Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,879 detections
Filters
Last updated
All Time
Detection languages
2,954
1,378
313
289
239
Contributors
1,807
1,529
1,304
180
173
Categories
20,460
11,847
5,879
5,158
4,866
Platforms
3,747
1,857
1,076
782
160
Products / Services
2,241
1,434
1,273
746
582
MITRE Techniques
2,448
2,151
1,129
937
790
CVEs
19
15
9
7
5
IDS Classtypes
834
334
94
23
20
IDS Protocols
689
276
235
117
23
Detects behavior indicative of the 'Adblock for YouTube' browser extension (or associated malicious variants) fetching rule configuration files from 'api.adblock-for-youtube.com', followed by suspicious outbound network traffic to non-Google/YouTube domains. This pattern suggests the extension is performing unauthorized data exfiltration, such as harvesting session cookies or credentials via injected scripts.
Identifies outbound traffic to specific task dispatch endpoints.
Outbound network connections from a sideloaded process context to Alibaba Cloud IPs.
Detects DNS requests originating from endpoints targeting the 'adblock-for-youtube.com' domain. This activity may be associated with browser extensions that exhibit unexpected or potentially unwanted network behavior.
Detects credential and session data exfiltration by browsers communicating with Bluekit PhaaS-associated domains or Telegram API webhooks. The rule filters network traffic originating from common web browsers to known malicious domains associated with Bluekit infrastructure or to the public Telegram API for automated exfiltration.
Detects network connections from the 'Adblock for YouTube' browser extension to its remote API endpoint (api.adblock-for-youtube.com). These connections are associated with fetching 'scripletsRules', a post-installation mechanism used to deliver dynamic payloads and potentially bypass extension security reviews.
Detects network connections from browser processes (Chrome, Edge, Brave) to 'api.adblock-for-youtube.com'. This activity is linked to the retrieval of remote configuration scripts that can deliver malicious payloads, enabling arbitrary JavaScript execution within the context of visited web pages without requiring an official browser store update.
Detects network connections to known C2, VPS, VPN, and Starlink IP addresses and ranges used by the Handala group (Void Manticore) for their operations.
Detects outbound web requests to domains associated with 'Adblock for YouTube', which has been identified as malicious browser extension behavior involving fetching script rules or lifecycle signals, potentially indicative of unauthorized data collection or C2-like behavior.
This rule detects network activity associated with known malicious browser extensions identified as 'AdBlock' variants. It monitors for connections to the domain 'api.adblock-for-youtube.com' or requests to '/api/v2/rules' made by specific extension IDs that are known to perform unauthorized or suspicious activities.
Detects explorer.exe making DNS requests to Discord or Telegram, which is anomalous and indicates potential process injection for data exfiltration. This behavior is associated with information stealer malware like Phantom Stealer.
Detects the installation of known-malicious browser extensions followed by network communication from the browser process to associated Command and Control (C2) domains within a one-hour window. This behavior is indicative of malicious browser-based activity such as ad-fraud or credential theft.
Detects browser processes exhibiting a pattern consistent with 'Browser-in-the-Middle' attacks, specifically the streaming of DOM content (e.g., using rrweb) over persistent WebSocket connections to external IP addresses. The rule identifies high-density connection events to the same remote IP on port 443 lasting for more than 120 seconds and correlates these events with a preceding phishing email click on the same device.
This rule monitors network device telemetry for three distinct indicators of compromise: usage of specific botnet-associated User-Agent strings, high-volume automated scanning against known IoT-vulnerable ports (80, 8080, 7547, 52869, 37215), and outbound network connections to known RondoDox command and control server infrastructure.
This rule detects suspicious network connections, process activity, and file events related to Node.js or systemd-userdbd, potentially indicating C2 communication or the presence of malicious tools. Specifically, it looks for outbound TCP connections to port 4444, process command lines containing shell commands or 'node-pty', and file paths/names associated with 'apintergrationpost' or 'node-pty'.
Detects the infostealer communicating with raw.githubusercontent.com to pull secondary modules or exfiltrate small data fragments via URL params, specifically when initiated by 'python.exe'.
Identifies Havoc Demon payloads beaconing to anomalous, predictable HTTP/HTTPS URIs used by default Havoc profiles (e.g., /weather, /api/v1). The detection specifically looks for HTTP connections originating from processes located in the 'Downloads' folder.
Detects Notepad.exe initiating outbound network connections, specifically over SMB (port 445) or to public IP addresses over HTTP/S. This behavior is highly anomalous and can indicate an attempt to exploit a vulnerability (e.g., CVE-2026-20841) to trigger an NTLM relay attack for credential harvesting or to download a remote payload.
Detects instances where the Squid proxy application is used to establish network connections over ports 21 (FTP) or 22 (SSH) to specific external IP ranges. This behavior may indicate an attacker using the internal proxy server to anonymize command-and-control (C2) traffic or perform unauthorized external reconnaissance.
Detects processes containing sensitive credential-related keywords (cookies, creds, password, token) in their command lines followed by a network connection to known suspicious remote IP addresses within a 60-minute window, suggesting potential credential exfiltration.
Detects a potential multi-stage attack sequence where a file (archive or browser-related) is executed, followed by a script interpreter (wscript/cscript), and finally followed by a remote connection to common remote access ports (RDP, FTP, SMB, SSH). The rule correlates these events within a specific timeframe per device to identify likely lateral movement or remote command and control initialization.
Page 234 of 280