Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,156 detections
Filters
Last updated
All Time
Detection languages
2,302
1,070
640
289
288
Contributors
918
814
769
696
224
Categories
20,456
11,839
5,877
5,156
4,865
Platforms
2,859
2,017
816
524
213
Products / Services
1,337
1,144
831
576
366
MITRE Techniques
1,823
1,307
787
747
577
CVEs
9
7
7
6
6
IDS Classtypes
538
151
101
57
48
IDS Protocols
375
373
132
64
42
Movie Reaper Activity
YARA-L
Detects activity associated with MovieReaper campaign including process, file, and network indicators
Detects activity associated with the 'MovieReaper' threat campaign by identifying known malicious file hashes, command and control (C2) IP addresses, and communication with identified malicious domains. This rule monitors process execution, file operations, and network connections within the campaign's active timeframe.
Detects activity associated with the 'MovieReaper' threat campaign by identifying known malicious file hashes, command and control (C2) IP addresses, and communication with identified malicious domains. This rule monitors process execution, file operations, and network connections within the campaign's active timeframe.
Detects activity associated with the 'MovieReaper' threat campaign by identifying known malicious file hashes, command and control (C2) IP addresses, and communication with identified malicious domains. This rule monitors process execution, file operations, and network connections within the campaign's active timeframe.
This rule monitors and alerts on network traffic (TCP/TLS/HTTP) directed toward a known malicious IP address associated with an Adversary-in-the-Middle (AiTM) phishing infrastructure, categorized under the PREY-0058 designation.
This rule detects potential Xray-core command-and-control (C2) activity where a client initiates a TLS connection using 'dl.google.com' as the Server Name Indication (SNI) but connects to a destination IP address that does not belong to Google's infrastructure. This technique is often used to mask C2 traffic as legitimate traffic to Google services.
Detects suspicious network traffic to Ethereum Sepolia testnet RPC endpoints (Alchemy and Infura) indicative of the 'indexed-btree' malware campaign. The rule monitors for characteristic C2 polling patterns, specifically requests involving malicious contract addresses and specific RPC methods (eth_call, eth_getStorageAt) associated with this activity.
This rule detects activity associated with the 'Ghostcode' threat campaign by monitoring multiple telemetry sources. It identifies connections to known malicious IP addresses and domains, patterns consistent with phishing kit hosting, and specific URL structures used in credential harvesting or payload delivery. The rule correlates sign-in logs, device network events, DNS queries, and email telemetry to identify potential compromise.
Detects delivery and execution artifacts associated with the BlueMoon CVE-2026-85046 V8 type-confusion exploit. The rule monitors for known exploit-related file names (e.g., driver-html.js) and characteristic string indicators (e.g., v8ctf_exp_attempt, addrof, fakeobj) across file system, process execution, and network telemetry.
This rule monitors for network and email activity associated with known fraudulent AI reseller infrastructure. It aggregates data from device network connections, email URL inspections, and email header analysis to identify potential interactions with malicious domains known to facilitate AI-related fraud.
This rule detects network connections to known command-and-control (C2) infrastructure associated with the KREMLIN browser extension. The extension exfiltrates browser data (cookies, sessionStorage, localStorage) by masquerading data transfer within requests to .css files hosted on the attacker-controlled domain 'luizestrelhashapr.online'.
Detects network requests to the Microsoft authentication service specifically targeting the /common/oauth2/deviceauth endpoint, which is used in the OAuth 2.0 Device Authorization Grant flow. While legitimate for device authentication (e.g., CLI tools, smart devices), this flow can be abused by adversaries for phishing attacks to bypass traditional credential-based MFA, allowing them to gain persistent access to a user account once the target authorizes the code.
This rule detects potential API abuse by identifying high-frequency API calls using the 'python-requests' user agent that occur within a short time window (120 seconds) immediately following a successful device code authentication event. This behavior is indicative of automated token theft or session hijacking where an adversary attempts to perform unauthorized actions quickly using tokens obtained via device code phishing.
This rule detects potential scanning activity by identifying high-frequency network connection attempts from a source to multiple distinct internal targets within a short 2-minute time window, specifically targeting suspicious ports (9191, 9192) or a known malicious IP address (45.142.193.132).
Detects outbound network connections to known command-and-control (C2) infrastructure associated with SpiceRAT, including specific malicious IP addresses and domain names used for decoy content delivery.
This rule detects outbound network connections from internal devices to a list of known malicious IP addresses associated with adversary command and control infrastructure. The rule specifically monitors connections over common ports, potentially indicating established communication with malicious servers.
This rule monitors endpoint telemetry for known indicators of compromise associated with the Casbaneiro/Ousaban banking trojan. It identifies activity across network connections (IPs and domain patterns), DNS queries for specific C2 domains, and the presence or execution of known malicious file hashes (e.g., PDF lures, HTA, AutoIt scripts, and payload binaries).
This rule detects potential command and control (C2) activity associated with the Koktevrat malware, specifically looking for WebSocket handshake requests (HTTP GET with 'Upgrade' header) to domain names that follow a generated pattern (8-27 alphanumeric characters ending in .icu or .cfd).
Detects activity associated with the 'BlueKit' session relay tool, which uses the rrweb library to capture and replay user session interactions. This rule identifies web browser network events involving rrweb-related scripts occurring within 10 minutes of a successful user sign-in, indicating a potential Adversary-in-the-Middle (AiTM) phishing attack where credentials and session cookies are being captured.
Detects activity associated with the 'BlueKit' session relay tool, which uses the rrweb library to capture and replay user session interactions. This rule identifies web browser network events involving rrweb-related scripts occurring within 10 minutes of a successful user sign-in, indicating a potential Adversary-in-the-Middle (AiTM) phishing attack where credentials and session cookies are being captured.
This rule monitors DeviceNetworkEvents for any outbound network connections to a specific list of known malicious domains. The rule identifies potential command and control (C2) communication by matching remote URLs against a hardcoded set of domains associated with known threats.
Page 52 of 246