Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,937 detections
Filters
Last updated
All Time
Detection languages
1,930
3
2
1
1
Contributors
592
477
360
250
124
Categories
995
927
834
546
538
Platforms
1,753
214
81
54
41
Products / Services
1,868
1,144
65
51
17
MITRE Techniques
564
412
305
201
175
CVEs
4
4
4
2
2
IDS Classtypes
1,937
503
461
381
236
IDS Protocols
1,098
362
201
171
37
Detects a specific fingerprinting activity by the ClickFix Traffic Direction System (TDS) within HTTP POST request bodies. The rule identifies the combination of 'mode:php', a 'MacIntel' platform string (spoof-check), and WebGL rendering fields ('webglVendor', 'webglRenderer') in a JSON-encoded body, which is characteristic of the macOS ClickFix infostealer campaign delivery.
Detects payload callbacks to the Rognar Telegram-bot-linked DOUBLECUP C2 URL (hxxp://67.219.107.181/hgflssvslvidfugvbldiuv).
ChainDrop Shai-Hulud 2.0 npm worm C2 TLS SNI npm-cache.com
Persistent multi-day exfil retry with per-package tracking ID beacon
Detects HTTP GET requests for sync.dat runtime configuration files with a JSON accept header, consistent with CornFlake RAT's custom C2 protocol, excluding known legitimate cloud-sync/update CDN hosts.
Detects possible kernel-level WFP redirection of outbound HTTP connections to an unexpected local loopback proxy port while the original destination host header is retained, consistent with Phantom Mantis G12/G13 network redirection.
Detects DNS queries to mangorbit.com and its subdomains, C2 infrastructure associated with the Open VSX Evil Twin extensions campaign
Detects successful DNS resolution responses, TLS SNI values, and HTTP Host headers referencing known Shai-Hulud/Miasma token-jacking transfer station infrastructure (amutes.com, abb1.life) used by attackers to resell stolen AI/LLM API access via gray-market proxy services.
TOKYOCORE RansomAgent User-Agent HTTP Traffic to Public File Hosting Service
Detects DNS/TLS/IP traffic to known CaptiveCrunch AitM doppelganger domains and C2/redirect IP infrastructure via exact-match indicators.
Larva-24009 HeptaX C2 beacon to shared infrastructure (get-command/index/new-upload/post_proc)
TLS beaconing to disposable AMOS distribution/redirector domain
AiTM Phishing - PHPSESSID Cookie with Preload Flag and Word-Number Route Token
This rule detects DNS queries, HTTP Host headers, and TLS SNI values indicative of interaction with specific doppelganger domains designed to impersonate Microsoft online services (ms365-device.com, ms365-live.com, m365-owa.com, owa-ms365.com). Such activity is commonly associated with phishing or C2 infrastructure targeting Microsoft 365 environments.
Detects likely exfiltration of encrypted synced passkey (WebauthnCredentialSpecifics) blobs to external C2 infrastructure, correlated with a prior non-browser read of Chrome's Sync Data LevelDB store, consistent with the collection-and-exfiltration stage of a Pass-ta-key credential-theft chain. Excludes traffic destined to Google's own domains.
SNOWBELT time-based DGA S3 bucket manifest retrieval
Detects network communication associated with the TOKYOCORE malware C2 infrastructure. The rule monitors for specific API endpoints (/api/victim/(log|data|command|archive)) combined with known malicious User-Agent strings (RansomAgent or fsociety/1.0), as well as suspicious multipart form data uploads that may indicate data staging or exfiltration.
CaptiveCrunch ChocoShell disguised C2 URI pattern to known Storm-2945 C2 IP (/t/event, /t/pixel.gif, polyfill payload)
Dolphin X DNS query for thedolphinx.top C2 domain
UNC6692 Edgecution phishing/payload page hosted on AWS S3 static website hosting (patch.html/.a payload)
Detects high-frequency outbound HTTP traffic matching specific URI patterns associated with potential Adaptix C2 beaconing behavior. The rule uses a sliding window threshold (10 requests within 600 seconds) to identify repetitive check-in patterns, which is a common characteristic of malware command-and-control channels.
Page 50 of 93