Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
452 detections
Filters
Last updated
All Time
Detection languages
251
100
69
13
8
Contributors
113
74
46
46
44
Categories
20,417
11,806
5,870
5,145
4,864
Platforms
302
94
46
43
29
Products / Services
317
231
88
54
28
MITRE Techniques
171
167
100
60
59
CVEs
4
3
2
2
2
IDS Classtypes
5
3
3
1
1
IDS Protocols
7
6
Detects specific URI patterns associated with the 'JWR' phishing framework, which relays live operator instructions to capture pages (e.g., requesting CVV, 2FA codes, or PINs). These patterns are indicative of active adversary-in-the-middle phishing sessions.
This rule detects anomalous network traffic patterns characteristic of the JWR phishing framework. It identifies live, operator-driven exfiltration where an attacker issues specific instruction sequences (e.g., to_card, to_sms, to_2fa) via HTTP polling or WebSockets to facilitate the character-by-character capture of sensitive information like payment card details and OTPs from a victim.
Detects network requests related to the RatHat Android malware, specifically focusing on the retrieval of the 'minicap' tool used for screen capture and the subsequent exfiltration of captured screen data or video chunks.
This rule detects potential Adversary-in-the-Middle (AiTM) phishing activity by correlating network requests to known malicious lure domains with help-desk or vishing-themed events (such as password resets or unsolicited IT support) for the same user within a one-hour window. This behavior is indicative of a help-desk impersonation campaign where attackers direct users to credential harvesting sites.
Detects proxy requests to typosquatted domains masquerading as major job platforms (LinkedIn, Indeed) that are serving suspicious file extensions (.hta, .ps1) often associated with the 'ClickFix' social engineering technique. This rule monitors for URLs mimicking these brands while attempting to deliver potentially malicious scripts to the user.
Detects high-frequency, automated API requests to commercial Large Language Model (LLM) endpoints from a single source IP. The rule identifies suspicious activity characterized by a rapid rotation of multiple API tokens, often indicative of an intermediary proxy or middleware service attempting to bypass provider-specific usage limits, billing controls, or safety guardrails.
This rule monitors for user interactions with specific domains and URLs known to be associated with suspicious or malicious activity. It aggregates data from multiple sources, including email clicks (UrlClickEvents), device network activity (DeviceNetworkEvents), device browser events (DeviceEvents), and DNS queries (DnsEvents), to identify potential exposure to these indicators of compromise.
Detects potential cross-family Command and Control (C2) activity by correlating multiple network infrastructure indicators associated with the SilkParasite threat actor. The rule identifies source hosts that interact with at least two distinct indicator sets (specific malicious domains, shared TLS certificates, or cloned homepage content hashes) within a one-hour timeframe.
This rule monitors for two distinct stages of potential account recovery abuse. First, it detects the execution of suspected Python scripts on an endpoint that contain command-line arguments related to password recovery or authentication codes. Second, it monitors network proxy/web logs for a high volume of API requests to the 'easy4ipcloud.com' domain associated with password reset or device probe endpoints, which may indicate automated credential stuffing or unauthorized device account recovery attempts.
Detects network requests to a WordPress site's API path associated with the 'ClickFix' social engineering campaign. The rule monitors for specific URL parameters used by the campaign's backend to deliver malicious payload-fetching instructions to victims.
Detects outbound proxy traffic indicating potential Adversary-in-the-Middle (AiTM) phishing activity. The rule identifies requests directed at domains mimicking major Identity Providers (Microsoft, Okta, Duo, Google) that either utilize punycode homograph encoding or arrive via known URL shortener/redirector services, while filtering out known legitimate brand domains.
Detects network requests targeting specific public Polygon RPC endpoints that query a known smart contract associated with EtherHiding-style C2 activity. This rule monitors for RPC methods (eth_call, eth_getStorageAt) commonly used to retrieve embedded C2 instructions stored within blockchain state data, a technique known as leveraging smart contracts for command-and-control communication.
Detects outbound web requests where the referer header indicates the traffic originated from 'accounts.google.com' and the target URI contains 'gusercontent.com', excluding the legitimate 'googleusercontent.com' domain. This behavior is indicative of potential typosquatting or malicious redirection to a lookalike domain, often used in credential theft or phishing campaigns.
Detects outbound network requests to popular Large Language Model (LLM) API endpoints originating from processes that do not appear to be standard web browsers or identified legitimate development tools. This behavior may indicate an unauthorized script, malware, or compromised process attempting to use LLM APIs for C2, data exfiltration, or automated reconnaissance.
Detects attempts to perform prompt injection against internal Large Language Model (LLM) inference APIs. The rule monitors HTTP proxy logs for specific query parameters designed to trick the model into disclosing its underlying system instructions or hidden prompts.
Detects outbound web or proxy connections to known consumer-grade cloud storage and file-sharing services. This activity is often indicative of data exfiltration, where an adversary uploads staged or archived sensitive data to third-party file hosting services (e.g., Mega, Dropbox, transfer.sh, pastebin) to bypass traditional enterprise exfiltration controls.
Detects network activity and HTTP traffic associated with the Iron Man System kit, specifically targeting hardcoded C2 infrastructure (IP-based) and lure domain patterns involving specific brand tokens combined with disposable TLDs.
This rule monitors for user interactions with specific domains and URLs known to be associated with suspicious or malicious activity. It aggregates data from multiple sources, including email clicks (UrlClickEvents), device network activity (DeviceNetworkEvents), device browser events (DeviceEvents), and DNS queries (DnsEvents), to identify potential exposure to these indicators of compromise.
This rule detects email or web proxy traffic containing a lure themed around 'Confluence', combined with a redirect or link to Telegram, and specifically containing Cyrillic character sets. This combination is often indicative of targeted phishing campaigns using social engineering lures to redirect users to external messaging platforms for further interaction or credential harvesting.
Detects signs of the TrustSink technique where an Entra sign-in process, while at the MFA stage, is intercepted by redirecting the user to a rogue External Authentication Method (EAM) provider. This unauthorized provider typically uses look-alike domains or tunneling services to host phishing pages that harvest plaintext credentials and return forged MFA tokens to Entra.
This rule detects potential Adversary-in-the-Middle (AiTM) phishing attacks targeting Microsoft 365 authentication flows. It identifies suspicious proxy traffic that contains authentication-related URIs or session-related cookies (such as ESTSAUTHPERSISTENT or refresh tokens) originating from hosts other than recognized Microsoft domains. This behavior is indicative of an attacker using a reverse proxy, such as Evilginx2, to intercept user credentials and session cookies in real-time.
Page 5 of 22