Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,879 detections
Filters
Last updated
All Time
Detection languages
2,954
1,378
313
289
239
Contributors
1,807
1,529
1,304
180
173
Categories
20,460
11,847
5,879
5,158
4,866
Platforms
3,747
1,857
1,076
782
160
Products / Services
2,241
1,434
1,273
746
582
MITRE Techniques
2,448
2,151
1,129
937
790
CVEs
19
15
9
7
5
IDS Classtypes
834
334
94
23
20
IDS Protocols
689
276
235
117
23
Detects HTTP downloads from GitHub involving specific repositories and archive naming patterns commonly associated with the 'NightEagle GhostContainer' threat activity. These patterns involve downloading ZIP files disguised as development or resource packages (e.g., 'mirror-js', 'browserthemes', 'resource-pack').
Detects the use of command-line tools like curl, wget, PowerShell, or Python to perform DNS over HTTPS (DoH) queries, identified by specific command-line arguments and connections to known public DoH resolvers. This behavior can be indicative of attempts to bypass local DNS monitoring or security controls.
Detects the modification or creation of scheduled tasks using OOBETaskScheduler or referencing Windows Servicing paths, combined with network connections to known malicious domains identified in threat intelligence.
Detects DNS queries and TLS SNI traffic directed towards known phishing domains that mimic Brazilian financial and government portals, specifically targeting 'gerenciadorcaixa.digital', 'aapj.digital', and 'receitafederal.digital'.
Detects the download of ZIP files with filenames matching known phishing patterns associated with NFe (Nota Fiscal Eletrônica) campaigns, correlated with access to specific malicious or suspicious download URLs within a 15-minute window.
Detects the download of ZIP files with filenames matching known phishing patterns associated with NFe (Nota Fiscal Eletrônica) campaigns, correlated with access to specific malicious or suspicious download URLs within a 15-minute window.
Detects outbound HTTP requests from the internal network to the domain 'adminmenueditor.com'. This domain has been associated with a compromised software supply chain attack targeting the Admin Menu Editor Pro WordPress plugin, which was used to distribute malicious code to users.
Detects DNS queries and TLS SNI traffic related to known malicious domains used by threat actor groups Storm-3121 and Storm-3032 in passkey-themed phishing campaigns.
Detects anomalous network traffic patterns where internal assets interact with Microsoft Graph API and Entra ID (login.microsoftonline.com) authentication endpoints from distinct external destination IPs within a short time window. This behavior is indicative of potential attacker infrastructure rotation during C2 or post-authentication phases.
Detects outbound network traffic from internal hosts to the Microsoft Graph API (graph.microsoft.com) originating from Python HTTP clients (requests or urllib libraries). This pattern can indicate automated data exfiltration from an internal environment to a cloud-based service, or the use of Microsoft Graph API for command and control purposes.
This rule detects network traffic directed at a potentially compromised server associated with the Admin Menu Editor Pro plugin, specifically looking for HTTP requests that indicate an attempt to download a malicious update.
Detects DNS resolutions, TLS SNI, and HTTP host requests to known malicious phishing domains impersonating passkey and SSO infrastructure, often associated with Storm-3121/Storm-3032 activities.
Detects TCP connections on standard web ports from internal hosts to known IronToll C2 IPs on Tencent/Alibaba Cloud. Scoped to web ports and an established handshake, with a per-source hourly alert cap to reduce repeat noise.
Detects TCP connections on standard web ports from internal hosts to known IronToll C2 IPs on Tencent/Alibaba Cloud. Scoped to web ports and an established handshake, with a per-source hourly alert cap to reduce repeat noise.
Detects emails delivering links to IronToll government-impersonation traffic-fine/payment portals (Egyptian and Moroccan justice-ministry lures), correlated with Safe Links click-through telemetry for the same URLs.
Detects emails delivering links to IronToll government-impersonation traffic-fine/payment portals (Egyptian and Moroccan justice-ministry lures), correlated with Safe Links click-through telemetry for the same URLs.
Detects sensitive data exfiltration attempts (PII, credit card, OTP) via HTTP POST requests to suspicious lookalike domains, followed by a WebSocket connection to known IronToll C2 infrastructure.
Detects the creation of files in the /tmp/ directory by common command-line tools (curl, wget, sh, bash), followed shortly by a successful external network connection by the same process from the same device, excluding known benign domains.
Detects Rust-compiled executables exhibiting C2-capable characteristics consistent with backdoors dropped on compromised JFrog Artifactory servers
Detects Rust-compiled executables exhibiting C2-capable characteristics consistent with backdoors dropped on compromised JFrog Artifactory servers
Detects Rust-compiled executables exhibiting C2-capable characteristics consistent with backdoors dropped on compromised JFrog Artifactory servers
Page 135 of 280