Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
452 detections
Filters
Last updated
All Time
Detection languages
251
100
69
13
8
Contributors
113
74
46
46
44
Categories
20,440
11,814
5,871
5,145
4,864
Platforms
302
94
46
43
29
Products / Services
317
231
88
54
28
MITRE Techniques
171
167
100
60
59
CVEs
4
3
2
2
2
IDS Classtypes
5
3
3
1
1
IDS Protocols
7
6
Detects downloads of the Huorong themed archive name reported in a ValleyRAT delivery chain.
This rule detects various indicators associated with the Booking.com phishing campaign targeting hotels and customers. It identifies suspicious web requests to non-Booking.com domains containing 'op_token' and 'complaint' or 'reservation' keywords, especially when combined with punycode, 'booklng' typos, or management-related subdomains. It also looks for partner kit patterns involving 'sign-in/?tpo_token=' and 'booklng' in URLs. Additionally, it identifies suspicious emails from newly generated Gmail accounts with specific subjects ('Automatic reply', 'Availability', 'Reservation') containing 'op_token' in the subject or body.
Detects Booking.com partner phishing lures described by Bridewell by identifying complaint/reserv URLs with op_token hosted on punycode or lookalike domains, plus the booklng sign-in tpo_token pattern.
Detects access to Huorong typosquat and intermediary redirector domains reported by Malwarebytes as part of a ValleyRAT distribution campaign.
Detects outgoing network connections using the User-Agent 'ArkanixStealer/1.0', which is hardcoded in the C++ variant of the Arkanix Stealer.
This rule detects OysterLoader C2 communication based on specific HTTP User-Agent strings and URI paths. It looks for 'WordPressAgent' or 'FingerPrint' in the User-Agent field combined with URIs like '/reg', '/login', '/api/kcehc', '/api/v2/init', '/api/v2/facade', or '/api/jgfnsfnuefcnegfnehjbfncejfh'. This activity is indicative of OysterLoader's multi-stage evasion techniques as described in a Sekoia report.
Detects a potential attempt to downgrade a password manager client's encryption to a legacy, non-authenticated mode (e.g., AES-CBC). A malicious or compromised server can send a specially crafted response during login or synchronization that forces the client to use weaker cryptography. This can compromise the integrity and confidentiality of the user's vault, enabling further attacks like vault modification or padding oracles.
This query hunts for network activity and other events related to specific domains (freefoodaid.com, wellnessmedcare.org) potentially associated with CVE-2026-21509. It searches DNS queries, network connections, generic web proxy/firewall logs, and URL click events to identify interactions with these domains.
This is for when we need to investigate user navigation through proxy logs to understand if visit was intentional or if it was a sideload (redirect/iframe/malvertising) causing the navigation.
Detects HTTP POST requests containing a JSON-RPC payload with the 'eth_call' method. This is often used by web-based crypto wallets or dApps to interact with the Ethereum blockchain, but can also be used by malicious JavaScript for activities like cryptojacking or wallet draining.
Detects network traffic to known Tier One Command and Control (C2) domains used by IPIDEA-affiliated SDKs (PacketSDK, CastarSDK, EarnSDK, HexSDK) for device enrollment and tasking.
Detects network traffic to fallback command and control (C2) domains generated by the 'Children Protection' malicious browser extension. The extension uses a Domain Generation Algorithm (DGA) based on the current date to provide resilient C2 infrastructure.
Detects network connections to the GitHub API attempting to fetch a 'command.txt' file. This behavior is characteristic of the GITSHELLPAD backdoor, which uses private GitHub repositories for command and control (C2) communication as seen in the Gopher Strike campaign.
Detects network connections to known infrastructure associated with the EncystPHP web shell campaign. This IP (45.234.176.202) was observed distributing the 'c' and 'k.php' droppers.
Detects C2 network traffic associated with PylangGhost and GolangGhost, RATs used by the PurpleBravo group. The malware sends an RC4-encrypted payload via an HTTP POST request to known C2 servers.
Detects C2 network traffic associated with the InvisibleFerret RAT, used by the PurpleBravo group. This malware uses a plaintext HTTP channel for beaconing, data exfiltration, and payload delivery to specific URI endpoints.
Detects the download of the Amnesia RAT payload from a specific Dropbox URL observed in a multi-stage malware campaign.
Detects the injection of a malicious iframe with attributes that impersonate the legitimate Stripe payment interface. This technique is used by Magecart actors to steal credit card data by replacing the real payment form with a clone.
Detects outbound network traffic with a User-Agent header indicating the use of the Rust 'reqwest' HTTP client library. This User-Agent is used by the RustyWater implant, associated with the MuddyWater APT group, for command and control (C2) communications.
Detects a URL containing common redirection or proxy parameters where the value appears to be a ROT13 obfuscated URL, indicated by the presence of 'uggcf' ('https') and common ROT13'd TLDs. This is an evolution of a TTP observed in Kimsuky campaigns.
Detects a distinctive User-Agent string used by the initial RedLoader DLL for command and control (C2) communications. This activity is associated with the GOLD BLADE threat group (also known as RedCurl).
Page 17 of 22