Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
236 detections
Filters
Last updated
All Time
Detection languages
234
2
Contributors
120
68
21
9
8
Categories
133
104
94
78
68
Platforms
220
16
8
4
4
Products / Services
230
105
23
6
4
MITRE Techniques
96
48
25
25
23
CVEs
1
IDS Classtypes
1,937
503
461
381
236
IDS Protocols
102
64
21
14
8
Detects network activity (DNS queries, TLS SNI, and HTTP requests) associated with identified 'ShipmentsFree' scam domains. These domains are typically used in phishing or credential harvesting campaigns to trick users into visiting fake account or tracking pages.
Detects network activity (DNS queries, TLS SNI, and HTTP requests) associated with identified 'ShipmentsFree' scam domains. These domains are typically used in phishing or credential harvesting campaigns to trick users into visiting fake account or tracking pages.
Detects network activity (DNS queries, TLS SNI, and HTTP requests) associated with identified 'ShipmentsFree' scam domains. These domains are typically used in phishing or credential harvesting campaigns to trick users into visiting fake account or tracking pages.
Detects outbound network traffic (TLS and DNS queries) directed towards AWS S3 endpoints, which may indicate the use of s5cmd or similar tools for unauthorized data exfiltration to cloud storage.
Detects outbound network traffic (HTTPS and TLS) directed at the specific S3-compatible object storage host 'ams1.vultrobjects.com'. This pattern is associated with 'HEAVYGRAM', a threat actor or toolkit using Vultr S3 buckets for potential data exfiltration.
Detects HTTP traffic to the Telegram Bot API (/sendPhoto) originating from internal network hosts, which is indicative of potential exfiltration of captured images (e.g., screenshots or webcam captures) to an adversary-controlled Telegram channel.
Detects the usage of s5cmd, a command-line tool for S3, to communicate with AWS S3 endpoints. This behavior is indicative of potential data exfiltration by an adversary using authorized cloud storage tools to move data out of the environment.
Detects established SSH network connections originating from the internal network to external destinations on ports other than the standard port 22. This behavior is often associated with unauthorized SSH tunneling or command-and-control (C2) communication intended to bypass standard firewall egress filtering.
Detects outbound TLS traffic to known remote access and management software domains (e.g., ScreenConnect, AnyDesk, TeamViewer), which are frequently abused by adversaries for establishing Command and Control (C2) channels.
Detects outbound network traffic associated with the Tailscale VPN protocol, specifically identifying potential unauthorized or personal tailnet communication channels. The detection monitors for TLS SNI strings ending in '.ts.net' and WireGuard handshakes on UDP port 41641. These indicators are common to all Tailscale client activity and require environment-specific exclusions of sanctioned Tailscale infrastructure to minimize noise.
Detects high-frequency access requests to SharePoint or OneDrive services using the 'python-httpx' library. This behavior is indicative of automated scraping or mass data retrieval often associated with malicious actors or unauthorized automated tools.
Detects outbound network traffic (HTTPS and TLS) directed at the specific S3-compatible object storage host 'ams1.vultrobjects.com'. This pattern is associated with 'HEAVYGRAM', a threat actor or toolkit using Vultr S3 buckets for potential data exfiltration.
Detects outbound network traffic (HTTPS and TLS) directed at the specific S3-compatible object storage host 'ams1.vultrobjects.com'. This pattern is associated with 'HEAVYGRAM', a threat actor or toolkit using Vultr S3 buckets for potential data exfiltration.
Detects outbound network traffic attempting to reach known public DNS-over-HTTPS (DoH) resolvers. This rule monitors for specific SNI fields in TLS handshakes or HTTP/2 :authority headers that indicate communication with common third-party DoH services, which may be used to bypass internal DNS filtering and monitoring controls.
Detects outbound network traffic associated with the Tailscale VPN protocol, specifically identifying potential unauthorized or personal tailnet communication channels. The detection monitors for TLS SNI strings ending in '.ts.net' and WireGuard handshakes on UDP port 41641. These indicators are common to all Tailscale client activity and require environment-specific exclusions of sanctioned Tailscale infrastructure to minimize noise.
Detects established TLS outbound connections to external networks on ports other than standard ones (e.g., 443, 465, 587, 993, 995, 8443, 9443). This behavior may indicate a covert C2 channel or unauthorized data exfiltration attempting to bypass standard firewall controls.
Detects inbound HTTP traffic directed to internal hosts on ports other than commonly used web ports (80, 443, 8080, 8443, 8000, 8888, 3128). This behavior may indicate an attempt to bypass network security controls or the use of non-standard ports for command and control or data exfiltration.
Detects outbound network traffic (HTTPS and TLS) directed at the specific S3-compatible object storage host 'ams1.vultrobjects.com'. This pattern is associated with 'HEAVYGRAM', a threat actor or toolkit using Vultr S3 buckets for potential data exfiltration.
Detects outbound network traffic associated with the Tailscale VPN protocol, specifically identifying potential unauthorized or personal tailnet communication channels. The detection monitors for TLS SNI strings ending in '.ts.net' and WireGuard handshakes on UDP port 41641. These indicators are common to all Tailscale client activity and require environment-specific exclusions of sanctioned Tailscale infrastructure to minimize noise.
Detects high-frequency PUT requests to known S3-compatible cloud storage providers using the rclone user-agent, which is a common indicator of bulk data exfiltration or unauthorized backup activity by attackers.
Detects high-frequency PUT requests to known S3-compatible cloud storage providers using the rclone user-agent, which is a common indicator of bulk data exfiltration or unauthorized backup activity by attackers.
Page 2 of 12