Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
127 detections
Filters
Last updated
All Time
Detection languages
127
Contributors
93
34
Categories
52
48
20
19
15
Platforms
117
13
6
5
3
Products / Services
125
5
2
1
1
MITRE Techniques
29
29
22
16
15
IDS Classtypes
1,937
503
461
381
236
127
IDS Protocols
57
19
19
18
12
ET INFO Blockchain RPC Domain in TLS SNI (api .avax .network)
ET INFO Observed VNT VPN Domain (vnt .8443 .eu .org in TLS SNI)
ET INFO VNT VPN Domain in DNS Lookup (vnt .wherewego .top)
ET INFO VNT VPN Domain in DNS Lookup (vnt .8443 .eu .org)
ET INFO Observed RMM Domain (meshcentral .com in TLS SNI)
ET INFO Blockchain RPC Domain in DNS Lookup (rpc .ftm .tools)
ET INFO Blockchain RPC Domain in DNS Lookup (arbitrum .one)
This rule detects HTTP GET requests for PNG files from github.com with a minimal set of HTTP headers. Specifically, it looks for requests where the total size of HTTP header names is less than 30 bytes and explicitly excludes common headers like 'user-agent', 'referer', 'accept', 'x-auth', and 'cookie'. This pattern could indicate an attempt to exfiltrate data or perform other covert communication using a simplified HTTP client, potentially to evade detection by security tools that expect full browser-like headers.
ET INFO Remote Monitoring and Management (RMM) Tool in TLS SNI (gorelo .tech)
ET INFO Blockchain RPC Domain in DNS Lookup (polygon-rpc .com)
ET INFO Blockchain RPC Domain in DNS Lookup (mainnet .optimism .io)
ET INFO Blockchain RPC Domain in TLS SNI (cloudflare-eth .com)
ET INFO Blockchain RPC Domain in DNS Lookup (cloudflare-eth .com)
ET INFO Observed Commonly Actor Abused Cloud Hosting Service Domain (caspio .com in TLS SNI)
ET INFO Observed Commonly Actor Abused Cloud Hosting Service Domain (vercel .app in TLS SNI)
ET INFO Blockchain RPC Domain in TLS SNI (rpc .ftm .tools)
ET INFO Blockchain RPC Domain in TLS SNI (arbitrum .one)
ET INFO Observed Observed Commonly Actor Abused Online Service Domain (getenjoyment .net in TLS SNI)
This rule detects HTTP GET requests to github.com for PNG files where the User-Agent header contains "WindowsPowerShell". This combination could indicate an attempt to download malicious content or C2 instructions disguised as an image file using PowerShell.
ET INFO Blockchain RPC Domain in TLS SNI (mainnet .optimism .io)
ET INFO Blockchain RPC Domain in TLS SNI (polygon-rpc .com)
Page 6 of 7