Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,879 detections
Filters
Last updated
All Time
Detection languages
2,954
1,378
313
289
239
Contributors
1,807
1,529
1,304
180
173
Categories
20,460
11,847
5,879
5,158
4,866
Platforms
3,747
1,857
1,076
782
160
Products / Services
2,241
1,434
1,273
746
582
MITRE Techniques
2,448
2,151
1,129
937
790
CVEs
19
15
9
7
5
IDS Classtypes
834
334
94
23
20
IDS Protocols
689
276
235
117
23
This rule detects potential phishing attempts by identifying emails that contain links to legitimate Microsoft Forms (forms.office.com) with lures commonly associated with document-related phishing (e.g., 'shared a document', 'invoice'). The rule then correlates this with user click activity to identify instances where the user was redirected from the Microsoft Forms site to an external, potentially malicious URL.
Detects endpoint activity indicative of the TELEPUZ malware interacting with the Telegram API to resolve its fallback Command and Control (C2) server. The rule monitors for DNS queries, network connections, and security log entries related to the specific channel 'chanadarkpart' and common Telegram API endpoints used for retrieving message data or user profiles.
This rule detects email activity where a user receives an email containing a link to 'tilda.ws' (often used for landing pages) with social engineering themes like invoices or document signing, and subsequently clicks the link to be redirected to a different destination. This pattern is indicative of a credential phishing or malicious landing page campaign.
Detects a single host rapidly initiating outbound Telnet (port 23) or SSH (port 22) connection attempts against a large number of distinct remote IP addresses in a short window. This behavior is indicative of bot-agent scanners, such as those associated with IoT botnets, attempting to propagate by performing brute-force login attempts using default credential pairs.
Detects various stages of the Armored Likho APT campaign using the BusySnake stealer, including lure archive delivery, NSIS droppers, LNK shortcut abuse, PowerShell-based staging, VBScript persistence, scheduled task creation, reverse SSH tunneling, and exfiltration of browser and communication artifacts.
Anomalously large outbound transfers over the WebRTC DataChannel from a Chrome/Edge process launched with --headless and --remote-debugging-port flags (no visible window), indicating exfiltration rather than routine interactive or automation-only browser use.
Detects outbound network connections to hard-coded IP addresses associated with GigaWiper malware C2 infrastructure on specific ports, which may indicate active backdoor communication.
Detects outbound network connections to hard-coded IP addresses associated with GigaWiper malware C2 infrastructure on specific ports, which may indicate active backdoor communication.
Detects outbound HTTP POST requests containing JSON-RPC 'eth_call' methods, which are indicative of EtherHiding activity where blockchain infrastructure is abused for command and control or data retrieval.
Detects outbound network connections to hard-coded IP addresses associated with GigaWiper malware C2 infrastructure on specific ports, which may indicate active backdoor communication.
Detects HTTP requests to known Cloudflare Turnstile challenge endpoints or challenge platform scripts which are commonly abused by phishing kits (e.g., Kratos) to act as an anti-sandbox or anti-scanner gate before delivering malicious content.
Detects network traffic originating from the internal network directed towards a specific IP range associated with known PureRAT command and control infrastructure.
Detects outbound network connections to identified infrastructure associated with 'Pink' (CL-CRI-1147) passkey-enrollment vishing campaigns. These operators use phone-based social engineering to direct victims to phishing domains that relay credentials and MFA tokens in real-time to register attacker-controlled passkeys. The rule monitors for specific DNS query patterns containing passkey-related keywords and known malicious IP addresses used by the threat group.
Detects outbound HTTP POST requests destined for 'webhook.site' containing the string 'secret' in the request body. This is a common pattern used by attackers to exfiltrate small amounts of sensitive data or credentials to a public web service for collection.
Detects Node.js processes executing with command-line arguments containing potential GitHub personal access tokens (PAT) or secrets while simultaneously initiating a network connection to the GitHub API. This behavior is indicative of potential credential abuse or automated exfiltration of sensitive tokens.
Detects outbound HTTP POST requests containing the word 'secret' in the request body directed to the external service 'webhook.site', which is often used by adversaries for quick data exfiltration or testing during post-exploitation activities.
Detects outbound network traffic established to an *.ngrok.io domain, which is frequently used by adversaries to create secure tunnels for command and control (C2) or unauthorized data exfiltration.
Detects periodic, repetitive TLS network connections from internal hosts to external destinations using threshold-based analysis. This pattern is indicative of potential command-and-control (C2) beaconing, which may be used for exfiltrating stolen credentials or sensitive data from build or developer environments.
This rule detects network traffic originating from the internal network directed towards a hardcoded IP address associated with the CrashStealer malware. The rule flags outbound traffic to this specific destination, which is indicative of command and control communication or data exfiltration.
Detects outbound POST requests using the grpc-web+proto content type where the X-Request-Id header contains a base64-encoded JSON blob. This pattern is associated with exfiltrating sensitive data, such as mnemonic phrases or private keys, to a malicious endpoint masquerading as an Injective testnet gRPC-web node.
Detects DNS queries targeted towards specific '2miners.com' solo mining pool subdomains (e.g., solo-zeph.2miners.com, solo-rvn.2miners.com). Such activity is often associated with unauthorized cryptocurrency mining (cryptojacking) performed on compromised systems.
Page 166 of 280