Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
452 detections
Filters
Last updated
All Time
Detection languages
251
100
69
13
8
Contributors
113
74
46
46
44
Categories
20,440
11,814
5,871
5,145
4,864
Platforms
302
94
46
43
29
Products / Services
317
231
88
54
28
MITRE Techniques
171
167
100
60
59
CVEs
4
3
2
2
2
IDS Classtypes
5
3
3
1
1
IDS Protocols
7
6
Detects network traffic to domains associated with Intellexa front companies, such as Pulse Advertise and MorningStar TEC, which are linked to the 'Aladdin' zero-click infection vector. This vector abuses the digital advertising ecosystem to deliver Predator spyware.
Detects unique strings associated with the JSKit iOS exploitation framework in network traffic. This framework is used by multiple threat actors, including the commercial surveillance vendor Intellexa, to deliver spyware like Predator.
Detects network traffic consistent with RomCom's Mythic C2 framework. This includes connections to known C2 domains or requests for specific URI paths that return a 403 Forbidden status with an Nginx server header, a known fingerprint of this infrastructure.
Detects HTTP/HTTPS POST requests to known Lumma Stealer C2 domain
Detects queries to IP lookup services used by FlexibleFerret for victim identification.
Detects HTTP/HTTPS communication to known FlexibleFerret payload hosting domains.
Detects exploitation attempts targeting a code injection vulnerability in XWiki's SolrSearch macro (CVE-2025-24893). Attackers can inject malicious Groovy code through specially crafted requests to the SolrSearch endpoint, leading to unauthenticated remote code execution.
PwnDrp Access
Sigma
Detects downloads from PwnDrp web servers developed for red team testing and most likely also used for criminal activity
This detection identifies network traffic to domains explicitly listed as associated with recent phishing campaigns. It specifically looks for these domains within the RequestURL field of logs from Palo Alto Networks or Cato Networks firewalls/proxies.
APT User Agent
Sigma
Detects suspicious user agent strings used in APT malware in proxy logs
Detects suspicious user agent strings used by crypto miners in proxy logs
Hack Tool User Agent
Sigma
Detects suspicious user agent strings user by hack tools in proxy logs
Detects outbound HTTP POST requests to the LeakyStealer C2 server 'everstead.group' using a specific user-agent and URI paths.
Detects download of certain file types from hosts in suspicious TLDs
Detects executable downloads from suspicious remote systems
Detects suspicious user agent strings used by exploit / pentest frameworks like Metasploit in proxy logs
Detects the use of rclone, a command-line program to manage files on cloud storage, via its default user-agent string
This rule detects attempts to access Okta administrative functions when the request is routed through a proxy. This could indicate an adversary attempting to bypass security controls or obscure their origin when performing administrative actions within Okta.
Detects the deployment or activity of the TOLLBOOTH IIS module. This is achieved by identifying the creation of its specific DLLs by the IIS worker process (w3wp.exe), or by detecting outbound C2 communication from the IIS worker process to known TOLLBOOTH infrastructure.
Detects network connections from web browsers to domains associated with the UNC5142 EtherHiding technique, including a specific blockchain node and malicious Cloudflare Pages domains.
Detects connections to interplanetary file system (IPFS) containing a user's email address which mirrors behaviours observed in recent phishing campaigns leveraging IPFS to host credential harvesting webpages.
Page 18 of 22