Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,156 detections
Filters
Last updated
All Time
Detection languages
2,302
1,070
640
289
288
Contributors
918
814
769
696
224
Categories
20,456
11,839
5,877
5,156
4,865
Platforms
2,859
2,017
816
524
213
Products / Services
1,337
1,144
831
576
366
MITRE Techniques
1,823
1,307
787
747
577
CVEs
9
7
7
6
6
IDS Classtypes
538
151
101
57
48
IDS Protocols
375
373
132
64
42
Detects network connections to command-and-control infrastructure associated with the JeetBot/Twitch Enhanced Viewer malicious browser extension. The rule triggers on connections to known malicious domains or IPs, as well as specific API endpoints on ambiguous domains that are used for exfiltrating Twitch OAuth tokens.
Detects network connections to command-and-control infrastructure associated with the JeetBot/Twitch Enhanced Viewer malicious browser extension. The rule triggers on connections to known malicious domains or IPs, as well as specific API endpoints on ambiguous domains that are used for exfiltrating Twitch OAuth tokens.
Detects network connections to command-and-control infrastructure associated with the JeetBot/Twitch Enhanced Viewer malicious browser extension. The rule triggers on connections to known malicious domains or IPs, as well as specific API endpoints on ambiguous domains that are used for exfiltrating Twitch OAuth tokens.
Detects network connections to command-and-control infrastructure associated with the JeetBot/Twitch Enhanced Viewer malicious browser extension. The rule triggers on connections to known malicious domains or IPs, as well as specific API endpoints on ambiguous domains that are used for exfiltrating Twitch OAuth tokens.
Detects network connections to JeetBot/Twitch Enhanced Viewer malicious browser extension infrastructure exfiltrating Twitch OAuth tokens. Apex domains (jeetbot.cc, api.jeetbot.cc) are gated on a token-forwarding indicator to avoid false positives.
Detects successful network connections to a known hVNC RAT (GapiUpdate) C2 infrastructure IP address on port 5556, based on DeviceNetworkEvents logs.
This rule detects network traffic where the TLS Server Name Indication (SNI) field claims to be 'gemini.google.com', but the traffic is being directed to a non-Google destination. This is often indicative of an Adversary-in-the-Middle (AiTM) attempt to intercept or redirect traffic intended for legitimate AI service domains.
Detects potential data exfiltration activity associated with the GRAYRABBIT threat actor, where a local file is accessed or modified by a process shortly before or after that same process initiates a network connection to a known GRAYRABBIT C2 endpoint over port 443.
Detects unauthorized access and data retrieval attempts from a MinIO object storage instance using default administration credentials (minioadmin:minioadmin). The rule monitors both command-line execution of MinIO client (mc) operations and network connections to MinIO service ports (9000/9001) that involve the use of the default credential pair.
This rule monitors for various types of events (user logons, network connections, API audits, cloud app events, and email traffic) originating from a specific CIDR block (160.79.104.0/21), which is flagged as suspicious or unauthorized.
This rule detects various event types (email, identity authentication, network connections, and cloud audit logs) originating from or interacting with the specific IP address range 160.79.104.0/22 to 160.79.111.0/22, which is associated with known malicious activity.
Detects high-frequency access to 'about' pages from a single IP address, indicative of potential reconnaissance or information gathering on an organization's public-facing infrastructure. The rule filters out common search engine crawlers and triggers only when a significant number of distinct pages are requested within a short timeframe.
Detects high-frequency access to 'about' pages from a single IP address, indicative of potential reconnaissance or information gathering on an organization's public-facing infrastructure. The rule filters out common search engine crawlers and triggers only when a significant number of distinct pages are requested within a short timeframe.
Detects anomalous, high-frequency access to LinkedIn 'about' pages, which may indicate reconnaissance activity or attempts to gather sensitive organizational information by an adversary. The rule uses threshold-based aggregation to filter out standard search engine crawlers and identify potentially malicious scanning behavior.
Detects anomalous, high-frequency access to LinkedIn 'about' pages, which may indicate reconnaissance activity or attempts to gather sensitive organizational information by an adversary. The rule uses threshold-based aggregation to filter out standard search engine crawlers and identify potentially malicious scanning behavior.
This rule monitors network connections and DNS query responses for activity associated with known suspicious domains: 'getmacouscloud.com', 'ferncore13.com', and 'grove-89.com'. It identifies communication attempts (successes, failures, or DNS lookups) between endpoints and these domains, which is indicative of potential command and control (C2) activity.
This rule monitors network connections and DNS query responses for activity associated with known suspicious domains: 'getmacouscloud.com', 'ferncore13.com', and 'grove-89.com'. It identifies communication attempts (successes, failures, or DNS lookups) between endpoints and these domains, which is indicative of potential command and control (C2) activity.
Detects Server-Side Request Forgery (SSRF) attempts originating from the Grafana MCP (Model Context Protocol) process. The rule specifically monitors for instances where the 'grafana_api_request' tool is used in conjunction with a 'X-Grafana-URL' header targeting cloud metadata IP ranges (169.254.0.0/16), or where the host attempts to resolve GCP metadata domains ('metadata.google.internal'). This behavior is indicative of an attacker attempting to access cloud provider instance metadata to exfiltrate security credentials.
HBO Max ClickFix attacks IOC Hunt
Cortex XDR
Detects network activity (DNS queries or direct IP communication) associated with 'ClickFix' social engineering attacks targeting users under the guise of an HBO Max update or repair utility. The rule includes indicators for known malicious domains and IP addresses while incorporating filters to minimize false positives from security scanners, threat intel feeds, and automated crawlers by analyzing User-Agent strings and network source addresses.
Detects network requests to the Gitea Prometheus metrics API that contain 'k=' and 'x=' query parameters, a pattern indicative of a C2 command channel disguised as legitimate telemetry traffic.
Detects network requests to the Gitea Prometheus metrics API that contain 'k=' and 'x=' query parameters, a pattern indicative of a C2 command channel disguised as legitimate telemetry traffic.
Page 62 of 246