Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,158 detections
Filters
Last updated
All Time
Detection languages
2,304
1,070
640
289
288
Contributors
918
814
769
696
224
Categories
20,460
11,847
5,879
5,158
4,866
Platforms
2,861
2,017
816
524
213
Products / Services
1,339
1,144
831
576
366
MITRE Techniques
1,825
1,307
787
747
577
CVEs
9
7
7
6
6
IDS Classtypes
538
151
101
57
48
IDS Protocols
375
373
132
64
42
Detects the clipboard_start/clipboard_stop/clipboard_data C2 command schema used by ChonkyChicken for clipboard monitoring.
Detects HTTP traffic patterns characteristic of suo5 and Neo-reGeorg web shell tunnels. These tools facilitate bidirectional communication through JSP endpoints (e.g., /jmx/suo5.jsp, /common/themes/top_css.jsp) by utilizing hardcoded proxy identifiers in HTTP headers. This behavior is indicative of a compromised web server acting as a pivot point for command-and-control operations.
Detects a non-browser process establishing a loopback connection to a Chrome or Edge remote-debugging (CDP) endpoint. Malicious processes may abuse the Chrome DevTools Protocol to drive a headless browser, allowing the attacker to perform browser-based actions or use the browser as a covert C2 channel. This rule monitors for HTTP requests to /json/list/ or /devtools/ on 127.0.0.1 originating from processes other than chrome.exe or msedge.exe.
Detects HTTP POST requests to the Microsoft login endpoint for OAuth2 tokens using the client_credentials grant type, where the request body contains evidence of hardcoded client_secret parameters and specific scopes. This behavior often indicates an application or script with embedded, potentially leaked or insecurely stored, credentials being used to authenticate against Microsoft cloud services.
Detects the combined msaRAT CDP C2 sequence within a single event - Page.setBypassCSP disabling Content Security Policy, all five Runtime.addBinding callback registrations (msaOpen, msaClose, msaError, msaMessage, dataAck), and a Runtime.evaluate call injecting JavaScript that establishes an RTCPeerConnection. All three behaviors must be present together, reducing false positives from unrelated CDP activity.
Detects HTTP GET requests to a known malicious endpoint attempting to download a file named 'update_ms.msi', associated with the Chaos msaRAT trojan.
Detects the combined msaRAT CDP C2 sequence within a single event - Page.setBypassCSP disabling Content Security Policy, all five Runtime.addBinding callback registrations (msaOpen, msaClose, msaError, msaMessage, dataAck), and a Runtime.evaluate call injecting JavaScript that establishes an RTCPeerConnection. All three behaviors must be present together, reducing false positives from unrelated CDP activity.
Detects a multi-stage network activity pattern characteristic of 'SourTrade' cloaking. The rule tracks an initial HTTP request with a referral to a known lookalike crypto/trading domain, followed by the fetching of a client-side JavaScript fingerprinting script, and finally, a subsequent HTTP response that appears to be a near-empty decoy page (used to mask malicious content from crawlers).
This rule detects the initial WebSocket handshake request used by the INTERLOCK NodeSnake RAT for beaconing. It looks for a GET request containing a 'Sec-WebSocket-Key' header and a specific URI pattern (?v=n;) common to the RAT's communication profile.
Detects an HTTP GET request to the Microsoft Graph API (/v1.0/users/*/calendarView) containing a specific hardcoded far-future date (2050-05-13) in the startDateTime parameter. This pattern is indicative of a command-and-control (C2) mechanism leveraging a legitimate cloud service to maintain persistent communication channels.
This rule detects UDP traffic patterns characteristic of the msaRAT C2 handshake. It specifically identifies initial WebRTC DataChannel connection frames containing the 0xFE marker combined with ChaCha-Poly1305 encryption indicators within the expected packet size range.
This rule detects potential Adversary-in-the-Middle (AiTM) phishing attacks targeting Microsoft 365. It monitors for suspicious network connections to known Evilginx-style subdomains (e.g., owa, sso, secure, billing) that proxy traffic to login.microsoftonline.com, followed immediately by a successful user login event on the same host. This pattern indicates an active session hijacking attempt designed to capture session cookies like ESTSAUTH and ESTSAUTHPERSISTENT.
Detects network-based enumeration of Active Directory components, including user accounts, computer objects, group memberships, session information, and domain trust relationships. This pattern is characteristic of automated discovery tools used during the reconnaissance phase of an attack.
Detects ChonkyChicken's monitor_list enumeration chained with a screen_start command in the same C2 session.
Detects specific WebSocket JSON-formatted C2 agent registration and profiling traffic associated with the TAG-195/TinyEgg campaign. The rules look for specific registration markers (agent_register, request_register) and host profiling data (hostname, username, OS, domain, isAdmin status) characteristic of this threat actor's C2 communication.
This rule detects network traffic patterns characteristic of the 'ChonkyChicken' malware using a 'proxy_request' method within a JSON payload, suggesting the initiation of command-and-control (C2) communication or traffic relaying through the infected host.
Detection of network communications associated with the TAG-195 campaign, specifically targeting the 'ClickFix' social engineering lure. The rules identify TLS SNI, DNS queries, and HTTP requests involving known C2/staging domains 'screenly.cam' and 'xtrafftrck.net', as well as specific payload retrieval patterns for OCX files and 'curl' usage involving the infrastructure IP 70.34.205.43.
Detects silent browser-side cryptocurrency wallet fingerprinting via EIP-6963 discovery, window.ethereum probing, and wallet-extension enumeration (e.g. MetaMask, Solana) occurring together, excluding known legitimate dApp/wallet-connect domains, consistent with BlueNoroff's pre-payload wallet profiling.
Detects network traffic indicating msaRAT behavior where a host initiates a STUN/TURN token request to a Cloudflare Workers (.workers.dev) domain. The rule identifies suspicious characteristics including spoofed Microsoft-related Origin or Referer headers and a HeadlessChrome User-Agent, commonly used by automated C2 communication.
A non-browser process pivoting through the browser's CDP loopback debug port, so the RAT's own traffic never leaves 127.0.0.1. Tightened to exclude known developer tooling and browser automation frameworks (VS Code debugger, Chrome DevTools frontend, Selenium/Puppeteer/Playwright drivers) that legitimately attach to the local CDP debug port.
Detects the remote_logon C2 command token correlated with an absence of a matching auth event, indicating passive logon-session enumeration.
Page 84 of 246