Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
452 detections
Filters
Last updated
All Time
Detection languages
251
100
69
13
8
Contributors
113
74
46
46
44
Categories
20,427
11,813
5,871
5,145
4,864
Platforms
302
94
46
43
29
Products / Services
317
231
88
54
28
MITRE Techniques
171
167
100
60
59
CVEs
4
3
2
2
2
IDS Classtypes
5
3
3
1
1
IDS Protocols
7
6
Detects HTTP(S) requests to known SideCopy/ReverseRAT payload-delivery URLs identified in Operation SideCopy spear-phishing campaigns targeting Indian academia.
Detects HTTP(S) requests to known SideCopy/ReverseRAT payload-delivery URLs identified in Operation SideCopy spear-phishing campaigns targeting Indian academia.
Detects HTTP proxy requests for ZIP archives where the Referer header indicates a navigation originated from a GitHub Pages (github.io) site, but the destination is not a GitHub domain. This behavior is indicative of a multi-hop redirect chain used in campaigns to deliver malicious payloads, such as infostealers, by abusing GitHub Pages to redirect users to external hosting for ZIP archive downloads.
Detects outbound HTTP POST requests from an AI agent runtime environment to known external paste-sites, webhook providers, or staging services. This behavior is indicative of a compromise where the AI agent is being manipulated to exfiltrate sensitive API keys, tokens, or configuration secrets to an attacker-controlled endpoint.
Detects attempts to perform path traversal attacks against the MikroTik RouterOS WebFig interface via the jsproxy endpoint. The rule monitors HTTP proxy traffic for directory traversal sequences (e.g., '../' or URL encoded equivalents) within the query parameters of requests directed to the jsproxy URI.
Detects suspicious mobile-device HTTP traffic patterns indicative of 'quishing' (QR code phishing). The rule identifies mobile HTTP GET requests (iPhone, Android, Mobile Safari, iPad) that lack a Referer header, followed by HTTP POST requests to common credential entry URI patterns (e.g., /login, /signin) over the same protocol, which is a behavioral indicator of a user being redirected from a scanned QR code to a malicious phishing landing page.
This rule detects access to known malicious domains used in vishing-themed Adversary-in-the-Middle (AiTM) phishing campaigns. Attackers use these domains to deceive users into providing MFA credentials or session tokens, often following a voice phishing interaction where victims are directed to these sites to register or set passkeys.
Detects the delivery of a fake 'slide-to-verify' CAPTCHA page commonly used by Mirage2FA phishing kits. These pages are designed to trick users or automated analysis tools into interacting with the site before the final AiTM (Adversary-in-the-Middle) phishing proxy is served.
Detects HTTP redirect chains originating from common webmail providers to URLs containing suspicious login-related keywords or obfuscated brand look-alike domains, which is indicative of credential harvesting or phishing activity.
Detects high-volume data transfers (exceeding 100MB) from internal sources to known external cloud storage and file-sharing platforms. This behavior is consistent with data staging and exfiltration patterns, often used by threat actors to move collected data to attacker-controlled storage infrastructure.
Detects HTTP(S) requests to known SideCopy/ReverseRAT payload-delivery URLs identified in Operation SideCopy spear-phishing campaigns targeting Indian academia.
Detects web-proxy or webserver log activity associated with domains registered within the last 30 days that mimic branding or structure of major identity providers (Microsoft, Okta, Google, Duo). This behavior is characteristic of adversary-in-the-middle (AiTM) phishing infrastructure staging.
Detects outbound HTTP/HTTPS POST requests where the URI, query string, or path contains evidence of sensitive credential material, such as AWS access keys, private key blocks, or common environment variable patterns, indicative of potential credential harvesting and exfiltration to an external destination.
Detects unauthorized outbound network traffic from browser processes to the lookalike domain 'pdf.gusercontent.com'. This domain is associated with a malicious Firefox browser extension, 'PDF Identity Verifier', which is designed to exfiltrate session telemetry and data from Google account sessions.
Detects requests to the FedCM (Federated Credential Management) well-known configuration endpoint (.well-known/web-identity) that originate from referrers containing 'gusercontent.com', often used in phishing or credential harvesting campaigns to simulate legitimate Google authentication flows.
Detects web proxy requests that resemble phishing attempts targeting Apple Activation Lock. The rule identifies URLs containing specific Apple-related keywords in combination with common phishing URL paths, while filtering out legitimate Apple support documentation pages.
Detects instances where a user experiences an interrupted sign-in event (Azure AD error code 50199) followed closely by a successful sign-in from the same user account. This pattern is often indicative of Adversary-in-the-Middle (AiTM) phishing, where an attacker intercepts an authentication request, prompts the user, and replays the captured session material.
Detects network proxy requests indicative of Adversary-in-the-Middle (AiTM) phishing kits. The rule monitors for specific URL patterns associated with malicious JavaScript delivery, administrative panels, and connections to known malicious infrastructure hosting phishing activities.
Detects HTTP CONNECT requests to external networks that include Proxy-Authorization headers with Basic authentication. This pattern is indicative of malicious proxy tunneling or unauthorized credential usage for bypassing security controls or establishing command and control channels via a proxy.
Detects network activity associated with the GhostCode phishing kit backend. The rule monitors for specific API endpoints used for credential and MFA harvesting, including loading configurations, geolocation, and polling for captured data, combined with specific session cookie identifiers.
This rule detects indicators of Browser-in-the-Browser (BitB) phishing attacks within web proxy traffic. It monitors for suspicious HTML markup mimicking browser UI elements, such as fake title bars and URL bars, as well as specific window dimensions and authentication lures that deviate from known legitimate identity provider patterns.
Page 3 of 22