Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
324 detections
Filters
Last updated
All Time
Detection languages
323
1
Contributors
86
53
49
47
46
Categories
283
117
117
70
64
Platforms
300
16
8
6
3
Products / Services
301
209
30
18
10
MITRE Techniques
113
100
86
64
33
CVEs
1
1
IDS Classtypes
171
51
43
18
14
IDS Protocols
2,431
868
408
324
97
Detects DNS A record lookups for the domain 'mail.uaiubifas.top', which is associated with GRAYRABBIT C2 activity linked to UNC3569. This domain is known to be used for command and control communications.
Detects DNS queries originating from an internal host to 'mail.uaiubifas.top', which is associated with GRAYRABBIT command-and-control (C2) activity.
Detects DNS queries originating from an internal host to 'mail.uaiubifas.top', which is associated with GRAYRABBIT command-and-control (C2) activity.
Detects DNS queries and TLS SNI traffic directed towards known phishing domains that mimic Brazilian financial and government portals, specifically targeting 'gerenciadorcaixa.digital', 'aapj.digital', and 'receitafederal.digital'.
This rule detects high-volume DNS resolution of domains ending in the .shop TLD from internal hosts, which may indicate interaction with a cluster of infrastructure used by the DoppelCart fake-shop campaign.
This rule monitors for DNS queries, HTTP requests to '/cli/check', and TLS SNI traffic directed towards the domain 'coder-infra.com', which is associated with a suspected compromise of a Coder registry.
This rule detects network traffic (DNS, TLS, HTTP, and TCP) originating from internal assets to known infrastructure associated with the QTFY proxy botnet/C2 framework. It identifies communication with specific C2 domains, proxy management systems, and associated malicious IP ranges.
Detects DNS queries and TLS SNI traffic originating from internal hosts directed towards a specific set of domains associated with passkey/MFA/SSO-themed vishing lures. These domains are identified as potential components of phishing campaigns designed to deceive users into disclosing authentication credentials.
Detects DNS queries and TLS SNI traffic directed towards known phishing domains that mimic Brazilian financial and government portals, specifically targeting 'gerenciadorcaixa.digital', 'aapj.digital', and 'receitafederal.digital'.
This rule monitors for DNS queries, HTTP requests to '/cli/check', and TLS SNI traffic directed towards the domain 'coder-infra.com', which is associated with a suspected compromise of a Coder registry.
Detects DNS queries originating from an internal host to 'mail.uaiubifas.top', which is associated with GRAYRABBIT command-and-control (C2) activity.
This rule detects high-volume DNS resolution of domains ending in the .shop TLD from internal hosts, which may indicate interaction with a cluster of infrastructure used by the DoppelCart fake-shop campaign.
This rule detects high-volume DNS resolution of domains ending in the .shop TLD from internal hosts, which may indicate interaction with a cluster of infrastructure used by the DoppelCart fake-shop campaign.
Detects high-frequency DNS query responses for domains ending in '.shop' from external sources within a 10-minute window. This behavior is indicative of domain churn often associated with 'DoppelCart'-style fake e-commerce shop infrastructure.
Detects high-frequency DNS query responses for domains ending in '.shop' from external sources within a 10-minute window. This behavior is indicative of domain churn often associated with 'DoppelCart'-style fake e-commerce shop infrastructure.
Detects high-frequency DNS query responses for domains ending in '.shop' from external sources within a 10-minute window. This behavior is indicative of domain churn often associated with 'DoppelCart'-style fake e-commerce shop infrastructure.
Detects DNS queries and TLS SNI traffic originating from internal hosts directed towards a specific set of domains associated with passkey/MFA/SSO-themed vishing lures. These domains are identified as potential components of phishing campaigns designed to deceive users into disclosing authentication credentials.
Detects DNS queries for known typosquatted time-sync domains and associated UDP traffic on port 123 (NTP) utilized by the StyleSmuggler malware for command and control purposes.
Detects DNS lookups, TLS SNI headers, and HTTP Host headers associated with the known StyleSmuggler malware download domain '247.cdnflare.xyz'.
Detects DNS queries for known typosquatted time-sync domains and associated UDP traffic on port 123 (NTP) utilized by the StyleSmuggler malware for command and control purposes.
Detects DNS queries and TLS SNI traffic originating from internal hosts directed towards a specific set of domains associated with passkey/MFA/SSO-themed vishing lures. These domains are identified as potential components of phishing campaigns designed to deceive users into disclosing authentication credentials.
Page 7 of 16