Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,156 detections
Filters
Last updated
All Time
Detection languages
2,302
1,070
640
289
288
Contributors
918
814
769
696
224
Categories
20,456
11,839
5,877
5,156
4,865
Platforms
2,859
2,017
816
524
213
Products / Services
1,337
1,144
831
576
366
MITRE Techniques
1,823
1,307
787
747
577
CVEs
9
7
7
6
6
IDS Classtypes
538
151
101
57
48
IDS Protocols
375
373
132
64
42
Detects network activity (DNS lookups, TLS SNI, and HTTP Host headers) associated with proxy infrastructure (iproyal.com and lightningproxies.net) known to be used by the HEAVYGRAM/CHOSEN BRICK threat actors to mask Telegram-based command and control traffic.
Detects network activity (DNS lookups, TLS SNI, and HTTP Host headers) associated with proxy infrastructure (iproyal.com and lightningproxies.net) known to be used by the HEAVYGRAM/CHOSEN BRICK threat actors to mask Telegram-based command and control traffic.
Detects network traffic (TLS SNI or HTTP Host) to Firebase domains (firebaseio.com, firebaseapp.com, firebasedatabase.app) associated with Mantax Otax and other Android ransomware families for ransom negotiation chat channels.
This rule monitors network traffic logs for HTTP requests directed toward domains identified as potentially malicious (gstatcs.com, webfaset.com, bulder.online). It further filters for events involving common web activity patterns, such as Google Tag Manager references or general HTTP/web traffic, which may indicate command and control communication or beaconing behavior.
This rule monitors network traffic logs for HTTP requests directed toward domains identified as potentially malicious (gstatcs.com, webfaset.com, bulder.online). It further filters for events involving common web activity patterns, such as Google Tag Manager references or general HTTP/web traffic, which may indicate command and control communication or beaconing behavior.
This rule monitors DNS and email traffic for domains ending in .shop that fuzzy-match against a predefined watchlist of corporate brand names. This behavior is commonly associated with phishing campaigns, brand impersonation, or typosquatting, where attackers use similar-looking domains to lure users into revealing sensitive information or credentials.
This rule monitors DNS and email traffic for domains ending in .shop that fuzzy-match against a predefined watchlist of corporate brand names. This behavior is commonly associated with phishing campaigns, brand impersonation, or typosquatting, where attackers use similar-looking domains to lure users into revealing sensitive information or credentials.
Detects network connections to known command and control (C2) infrastructure, including hardcoded malicious domains, specific C2 IP addresses, and suspicious GitHub access patterns by processes other than standard web browsers, which may indicate malicious ingress tool transfer or C2 communication.
Detects network communication to Firebase infrastructure (.firebaseio.com) initiated by Android devices, which may indicate command-and-control (C2) activity associated with the Mantax Otax malware family. This rule tracks initial connections and should be correlated with specific suspicious domains for higher confidence.
Detects HTTP POST requests to gapidriver.com/api/rest.php containing stager-specific status messages like 'build started', 'launch error', or 'all builds loaded', indicating NeedleStealer malware command-and-control activity.
Detects HTTP POST requests to gapidriver.com/api/rest.php containing stager-specific status messages like 'build started', 'launch error', or 'all builds loaded', indicating NeedleStealer malware command-and-control activity.
Detects network traffic between internal hosts and a known malicious IP address on port 5556, characteristic of Go_RAT (hVNC) command and control communication. This rule monitors for established TCP connections to identify potential C2 beaconing or active remote management sessions by the GapiUpdate campaign.
Detects network traffic between internal hosts and a known malicious IP address on port 5556, characteristic of Go_RAT (hVNC) command and control communication. This rule monitors for established TCP connections to identify potential C2 beaconing or active remote management sessions by the GapiUpdate campaign.
Detects network traffic between internal hosts and a known malicious IP address on port 5556, characteristic of Go_RAT (hVNC) command and control communication. This rule monitors for established TCP connections to identify potential C2 beaconing or active remote management sessions by the GapiUpdate campaign.
Detects established raw-TCP C2 communication sessions associated with the GapiUpdate Go-based RAT, identifying both known malicious infrastructure and behavioral anomalies characteristic of long-lived, encrypted C2 persistence.
Detects established raw-TCP C2 communication sessions associated with the GapiUpdate Go-based RAT, identifying both known malicious infrastructure and behavioral anomalies characteristic of long-lived, encrypted C2 persistence.
Detects network activity associated with Rust-based stealer malware, specifically focusing on connections to a known C2 IP address (31.76.7.137) or HTTP requests directed at static-asset paths (e.g., analytics.gif, pixel.png, content.js) when the destination is an IPv4-literal address. This behavior is indicative of C2 beacons or data exfiltration disguised as legitimate web traffic.
Detects network activity associated with Rust-based stealer malware, specifically focusing on connections to a known C2 IP address (31.76.7.137) or HTTP requests directed at static-asset paths (e.g., analytics.gif, pixel.png, content.js) when the destination is an IPv4-literal address. This behavior is indicative of C2 beacons or data exfiltration disguised as legitimate web traffic.
Detects successful network connections to a known hVNC RAT (GapiUpdate) C2 infrastructure IP address on port 5556, based on DeviceNetworkEvents logs.
Detects successful network connections to a known hVNC RAT (GapiUpdate) C2 infrastructure IP address on port 5556, based on DeviceNetworkEvents logs.
Detects repeated manual HTTP GET requests from many distinct source IPs to a canary token resource. The URI pattern follows a format indicative of a tracked canary token resource, and the threshold of 49 unique source IPs accessing the resource within a prolonged period suggests potential unauthorized reconnaissance or probing activities.
Page 70 of 246