Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
101 detections
Filters
Last updated
All Time
Detection languages
101
Contributors
36
24
19
13
6
Categories
45
34
24
23
23
Platforms
88
16
4
4
3
Products / Services
97
56
7
2
2
MITRE Techniques
39
25
17
17
14
CVEs
1
IDS Classtypes
1,937
503
461
381
236
101
IDS Protocols
43
41
8
3
2
Detects high-volume, potentially malicious activity where a client requests a large number of distinct hostnames ending in .shop from a single destination IP address within a short time frame, which may indicate infrastructure used for phishing or fraudulent e-commerce storefronts similar to DoppelCart-style activity.
This rule detects high-volume DNS resolution of domains ending in the .shop TLD from internal hosts, which may indicate interaction with a cluster of infrastructure used by the DoppelCart fake-shop campaign.
This rule detects high-volume DNS resolution of domains ending in the .shop TLD from internal hosts, which may indicate interaction with a cluster of infrastructure used by the DoppelCart fake-shop campaign.
Detects high-frequency DNS query responses for domains ending in '.shop' from external sources within a 10-minute window. This behavior is indicative of domain churn often associated with 'DoppelCart'-style fake e-commerce shop infrastructure.
Detects high-frequency DNS query responses for domains ending in '.shop' from external sources within a 10-minute window. This behavior is indicative of domain churn often associated with 'DoppelCart'-style fake e-commerce shop infrastructure.
Detects high-frequency DNS query responses for domains ending in '.shop' from external sources within a 10-minute window. This behavior is indicative of domain churn often associated with 'DoppelCart'-style fake e-commerce shop infrastructure.
Detects high-volume, potentially malicious activity where a client requests a large number of distinct hostnames ending in .shop from a single destination IP address within a short time frame, which may indicate infrastructure used for phishing or fraudulent e-commerce storefronts similar to DoppelCart-style activity.
Detects high-volume, potentially malicious activity where a client requests a large number of distinct hostnames ending in .shop from a single destination IP address within a short time frame, which may indicate infrastructure used for phishing or fraudulent e-commerce storefronts similar to DoppelCart-style activity.
Detects network communication to Firebase infrastructure (.firebaseio.com) initiated by Android devices, which may indicate command-and-control (C2) activity associated with the Mantax Otax malware family. This rule tracks initial connections and should be correlated with specific suspicious domains for higher confidence.
Detects network communication to Firebase infrastructure (.firebaseio.com) initiated by Android devices, which may indicate command-and-control (C2) activity associated with the Mantax Otax malware family. This rule tracks initial connections and should be correlated with specific suspicious domains for higher confidence.
Detects network activity (DNS queries, TLS SNI, and HTTP Host headers) directed towards domains ending in the .vu Top-Level Domain (TLD). This is associated with NovaCookies phishing infrastructure which utilizes these TLDs for malicious redirection or staging.
Detects DNS, HTTP, and TLS access to the public code-hosting repositories publishing the ShieldBreak Microsoft Defender 0-day exploit (GitHub, git.projectnightcrawler.dev, git.churchofmalware.org).
Detects the ClickFix TDS (Traffic Direction System) gate, which uses browser-based JavaScript to perform anti-analysis and anti-instrumentation checks. Specifically, it looks for the unauthorized hooking of Array.prototype.includes and the use of canPlayType as a tripwire to detect sandboxes or debuggers, correlated with signs of developer tool usage or prototype property modifications.
Detects DNS queries to Google Ads click-tracking infrastructure followed within 60 seconds by resolution of a newly registered, previously unseen domain, consistent with the Storm-2755 AiTM redirect chain.
Detects DNS query bursts from a single source to a predefined set of domains mimicking passkey or single-sign-on (SSO) login portals. These domains are known to be part of the infrastructure used by the UNC6671 threat actor for credential harvesting activities.
Detects a high-volume DNS TXT-record query flood (200+ queries in 5 minutes) to a single destination, excluding common legitimate high-volume TXT consumers (SPF/DKIM/DMARC validators), indicative of DNS tunneling.
Detects an HTTP POST to an IP-literal host occurring after an eth_call blockchain RPC lookup from the same host, consistent with DeviceManager/DOUBLECUP resolving and beaconing to a C2 address extracted from blockchain-sourced configuration.
Detects a multi-stage network activity pattern characteristic of 'SourTrade' cloaking. The rule tracks an initial HTTP request with a referral to a known lookalike crypto/trading domain, followed by the fetching of a client-side JavaScript fingerprinting script, and finally, a subsequent HTTP response that appears to be a near-empty decoy page (used to mask malicious content from crawlers).
Detects HTTP response bodies containing specific combinations of advertising tracking markers (Google gtag, Meta fbq, and Twitter twq) alongside known path indicators like '/config' or 'sw.js', which are characteristic of SourTrade malvertising landing pages.
Detects DNS queries for the Twilio TURN relay domain 'global.turn.twilio.com', which is associated with msaRAT C2 activity. This indicator is low-confidence and intended to be used as part of a correlation with other behaviors like loopback C2 traffic or suspicious DevTools usage.
Detects sequential HTTP GET requests for specific SVG assets (barr.svg followed by lg.svg) associated with the Kratos V1 phishing kit landing page, indicating potential interaction with a phishing site.
Page 2 of 5