Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
452 detections
Filters
Last updated
All Time
Detection languages
251
100
69
13
8
Contributors
113
74
46
46
44
Categories
20,440
11,814
5,871
5,145
4,864
Platforms
302
94
46
43
29
Products / Services
317
231
88
54
28
MITRE Techniques
171
167
100
60
59
CVEs
4
3
2
2
2
IDS Classtypes
5
3
3
1
1
IDS Protocols
7
6
Detects outbound HTTP/proxy connections to gouvvbo.top, the JadeProx AdaptixC2 C2 domain also hosting a credential-harvesting phishing portal that impersonates the Piar Municipality (Venezuela) tax administration system.
Detects GET requests to the Microsoft Graph API 'organization' endpoint, often used by malicious tools to validate a tenant environment or gather metadata before initiating C2 communication or secondary stages of an attack.
Detects the presence of specific configuration strings ('design' and 'flow_type') within HTTP response bodies, which are indicative of the Kali365 phishing kit decrypting its configuration at runtime via the browser. This pattern is characteristic of credential harvesting pages.
Detects GET requests to the Microsoft Graph API 'organization' endpoint, often used by malicious tools to validate a tenant environment or gather metadata before initiating C2 communication or secondary stages of an attack.
Detects anomalous access to Outlook calendar attachments via the Microsoft Graph API, specifically targeting a file named 'file0.txt'. This activity may indicate a technique where attackers use calendar events as a covert channel for data exfiltration or delivery of malicious payloads.
Detects anomalous access to Outlook calendar attachments via the Microsoft Graph API, specifically targeting a file named 'file0.txt'. This activity may indicate a technique where attackers use calendar events as a covert channel for data exfiltration or delivery of malicious payloads.
Detects anomalous access to Outlook calendar attachments via the Microsoft Graph API, specifically targeting a file named 'file0.txt'. This activity may indicate a technique where attackers use calendar events as a covert channel for data exfiltration or delivery of malicious payloads.
Detects high-frequency Resource Owner Password Credentials (ROPC) authentication requests targeting the OAuth token endpoint. Attackers use ROPC for brute-forcing, credential stuffing, or bypassing security controls by directly passing user credentials to the OAuth flow.
This rule detects the exfiltration or beaconing of host profiling information, including security software, browser, UAC, hardware (CPU/RAM), and domain details, by the LabubaRAT remote access tool over a proxy or web-based connection.
Detects the presence of specific Microsoft Entra (formerly Azure AD) authentication session cookies (ESTSAUTH, ESTSAUTHPERSISTENT, ESTSAUTHLIGHT) in web proxy traffic. This activity is indicative of session cookie theft and potential replay attacks (Pass-the-Cookie) where an adversary attempts to authenticate to Microsoft services using stolen session material from an unauthorized or non-enrolled device.
Detects outbound web requests to OpenAI, Anthropic, or Google Gemini API endpoints that contain suspected API keys (OpenAI 'sk-proj-', Anthropic 'sk-ant-', or Google 'AIza' prefixes) in the request stream, potentially indicating hardcoded credentials, malicious script activity, or data exfiltration.
This rule detects potential brute-force or credential stuffing attempts against web application authentication endpoints by monitoring patterns of success and failure. It aggregates requests over 5-minute intervals, calculating a risk score based on high volumes of authentication failures relative to successful requests from individual source IPs targeting sensitive API paths (e.g., auth, session, login, token).
Detects HTTP POST requests to LLM chat completion API endpoints containing keywords associated with phishing kit generation, malware scaffolding, and automated credential harvesting. This behavior is consistent with attackers using LLM-assisted supply chain or phishing campaigns.
Detects network, DNS, proxy, and email interactions with known Microsoft-themed lookalike domains used in Adversary-in-the-Middle (AiTM) phishing campaigns. These domains impersonate Microsoft login portals to facilitate credential and session token harvesting by kits such as EvilProxy, Sneaky2FA, and Tycoon.
Detects network proxy requests from Go-based HTTP clients targeting Dropbox and gofile.io, which are common indicators of VILE ransomware communication or data exfiltration activities.
Detects HTTP POST requests sent to Large Language Model (LLM) chat completion API endpoints where the URI query parameters contain keywords strongly associated with the creation of phishing kits, credential harvesting forms, or malware scaffolding. This rule aims to identify the use of AI tools to accelerate malicious development workflows.
This rule detects attempts to perform Large Language Model (LLM) prompt injection via HTTP requests. It monitors proxy traffic for common jailbreaking or adversarial instruction patterns such as 'ignore previous instructions', 'bypass restrictions', or 'fictional environment' within URI parameters or request bodies. Such patterns are indicative of an attacker attempting to manipulate the behavior of an AI/LLM application.
Detects the presence of the 'x-ms-RefreshTokenCredential' cookie in requests directed to 'login.microsoftonline.com' originating from a client that does not identify as Windows. This behavioral pattern is associated with session hijacking techniques where an attacker uses a tool (e.g., Device Code Lab) to inject a session cookie into a browser, allowing for unauthorized access to Microsoft 365 services.
Detects evidence of SearchLeak (CVE-2026-42824), a post-exploitation technique where M365 Copilot prompt injection causes a browser to perform a Bing 'searchbyimage' request. The 'imgurl' parameter points to an attacker-controlled server, with the URL path containing exfiltrated mailbox data (e.g., MFA codes, email content) encoded as underscore-delimited segments. The Bing service performs an SSRF, fetching the image from the attacker's server and thereby delivering the data while bypassing local client-side security controls like CSP.
Detects outbound HTTP requests matching the VPN Go clipboard-stealer exfiltration pattern: a request to /html/continue.php carrying the uid, part, total, and data query parameters used to reassemble chunked clipboard contents server-side. URI-pattern based, so it catches infrastructure rotation beyond the known IOC hosts.
This rule detects potential brute-force or credential stuffing attempts against web application authentication endpoints by monitoring patterns of success and failure. It aggregates requests over 5-minute intervals, calculating a risk score based on high volumes of authentication failures relative to successful requests from individual source IPs targeting sensitive API paths (e.g., auth, session, login, token).
Page 9 of 22