Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
452 detections
Filters
Last updated
All Time
Detection languages
251
100
69
13
8
Contributors
113
74
46
46
44
Categories
20,440
11,814
5,871
5,145
4,864
Platforms
302
94
46
43
29
Products / Services
317
231
88
54
28
MITRE Techniques
171
167
100
60
59
CVEs
4
3
2
2
2
IDS Classtypes
5
3
3
1
1
IDS Protocols
7
6
Correlates an external Microsoft Teams helpdesk-impersonation contact event with subsequent remote access tool installation (Quick Assist/RemSupp/DWAgent/AnyDesk) and Chaos ransomware encryption/ransom note deployment (readme.chaos.txt) occurring within a 17-hour window, consistent with the STAC4749 campaign's observed under-17-hour intrusion-to-encryption timeline.
Detects OAuth2 token requests scoped to Google's secureidentity.action, used for passkey/security-domain-secret operations. Chrome's own sync/passkey process routinely requests this scope from the browser, so those requests (identified by a Chrome User-Agent) are excluded. Remaining matches indicate the token request did not originate from the legitimate Chrome browser process (e.g. a non-browser client, script, or tool crafting the request directly), which is anomalous and warrants investigation for possible passkey/security-domain-secret abuse or token reuse across devices.
Detects the Hermes Agent/DeepSeek autonomous CVE-research pivot pattern — proxy traffic showing both a GitHub trending-PoC search sorted by stars and a CVSS/exploitability scoring pipeline query, indicating autonomous vulnerability research and target re-selection after a failed exploitation attempt.
Detects OAuth2 token requests scoped to Google's secureidentity.action, used for passkey/security-domain-secret operations. Chrome's own sync/passkey process routinely requests this scope from the browser, so those requests (identified by a Chrome User-Agent) are excluded. Remaining matches indicate the token request did not originate from the legitimate Chrome browser process (e.g. a non-browser client, script, or tool crafting the request directly), which is anomalous and warrants investigation for possible passkey/security-domain-secret abuse or token reuse across devices.
This rule monitors Zscaler web proxy logs to identify potential unauthorized account access by flagging two types of anomalous geographic activity: Impossible Travel (user access from two different countries within a short time window) and New Country for Identity (the first instance of an account accessing resources from a specific country).
Correlates an external Microsoft Teams helpdesk-impersonation contact event with subsequent remote access tool installation (Quick Assist/RemSupp/DWAgent/AnyDesk) and Chaos ransomware encryption/ransom note deployment (readme.chaos.txt) occurring within a 17-hour window, consistent with the STAC4749 campaign's observed under-17-hour intrusion-to-encryption timeline.
Detects outbound HTTP/proxy connections to gouvvbo.top, the JadeProx AdaptixC2 C2 domain also hosting a credential-harvesting phishing portal that impersonates the Piar Municipality (Venezuela) tax administration system.
Correlates an external Microsoft Teams helpdesk-impersonation contact event with subsequent remote access tool installation (Quick Assist/RemSupp/DWAgent/AnyDesk) and Chaos ransomware encryption/ransom note deployment (readme.chaos.txt) occurring within a 17-hour window, consistent with the STAC4749 campaign's observed under-17-hour intrusion-to-encryption timeline.
Detects outbound HTTP/proxy connections to gouvvbo.top, the JadeProx AdaptixC2 C2 domain also hosting a credential-harvesting phishing portal that impersonates the Piar Municipality (Venezuela) tax administration system.
This rule detects potential Web Proxy Auto-Discovery (WPAD) exploitation or manipulation. It monitors for the presence of 'wpad_capture.ocx' (often associated with WPAD-based credential capturing tools), execution of processes involving WPAD-related command-line tokens, and modifications to the 'AutoConfigURL' registry value, which is used to redirect traffic through an attacker-controlled proxy.
Detects a suspicious proxy authentication negotiation pattern involving multiple HTTP 407 challenges followed by a WebSocket upgrade and the establishment of a SOCKS5 tunnel, indicative of the BridgeHead adversary toolset.
This rule monitors Zscaler web proxy logs to identify potential unauthorized account access by flagging two types of anomalous geographic activity: Impossible Travel (user access from two different countries within a short time window) and New Country for Identity (the first instance of an account accessing resources from a specific country).
This rule detects proxy requests directed to the legitimate Microsoft OAuth 2.0 device authorization endpoint (/common/oauth2/deviceauth). This activity is indicative of OAuth device code phishing, where a user is tricked into entering a malicious or attacker-provided device code into the legitimate Microsoft device login page to complete an authentication flow and grant unauthorized access to an attacker-controlled application.
This rule detects proxy requests directed to the legitimate Microsoft OAuth 2.0 device authorization endpoint (/common/oauth2/deviceauth). This activity is indicative of OAuth device code phishing, where a user is tricked into entering a malicious or attacker-provided device code into the legitimate Microsoft device login page to complete an authentication flow and grant unauthorized access to an attacker-controlled application.
Detects the presence of specific configuration strings ('design' and 'flow_type') within HTTP response bodies, which are indicative of the Kali365 phishing kit decrypting its configuration at runtime via the browser. This pattern is characteristic of credential harvesting pages.
Detects network requests to the Google OAuth device authorization flow endpoint, which is commonly abused in phishing campaigns to trick users into authorizing a malicious application on their behalf, allowing an attacker to steal session tokens.
Detects GET requests to the Microsoft Graph API 'organization' endpoint, often used by malicious tools to validate a tenant environment or gather metadata before initiating C2 communication or secondary stages of an attack.
This rule detects potential Adversary-in-the-Middle (AiTM) phishing attacks targeting Microsoft 365. It monitors for suspicious network connections to known Evilginx-style subdomains (e.g., owa, sso, secure, billing) that proxy traffic to login.microsoftonline.com, followed immediately by a successful user login event on the same host. This pattern indicates an active session hijacking attempt designed to capture session cookies like ESTSAUTH and ESTSAUTHPERSISTENT.
Detects silent browser-side cryptocurrency wallet fingerprinting via EIP-6963 discovery, window.ethereum probing, and wallet-extension enumeration (e.g. MetaMask, Solana) occurring together, excluding known legitimate dApp/wallet-connect domains, consistent with BlueNoroff's pre-payload wallet profiling.
Detects the presence of specific configuration strings ('design' and 'flow_type') within HTTP response bodies, which are indicative of the Kali365 phishing kit decrypting its configuration at runtime via the browser. This pattern is characteristic of credential harvesting pages.
Detects network requests to the Google OAuth device authorization flow endpoint, which is commonly abused in phishing campaigns to trick users into authorizing a malicious application on their behalf, allowing an attacker to steal session tokens.
Page 8 of 22