Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,937 detections
Filters
Last updated
All Time
Detection languages
1,930
3
2
1
1
Contributors
592
477
360
250
124
Categories
995
927
834
546
538
Platforms
1,753
214
81
54
41
Products / Services
1,868
1,144
65
51
17
MITRE Techniques
564
412
305
201
175
CVEs
4
4
4
2
2
IDS Classtypes
1,937
503
461
381
236
IDS Protocols
1,098
362
201
171
37
ET ATTACK_RESPONSE Lumma Stealer Payload Inbound
ET ATTACK_RESPONSE Observed ClickFix Landing Page Inbound
ET ATTACK_RESPONSE ClickFix CnC Response (Click Logged Successfully)
ET ATTACK_RESPONSE Unknown Payload Downloader Inbound
ET ATTACK_RESPONSE Observed ClickFix Powershell Delivery Page Inbound
ET ATTACK_RESPONSE Observed ClickFix Powershell Delivery Page (Portuguese)
This rule detects HTTP traffic where the User-Agent string contains the case-insensitive substring 'iot'. This could indicate activity from Internet of Things (IoT) devices, potentially malicious botnet activity, or other suspicious automated traffic originating from or targeting IoT devices.
ET MALWARE TA569 Middleware Server Domain in TLS SNI (cronapiworkersvc .com)
ET MALWARE Observed DNS Query to Malicious Domain (tamku .shop)
ET ATTACK_RESPONSE Likely ClickFix Related Staging Domain
ET ATTACK_RESPONSE HTML Smuggling Powershell Payload In iframe
ET MALWARE TA398 CurlBack_RAT CnC Activity - Upload Results
This rule detects HTTP traffic where the User-Agent string contains the case-insensitive substring 'iot'. This is often indicative of compromised IoT devices or botnet activity attempting to blend in or identify themselves.
ET MALWARE Observed Malicious Domain (significant-adopted-bearing-own .trycloudflare .com in TLS SNI)
ET MALWARE Observed Malicious Domain (tamku .shoplerter .opnetorologies .net in TLS SNI)
ET MALWARE Observed Malicious Domain (tamku .shop in TLS SNI)
ET ATTACK_RESPONSE Base64 Encoded Powershell Performing Byte Operations Inbound
ET ATTACK_RESPONSE Koi Loader/Stealer CnC Config Inbound
ET MALWARE TA398 CurlBack_RAT CnC Activity - Fetch Commands M2
ET ATTACK_RESPONSE Braodo Loader Inbound
ET ATTACK_RESPONSE KoiStealer Payload Inbound
Page 92 of 93