Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,879 detections
Filters
Last updated
All Time
Detection languages
2,954
1,378
313
289
239
Contributors
1,807
1,529
1,304
180
173
Categories
20,460
11,847
5,879
5,158
4,866
Platforms
3,747
1,857
1,076
782
160
Products / Services
2,241
1,434
1,273
746
582
MITRE Techniques
2,448
2,151
1,129
937
790
CVEs
19
15
9
7
5
IDS Classtypes
834
334
94
23
20
IDS Protocols
689
276
235
117
23
Detects activity associated with the MALFEX npm supply-chain campaign (also known as Overlord/movinlike). This rule performs a sweep for known malicious file hashes, suspicious process command lines, outbound network connections to malicious domains or IPs, and email communications from identified adversary-controlled accounts.
This rule identifies potential infections associated with the MacSync malware family by matching process, file, and network indicators (hashes, malicious domains, and specific payload URLs) against endpoint telemetry. It monitors for execution of known malicious binaries, file creation events, and communication with identified command-and-control infrastructure.
Detects high-frequency, sequential outbound GET requests to short URL patterns, potentially indicating a sandbox escape attempt or automated command-and-control activity where shortened links are used to download multi-stage payloads.
Detects high-frequency requests to Hugging Face dataset repository commit and discussion endpoints, which may indicate the use of the platform as a dead drop resolver or for C2 polling.
This rule detects repeated access to the RubyGems legacy API key endpoint within a short timeframe from a single source. This behavior is indicative of automated credential harvesting, where an adversary attempts to brute force or cycle through various API keys to gain unauthorized access to RubyGems accounts.
Detects outbound HTTP POST requests containing an aggregated 'LOOT' variable in the body. The rule looks for markers indicating the exfiltration of Kubernetes-related credentials, such as service account tokens, bearer tokens, or configuration secrets, as well as common environment variable dumps like API keys.
Detects anomalous POST requests to the RubyGems API endpoint '/api/v1/gems' that include an 'Authorization' header and a 'Content-Type' of 'application/octet-stream'. This pattern suggests the automated upload of binary files, potentially indicating exfiltration of data disguised as Ruby gems.
Detects an abnormally high volume of POST requests to the RubyGems API endpoint used for publishing packages. A sudden burst of these requests from a single source may indicate a mass upload campaign, commonly associated with software supply chain poisoning attempts.
This rule detects network activity associated with the GemStuffer malware, specifically monitoring for DNS queries to known OAST callback domains, HTTP requests to specific C2 paths, and unauthorized data exfiltration attempts to the webhook.site service.
Detects HTTP traffic attempting to download specific known malicious RubyGems packages from rubygems.org associated with the GemStuffer campaign. This indicates a supply chain compromise attempt where attackers distribute malicious code via public package repositories.
Detects a multi-stage communication pattern involving an initial request to a URL-mirroring or shortening service with a long base64-encoded path, followed by a request to a screenshot/rendering API, and culminating in the reception of an image file. This chain is indicative of command and control (C2) communication where command output or exfiltrated data is encoded into images rendered by external web services to bypass traditional network security filters.
Detects instances of mshta.exe initiating network connections to cloud storage providers (CloudFront, Cloudflare R2/pages) to retrieve multiple remote files (specifically .js or .txt). This behavior is indicative of an exploit stage where mshta.exe is used as a LOLBAS to fetch orchestrator scripts and gadget payloads for memory-based deserialization attacks.
Detects mshta.exe, wscript.exe, or cscript.exe initiating network connections to common CDN infrastructure (Cloudflare R2, CloudFront, pages.dev) to retrieve scripts (js, txt, log). This behavior is indicative of a staging phase in a malicious orchestration, often associated with subsequent deserialization attacks and DLL sideloading.
Detects outbound network traffic to domains and infrastructure known to be associated with the UAT-11587 Antino delivery chain. This includes specific Cloudflare Pages/R2 project URLs and CloudFront staging infrastructure often used for malicious payload hosting or staging.
Detects outbound network communication to known malicious hosting infrastructure used for the distribution of Antino Stage 2 payloads, specifically targeting CloudFront and Cloudflare R2 object storage locations.
Detects network activity associated with the 'ClickFix' social engineering campaign, which commonly targets users with fake error messages to trick them into executing malicious commands. The rule identifies communication with known malicious infrastructure (domains and IP addresses) found in CommonSecurityLog events, while implementing filters to exclude common security scanners and deduplicating per-host alerts.
Detects network requests to specific GitHub, Blogspot, and Telegram endpoints, which are known to be used by the 'VPN-for-X' extension to fetch proxy configuration files. This behavior is indicative of C2 channel configuration retrieval.
Detects network traffic attempting to connect to known proxy farm fallback hostnames using TLS SNI or HTTP CONNECT methods. These hostnames are often associated with command-and-control infrastructure designed to proxy traffic and mask the true destination of communications.
This rule performs indicator-based detection for the SectopRAT malware. It monitors network activity for connections to known command-and-control (C2) IP addresses and backup domains, as well as file and process creation events matching known malicious SHA256 hashes associated with the malware.
Detects outbound network connections to known SectopRAT C2 infrastructure, specifically targeting the hardcoded IP 98.142.252.140 or the non-standard port 15847 often used for encrypted exfiltration.
Detects HTTP GET requests for the path '/wmglb', which is indicative of a SectopRAT stage-two module download (specifically WbElevation.dll) from a Command and Control server.
Page 30 of 280