Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,937 detections
Filters
Last updated
All Time
Detection languages
1,930
3
2
1
1
Contributors
592
477
360
250
124
Categories
995
927
834
546
538
Platforms
1,753
214
81
54
41
Products / Services
1,868
1,144
65
51
17
MITRE Techniques
564
412
305
201
175
CVEs
4
4
4
2
2
IDS Classtypes
1,937
503
461
381
236
IDS Protocols
1,098
362
201
171
37
SourTrade malvertising - TLS SNI exact match to known SourTrade infrastructure domain
This rule detects potential command-and-control (C2) activity related to the NodeSnake RAT. It specifically identifies cleartext HTTP requests attempting to initiate a WebSocket upgrade (using the Sec-WebSocket-Key header) while the target host is specified as an IP address literal rather than a domain name, which is a common indicator of hardcoded or non-DNS-dependent C2 infrastructure.
Detects outbound HTTP GET requests to google.com that utilize a bare 'Mozilla/5.0' User-Agent header, which is indicative of the TOKYOCORE malware performing network connectivity checks. This behavior is atypical for standard browsers and can be used to identify potential beaconing activity.
Repeated TLS beacon activity to external host preceding possible CornFlake RAT C2 sync
This rule detects HTTP response bodies containing indicators associated with SourTrade malvertising campaigns, specifically JSON configuration fields and a base64-encoded Windows PE executable header (MZ/TVqQAAMAAAAEAAAA).
This rule monitors DNS queries for the domain 'veyko-service.org', which is identified as being associated with the NodeSnake RAT (Remote Access Trojan). The detection indicates potential command-and-control (C2) activity where an infected host attempts to reach a malicious infrastructure domain.
Detects HTTP POST requests to the Microsoft login endpoint for OAuth2 tokens using the client_credentials grant type, where the request body contains evidence of hardcoded client_secret parameters and specific scopes. This behavior often indicates an application or script with embedded, potentially leaked or insecurely stored, credentials being used to authenticate against Microsoft cloud services.
Detects HTTP GET requests to a known malicious endpoint attempting to download a file named 'update_ms.msi', associated with the Chaos msaRAT trojan.
BlueNoroff ClickFix - Traffic to Known-Malicious Watchlist IP
BlueNoroff ClickFix typosquatted meeting domain contacted (TLS SNI)
Detects network traffic consistent with the SleeperGem loader communicating with a Forgejo instance hosted on git.disroot.org. The detection looks for GET requests containing specific path patterns (e.g., '/git-ecosystem/', '/raw/branch/main/') and file extensions (deploy.sh or git-credential-manager), along with a 'Git' user-agent, which is characteristic of the loader's C2 retrieval activity.
Detects DNS queries matching known malicious infrastructure domains identified in SourTrade malvertising campaigns. These domains are often used by threat actors to host malicious payloads or C2 infrastructure.
This rule detects the initial WebSocket handshake request used by the INTERLOCK NodeSnake RAT for beaconing. It looks for a GET request containing a 'Sec-WebSocket-Key' header and a specific URI pattern (?v=n;) common to the RAT's communication profile.
This rule detects UDP traffic patterns characteristic of the msaRAT C2 handshake. It specifically identifies initial WebRTC DataChannel connection frames containing the 0xFE marker combined with ChaCha-Poly1305 encryption indicators within the expected packet size range.
This rule detects DNS queries for the domain 'xoredo-srv.com', which is associated with the INTERLOCK NodeSnake RAT for command and control communications.
Detects DNS queries matching the pattern used by the CAV3RN C2 infrastructure. The rule identifies specific subdomains under 'cloudlanecdn.com' that follow a structured format consistent with C2 configuration recovery and heartbeat beacons, specifically looking for a hex-encoded timestamp pattern.
Detects HTTP GET requests associated with the Blind Eagle (APT-C-36) campaign JC-46, specifically targeting GitHub for payload delivery and fetching dropper files (such as .vbs, .bat, .js, or .pif) from known command-and-control staging infrastructure.
Detection of network communications associated with the TAG-195 campaign, specifically targeting the 'ClickFix' social engineering lure. The rules identify TLS SNI, DNS queries, and HTTP requests involving known C2/staging domains 'screenly.cam' and 'xtrafftrck.net', as well as specific payload retrieval patterns for OCX files and 'curl' usage involving the infrastructure IP 70.34.205.43.
Detects network indicators related to the BlueNoroff ClickFix Kit, specifically targeting malicious TURN relay domains (edensun.xyz) used for WebRTC-based webcam exfiltration and Command and Control (C2) traffic involving Socket.IO signals that trigger malicious UI modals.
Detects network traffic indicating msaRAT behavior where a host initiates a STUN/TURN token request to a Cloudflare Workers (.workers.dev) domain. The rule identifies suspicious characteristics including spoofed Microsoft-related Origin or Referer headers and a HeadlessChrome User-Agent, commonly used by automated C2 communication.
Detects the HTTP POST exfiltration pattern used by the mrmustard stealer to send harvested credentials/host data to its C2 endpoint at metrics.femboy.energy/v1/collect.
Page 51 of 93