Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,937 detections
Filters
Last updated
All Time
Detection languages
1,930
3
2
1
1
Contributors
592
477
360
250
124
Categories
995
927
834
546
538
Platforms
1,753
214
81
54
41
Products / Services
1,868
1,144
65
51
17
MITRE Techniques
564
412
305
201
175
CVEs
4
4
4
2
2
IDS Classtypes
1,937
503
461
381
236
IDS Protocols
1,098
362
201
171
37
Detects DNS queries to the broader set of UNC6671/Blackfile/Pink/Falcon passkey- and SSO-themed lookalike phishing domains used across the campaign's rebrand clusters.
Detects POST requests to the Storm-2755 Payroll Pirates AiTM toolkit fingerprinting endpoint URI pattern co-occurring with the distinctive openresty/PHP response header combination.
Detects C2Looper v2 retrieving GitHub-hosted C2 tasking files (cmd.json, result.json, beacon.json) via raw.githubusercontent.com or api.github.com, requiring repeated requests to reduce false positives from incidental single fetches.
Detects SilentDataCollector uploading AES-CBC encrypted, specifically-named archives (desktop_files, pass_V, wallet_V, filelist.zip.encrypted, documents<n>.zip) to the compromised WordPress C2.
ChainDrop Mini Shai-Hulud npm supply-chain worm C2 infrastructure DNS lookup
Network signature matching known Gunra C2 IP addresses, the datapub.news leak/paste domain, and Gunra-associated .onion leak/negotiation sites.
Detects DNS/TLS SNI lookups for the hollowed wab.exe process's secondary C2 domains (bsc.rpc.blxrbdn.com, lb.propertyfind.cc) and the correlated follow-on connection to their resolved IPs, flagging the shared Cloudflare IP 172.67.161.234 for additional host-side process-lineage verification.
Detects HTTP outbound traffic to domains using the .sbs TLD that follow a specific 'file' followed by dictionary words naming convention, associated with the ClickFix campaign. The rule specifically identifies staging requests matching a /curl/<hex-id> URI pattern used to deliver secondary payloads.
Detects AiTM phishing page geolocation fingerprint script referencing api.country.is, setting an rcfh_country cookie, and redirecting via oauth2/v2.0/authorize.
Detects the Payroll Pirates (Storm-2755) AiTM phishing redirect chain: Google Meet/Ads redirector, an AWS S3 intermediate hop, and final resolution of a previously-unseen domain, indicating completion of the multi-hop chain to an AiTM proxy.
This rule detects suspicious outbound HTTP POST requests containing specific JSON fingerprint payloads associated with ClickFix campaigns. The fingerprint contains a mode set to 'php', typically delivered via hidden, auto-submitting forms on malicious domains to profile victims or deliver secondary payloads.
This rule detects outbound network traffic indicative of AI token jacking, where compromised API keys are utilized through unauthorized gray-market proxy platforms. It identifies requests originating from internal hosts using the specific, anomalous User-Agent string 'Go-http-client/2.0,gzip(gfe)' in conjunction with HTTP host headers associated with known AI 'transfer-station' services such as 'new-api' or 'one-api'. This signature is designed to distinguish malicious exploitation from benign Go-based service traffic, while explicitly excluding known internal service accounts to minimize false positives.
This rule detects sustained network communication (at least 5 connections within a 300-second window) between internal hosts and a specific list of IP addresses identified by Unit 42 as malicious infrastructure used for AI token jacking. These servers operate as transfer stations, likely utilizing platforms like new-api or one-api to facilitate the illicit resale of stolen frontier-AI API keys. The rule incorporates an exclusion for internal security scanning and proxy infrastructure to minimize false positives, and it is specifically designed to flag exfiltration or unauthorized API usage patterns associated with stolen credentials (T1539) and potential proxy-based obfuscation of command and control or data relay (T1090).
UNC6671 - Outbound connection to known automated SaaS data exfiltration IP, excluding maintained allowlist of legitimate backup/sync/CDN and sanctioned bulk-transfer destinations
Network traffic to Aeza Group bulletproof-hosting IP (loader/payload delivery)
UNC6671 AiTM passkey/SSO lookalike domain DNS query
Detects DNS queries for Storm-2945 Microsoft-impersonating doppelganger domains and traffic to actor-controlled AitM resolver/redirect infrastructure on captive-portal networks.
Possible O365 credential exfil via HTTP PUT to attacker-controlled S3 bucket
UNC6671 AiTM Phishing Infrastructure - Maintained IOC Dataset Match with TTL-Based Expiry (High Confidence)
WhiteCobra Operation Solidity Pro - Telegram Bot API exfiltration upload
ChainDrop Mini Shai-Hulud npm supply-chain worm C2 infrastructure DNS lookup
Page 49 of 93