Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
101 detections
Filters
Last updated
All Time
Detection languages
101
Contributors
36
24
19
13
6
Categories
45
34
24
23
23
Platforms
88
16
4
4
3
Products / Services
97
56
7
2
2
MITRE Techniques
39
25
17
17
14
CVEs
1
IDS Classtypes
1,937
503
461
381
236
101
IDS Protocols
43
41
8
3
2
Detects a multi-stage exploit chain targeting iOS Safari clients, characterized by the sequential fetching of specific JavaScript modules (platform_module.js, utility_module.js, Stage1, Stage3, and bootstrap.dylib) and subsequent callback communication to a remote server. This pattern is consistent with a browser-based exploit framework targeting iOS devices.
Detects a multi-stage exploit chain targeting iOS Safari clients, characterized by the sequential fetching of specific JavaScript modules (platform_module.js, utility_module.js, Stage1, Stage3, and bootstrap.dylib) and subsequent callback communication to a remote server. This pattern is consistent with a browser-based exploit framework targeting iOS devices.
Detects high-volume DNS traffic characterized by long, high-entropy subdomain labels, which are often used as a mechanism for command-and-control (C2) communication or data exfiltration via DNS tunneling.
Detects a multi-stage exploit chain targeting iOS Safari clients, characterized by the sequential fetching of specific JavaScript modules (platform_module.js, utility_module.js, Stage1, Stage3, and bootstrap.dylib) and subsequent callback communication to a remote server. This pattern is consistent with a browser-based exploit framework targeting iOS devices.
Detects a multi-stage exploit chain targeting iOS Safari clients, characterized by the sequential fetching of specific JavaScript modules (platform_module.js, utility_module.js, Stage1, Stage3, and bootstrap.dylib) and subsequent callback communication to a remote server. This pattern is consistent with a browser-based exploit framework targeting iOS devices.
Detects DNS queries attempting to resolve domains associated with malicious LLM-as-a-service platforms, specifically targeting domains containing 'wormgpt', 'fraudgpt', or 'evilgpt'. These platforms are often used by adversaries to facilitate automated social engineering, malware development, or other malicious activities.
Detects two-stage phishing activity involving an initial visit to a Vercel-hosted lure page followed by the exfiltration or relay of fingerprinting and sandbox-evasion results to api.telegram.org.
Detects HTTP traffic where a common automated scanner or sandbox user agent triggers an immediate redirect to 'about:blank', a common technique used by phishing kits to hide content from automated security analysis tools.
This rule detects network traffic originating from potential Casbaneiro or Ousaban malware that uses HTTP 302 redirects to redirect non-targeted IP addresses to Google or YouTube. This behavior is used as a geofencing and sandbox evasion technique to prevent security analysts and automated systems from seeing the actual malicious payload.
Detects network traffic (DNS queries, TLS SNI, and HTTP Host headers) targeting the domain 'expresshost.cloud', which is identified as hosting VPS infrastructure commonly used for scanning and malicious activities.
Detects malicious HTML pages commonly used in ClickFix-style phishing campaigns that intercept keyboard events (specifically blocking devtools and view-source shortcuts) and display fraudulent verification prompts to lure users into executing malicious actions.
This rule detects network traffic originating from potential Casbaneiro or Ousaban malware that uses HTTP 302 redirects to redirect non-targeted IP addresses to Google or YouTube. This behavior is used as a geofencing and sandbox evasion technique to prevent security analysts and automated systems from seeing the actual malicious payload.
This rule detects network traffic originating from potential Casbaneiro or Ousaban malware that uses HTTP 302 redirects to redirect non-targeted IP addresses to Google or YouTube. This behavior is used as a geofencing and sandbox evasion technique to prevent security analysts and automated systems from seeing the actual malicious payload.
Detects DNS queries, TLS SNI headers, or HTTP Host headers containing patterns consistent with IT-support-themed vishing lure domains, specifically 'helpdesk-support-office-#.com'. Such domains are often used to impersonate technical support services to facilitate social engineering, credential harvesting, or malware delivery.
This rule detects network traffic originating from potential Casbaneiro or Ousaban malware that uses HTTP 302 redirects to redirect non-targeted IP addresses to Google or YouTube. This behavior is used as a geofencing and sandbox evasion technique to prevent security analysts and automated systems from seeing the actual malicious payload.
Detects DNS queries for lookalike domains combining a government/brand-impersonation keyword (as its own label, not a substring) with a disposable TLD used across the IronToll campaign. Dropped the standalone 'digital' keyword, which was generic enough to match ordinary e-commerce domains on the same TLDs.
Detects network activity (DNS queries, TLS SNI, and HTTP requests) directed towards the 'web12api.com' domain, as well as specific HTTP response structures commonly associated with adversary registration or command-and-control communication protocols.
Detects DNS queries for lookalike domains combining a government/brand-impersonation keyword (as its own label, not a substring) with a disposable TLD used across the IronToll campaign. Dropped the standalone 'digital' keyword, which was generic enough to match ordinary e-commerce domains on the same TLDs.
Detects DNS queries for lookalike domains combining a government/brand-impersonation keyword (as its own label, not a substring) with a disposable TLD used across the IronToll campaign. Dropped the standalone 'digital' keyword, which was generic enough to match ordinary e-commerce domains on the same TLDs.
Detects network communication to Firebase infrastructure (.firebaseio.com) initiated by Android devices, which may indicate command-and-control (C2) activity associated with the Mantax Otax malware family. This rule tracks initial connections and should be correlated with specific suspicious domains for higher confidence.
This rule detects high-volume DNS resolution of domains ending in the .shop TLD from internal hosts, which may indicate interaction with a cluster of infrastructure used by the DoppelCart fake-shop campaign.
Page 1 of 5