Last updated
All Time
Detection languages
2,301
1,070
640
289
288
Contributors
918
814
769
696
224
Categories
20,456
11,839
5,876
5,155
4,865
Platforms
2,858
2,017
816
524
213
Products / Services
1,336
1,144
831
576
366
MITRE Techniques
1,822
1,307
787
747
577
CVEs
9
7
7
6
6
IDS Classtypes
538
151
101
57
48
IDS Protocols
375
373
132
64
42
Detects network communication to specific API endpoints associated with the RatHat Android malware, which leverages accessibility services for overlay-based credential harvesting and data exfiltration.
Detects potential AI-targeted cloaking, a technique where a web server serves different content to AI crawlers versus human users, identified by comparing HTTP response sizes or hashes across session logs. The rule uses Microsoft Sentinel's ASIM Web Session schema to correlate web requests, identifying discrepancies that suggest malicious or evasive intent. Covers T1036 & T1027
Detects OAuth 2.0 authorization requests sent to login.microsoftonline.com using the 'prompt=none' parameter, where the redirect_uri domain is not a trusted Microsoft property. This is a common indicator of consent phishing or malicious OAuth application abuse where an attacker attempts to redirect authorization tokens to an adversary-controlled endpoint.
Detects web traffic directed towards the AnonyMousKIT SMS relay API endpoint, commonly used by threat actors for dispatching SMS phishing lures. The rule monitors for requests to specific API paths related to SMS dispatching and analyzes the gateway status messages returned by the service.
Detects network requests (DNS queries or HTTP requests) to a predefined list of lookalike domains associated with the JWR phishing kit. These domains are designed to impersonate legitimate transport (LTA, OneMotoring, ERP) or courier/postal brands (Ninja Van, SingPost, Emirates Post) to deliver malicious payloads or credential harvesting pages.
Detects outbound network connections to known JWR phishing framework endpoints. The rule identifies suspicious interaction sequences, including initial beaconing via 'addClick' or 'getSyncSettings' followed by exfiltration of sensitive data (payment card info, OTPs) through POST requests to 'the_final_interface' or 'addCvv', or via a specific WebSocket channel pattern.
Detects sustained WebSocket connections to known C2 infrastructure associated with the JWR phishing framework. The rule identifies long-running sessions or frequent reconnection patterns characteristic of a live human operator interacting with a victim, as opposed to automated, one-time form submissions.
Detects the AnonyMousKIT vishing activity pattern by monitoring Twilio API call creation events followed by specific status or gather webhook callbacks from the same host within a one-hour window, consistent with automated voice phishing to collect DTMF-entered passcodes.
Detects the specific C2/WebSocket instruction sequence utilized by the JWR/Outsider phishing kit operators. The rule monitors DeviceNetworkEvents for characteristic outbound URL query parameters that indicate progress through a phishing interaction, including initial info collection (to_info), card data submission (to_card), and subsequent verification or outcome steps.
This rule detects network connections to specific domains and domain patterns that mimic legitimate entities (e.g., NinjaVan, EmiratesPost). The detection logic identifies direct matches to known malicious infrastructure and uses regular expressions to catch permutation-based typosquatting, which are common indicators of phishing or credential harvesting campaigns.
Detects the specific fingerprinting sequence associated with Mirage2FA AiTM phishing campaigns. The detection triggers when a process downloads a specific JavaScript loader from an '/xls/' path, followed closely within two minutes by an IP/geolocation lookup request to common services (api.ipify.org, api.country.is, api.ipgeolocation.io), which is a characteristic precursor to credential interception.
Detects network activity associated with Adversary-in-the-Middle (AiTM) phishing kits that perform client-side fingerprinting and geolocation tracking. The rules identify the initial fingerprinting request, the subsequent setting of a geolocation cookie by the proxy, and the query to a third-party geolocation service, using state tracking to correlate the chain of events.
Detects network activity associated with the GhostCode kit's bot-filter challenge, which performs session token/hash chaining prior to a device-code phishing redirect. The rule monitors for specific URL patterns containing 'check=1' and a session identifier, coupled with a mandatory 'js_enabled=1' cookie, commonly used to filter automated security scanners and verify bot activity before serving malicious content.
Detects network activity associated with the GhostCode phishing campaign, which leverages themed pages (e.g., MailDashboard) and Cloudflare Turnstile to perform security bypass checks. The rules identify the initial access URI pattern, the presence of specific phishing content in the HTTP response, and the subsequent verification cookies used after the CAPTCHA solution.
Detects anomalous POST requests containing the 'CrpxBoundary' string sent to a '/relay.php' endpoint. This signature is associated with the pre-encryption data exfiltration phase of CRPx0 ransomware.
This rule monitors for indicators of compromise (IOCs) associated with the Rapuncel/Cruciferra 'Bring Your Own Vulnerable Driver' (BYOVD) malware-as-a-service (MaaS) campaign. It detects malicious file hashes (associated with dropped binaries or drivers), connections to known malicious command-and-control (C2) IP addresses, and network requests to domains used by the infrastructure.
This rule monitors for network DNS queries containing keywords commonly associated with credential harvesting and identity verification lures, such as 'sso', 'mfa', 'passkey', or 'helpdesk'. It detects attempts to reach suspicious domains that may be used in phishing campaigns targeting corporate identity portals.
Detects indicators associated with the exploitation of CVE-2025-3248 in Langflow. The rule identifies anomalous web requests targeting the /api/v1/validate/code endpoint, subsequent suspicious process creation (base64 encoded payloads in Python/shell), and network communication with identified command and control (C2) or data exfiltration IP addresses. It also includes alerts for observed contact with known extortion email addresses.
Detects indicators associated with the exploitation of CVE-2025-3248 in Langflow. The rule identifies anomalous web requests targeting the /api/v1/validate/code endpoint, subsequent suspicious process creation (base64 encoded payloads in Python/shell), and network communication with identified command and control (C2) or data exfiltration IP addresses. It also includes alerts for observed contact with known extortion email addresses.
This rule monitors for indicators of compromise (IOCs) associated with the ShinyHunters threat actor, including specific malicious domains, IP addresses, and artifacts found in command lines or event data. It aggregates telemetry from network events, Entra ID sign-in logs, cloud application activity, email logs, process execution, and general device events to detect interaction with known malicious infrastructure or execution of threat-actor specific artifacts.
Detects endpoint, process, and network activity associated with the 'TaskStomp' threat actor, specifically targeting known malicious file hashes, command-and-control domains, and specific URLs used in their campaigns.
Page 39 of 246