Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
324 detections
Filters
Last updated
All Time
Detection languages
323
1
Contributors
86
53
49
47
46
Categories
283
117
117
70
64
Platforms
300
16
8
6
3
Products / Services
301
209
30
18
10
MITRE Techniques
113
100
86
64
33
CVEs
1
1
IDS Classtypes
171
51
43
18
14
IDS Protocols
2,431
868
408
324
97
Detects network activity associated with the 'ClickFix' campaign, specifically targeting DNS queries, TLS SNI, HTTP Host headers, and direct IP connections to known malicious infrastructure domains (cdnsuicaches.com, mnl.ac) and exfiltration endpoints (23.227.198.199).
Detects network activity associated with the 'ClickFix' campaign, specifically targeting DNS queries, TLS SNI, HTTP Host headers, and direct IP connections to known malicious infrastructure domains (cdnsuicaches.com, mnl.ac) and exfiltration endpoints (23.227.198.199).
Detects network activity associated with the 'ClickFix' campaign, specifically targeting DNS queries, TLS SNI, HTTP Host headers, and direct IP connections to known malicious infrastructure domains (cdnsuicaches.com, mnl.ac) and exfiltration endpoints (23.227.198.199).
Detects DNS queries, TLS SNI headers, or HTTP Host headers containing patterns consistent with IT-support-themed vishing lure domains, specifically 'helpdesk-support-office-#.com'. Such domains are often used to impersonate technical support services to facilitate social engineering, credential harvesting, or malware delivery.
Detects DNS queries and TLS SNI traffic associated with known authentication-themed lure domains often used in phishing campaigns. These domains mimic multi-factor authentication (MFA) registration or SSO setup processes to deceive users into credential theft.
Detects DNS queries and TLS SNI traffic directed towards known typosquatted domains associated with the SilkParasite campaign. These domains are designed to impersonate Central Asian government, energy, and telecommunications entities to facilitate malicious activity.
Detects DNS queries and HTTP GET requests directed at known typosquatted domains associated with the APT36 (Transparent Tribe) threat group, which are utilized for payload staging and delivery.
Detects DNS queries, HTTP requests, and TLS connections associated with known APT36 (Transparent Tribe) malicious infrastructure, specifically targeting typosquatted news domains used for staging payloads.
This rule detects DNS queries and TLS SNI connections to 'devtunnels.ms'. This domain is associated with Microsoft Dev Tunnels, a service that exposes local development environments to the internet. Adversaries may abuse this legitimate service to establish reverse tunnels or proxies, enabling lateral movement and bypassing inbound network restrictions.
Detects DNS queries, TLS SNI headers, and HTTP host headers associated with identified C2 infrastructure for NetSupport Manager malware, specifically domains themed around 'GTA6'. These indicators are used by attackers for command and control communication.
Detects DNS queries, TLS SNI, and HTTP Host header traffic associated with the IronToll phishing campaign. The rule specifically monitors for government-impersonating domains and lookalike domains utilizing various non-standard top-level domains (TLDs).
Detects DNS queries and TLS SNI traffic directed towards domains identified as part of Storm-3121/Storm-3032 phishing campaigns. These domains are themed around passkey management and single sign-on (SSO) services, likely intended for credential harvesting.
Detects network activity and email headers associated with the DoppelBrand campaign. The rule monitors DNS queries for specific IOC domains (service-nowinc.com, domainlify.net) and inspects SMTP traffic for malicious MAIL FROM addresses and Reply-To headers targeting these domains.
This rule detects network traffic (DNS, TLS, HTTP, and TCP) originating from internal assets to known infrastructure associated with the QTFY proxy botnet/C2 framework. It identifies communication with specific C2 domains, proxy management systems, and associated malicious IP ranges.
This rule detects DNS queries and TLS SNI traffic directed towards identified phishing or malicious domains that mimic Passkey, Single Sign-On (SSO), or help desk authentication portals. These domains are commonly used by attackers for credential harvesting or adversary-in-the-middle (AiTM) phishing attacks targeting organizational authentication services.
This rule monitors DNS queries and TLS SNI traffic for connections to domains that appear to be performing typosquatting, specifically targeting users by impersonating SSO and Passkey service providers. These domains mimic legitimate security portals to facilitate credential harvesting.
Detects DNS lookups and TLS SNI requests to known domains associated with Storm-3121 and Storm-3032 phishing campaigns. These campaigns utilize passkey or Single Sign-On (SSO) themed lures to facilitate credential harvesting.
Detection of DNS queries, TLS SNI, and HTTP Host headers matching domains associated with Storm-3121 and Storm-3032 phishing campaigns. These campaigns mimic identity, SSO, and passkey registration processes to capture credentials or perform token theft.
Detects DNS queries and TLS SNI traffic directed towards domains identified as part of Storm-3121/Storm-3032 phishing campaigns. These domains are themed around passkey management and single sign-on (SSO) services, likely intended for credential harvesting.
This rule monitors DNS queries and HTTP traffic for indicators related to known phishing infrastructure impersonating passkey and SSO providers. The domains detected are associated with Storm-3121/3032 campaigns designed to facilitate credential or session harvesting.
Detects DNS queries and TLS SNI traffic directed towards known malicious domains associated with passkey and SSO phishing campaigns, specifically attributed to Storm-3121 and Storm-3032. These domains are used to deceive users into providing credentials or authentication tokens via fraudulent login portals.
Page 5 of 16