Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,431 detections
Filters
Last updated
All Time
Detection languages
2,428
3
Contributors
747
554
405
315
183
Categories
1,914
1,291
689
671
449
Platforms
2,202
183
149
62
49
Products / Services
2,366
1,378
38
37
25
MITRE Techniques
537
454
342
308
301
CVEs
17
10
9
9
9
IDS Classtypes
1,098
452
204
154
102
IDS Protocols
2,431
868
408
324
97
Detects a ClientKing-style beacon abusing internal proxy CONNECT authentication to reach known Jewelbug C2 infrastructure (tarotfree101.top), reusing a compromised organization's own proxy the way Jewelbug reused a major aerospace manufacturer's internal proxy.
Detects the exact watering-hole script fetch (fonts.chrorne[.]com /dist/js/*.chunk.js) injected into shared government webmail installations, which opens a WebSocket back to Jewelbug C2 and exfiltrates session cookies and usernames.
Detects the ClickFix TDS (Traffic Direction System) gate, which uses browser-based JavaScript to perform anti-analysis and anti-instrumentation checks. Specifically, it looks for the unauthorized hooking of Array.prototype.includes and the use of canPlayType as a tripwire to detect sandboxes or debuggers, correlated with signs of developer tool usage or prototype property modifications.
Network signature for the specific WebSocket/admin-API request sequence used to exploit the FortiOS/FortiProxy authentication-bypass vulnerabilities CVE-2024-55591 and CVE-2025-24472, as leveraged by Gunra ransomware affiliates for initial access.
Detects HTTP GET requests to a specific Cloudflare Workers domain ('is-01-ast.ols-img-12.workers.dev') used for msaRAT WebRTC signaling, characterized by the presence of spoofed 'Origin' and 'Referer' headers pointing to 'microsoft.com' alongside a 'HeadlessChrome' user agent, indicating malicious command-and-control behavior.
Detects outbound network connections initiated by a process identifying itself as 'HeadlessChrome' within the User-Agent string. This behavior is indicative of a headless browser being misused as a proxy for Command and Control (C2) communication, as observed in msaRAT infections.
Detects HTTP requests for fingerprinted JavaScript/CSS assets shared across UNC6671's cloned SSO and cryptocurrency vault-drainer phishing panels.
Detects HTTP requests to known UNC6671 AiTM reverse-proxy phishing kit IPs on MFA/OTP interception URI paths (push-tap, duo-push, oauth2 2fa, community verify), indicating live MFA bypass.
Detects outbound network traffic from internal hosts to domains and IP addresses identified as part of the LinX Coders infrastructure used for Mirage2FA adversary-in-the-middle (AiTM) phishing and credential harvesting campaigns.
Detects SilentDataCollector uploading AES-CBC encrypted, specifically-named archives (desktop_files, pass_V, wallet_V, filelist.zip.encrypted, documents<n>.zip) to the compromised WordPress C2.
Detects malicious heartbeat check-ins to a C2 server endpoint '/api/bot/heartbeat' by monitoring for unauthorized exfiltration of hardware identifiers (Host/Device/HW ID) or potential remote task execution via Base64-encoded instructions in the response body, characteristic of ClickFix-related infostealer campaigns targeting macOS users.
Detects HTTP outbound traffic to domains using the .sbs TLD that follow a specific 'file' followed by dictionary words naming convention, associated with the ClickFix campaign. The rule specifically identifies staging requests matching a /curl/<hex-id> URI pattern used to deliver secondary payloads.
Detects outbound HTTP POST requests associated with the ChainDrop/Shai-Hulud malware family. The rule looks for 'eth_call' JSON-RPC method calls targeting a specific Ethereum smart contract address known to be used for EtherHiding C2 infrastructure, where malicious payloads or commands are embedded within blockchain interactions.
ChainDrop Shai-Hulud npm Worm C2 beacon POST /router Bun/1.3.13 UA to npm-cache.com
Detects macOS infostealer malware using the curl utility to exfiltrate archived data (zip, tar, tgz, etc.) via multipart POST requests to specific known staging endpoints associated with the ClickFix campaign.
This rule detects suspicious outbound HTTP POST requests containing specific JSON fingerprint payloads associated with ClickFix campaigns. The fingerprint contains a mode set to 'php', typically delivered via hidden, auto-submitting forms on malicious domains to profile victims or deliver secondary payloads.
This rule detects outbound network traffic indicative of AI token jacking, where compromised API keys are utilized through unauthorized gray-market proxy platforms. It identifies requests originating from internal hosts using the specific, anomalous User-Agent string 'Go-http-client/2.0,gzip(gfe)' in conjunction with HTTP host headers associated with known AI 'transfer-station' services such as 'new-api' or 'one-api'. This signature is designed to distinguish malicious exploitation from benign Go-based service traffic, while explicitly excluding known internal service accounts to minimize false positives.
Possible O365 credential exfil via HTTP PUT to attacker-controlled S3 bucket
WhiteCobra Operation Solidity Pro - Telegram Bot API exfiltration upload
Detects outbound HTTP POST requests associated with the ChainDrop/Shai-Hulud malware family. The rule looks for 'eth_call' JSON-RPC method calls targeting a specific Ethereum smart contract address known to be used for EtherHiding C2 infrastructure, where malicious payloads or commands are embedded within blockchain interactions.
Detects a specific fingerprinting activity by the ClickFix Traffic Direction System (TDS) within HTTP POST request bodies. The rule identifies the combination of 'mode:php', a 'MacIntel' platform string (spoof-check), and WebGL rendering fields ('webglVendor', 'webglRenderer') in a JSON-encoded body, which is characteristic of the macOS ClickFix infostealer campaign delivery.
Page 54 of 116