Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,431 detections
Filters
Last updated
All Time
Detection languages
2,428
3
Contributors
747
554
405
315
183
Categories
1,914
1,291
689
671
449
Platforms
2,202
183
149
62
49
Products / Services
2,366
1,378
38
37
25
MITRE Techniques
537
454
342
308
301
CVEs
17
10
9
9
9
IDS Classtypes
1,098
452
204
154
102
IDS Protocols
2,431
868
408
324
97
Detects HTTP GET requests to UNC6692 Edgecution phishing landing pages hosted on S3 buckets using the 'service-page-*-outlook.s3.us-west-2.amazonaws.com' naming pattern with an 'email=' parameter and '/update.html' URI, used to lure victims into downloading the Edgecution malware suite via fake Outlook/Mailbox Repair Utility pages.
Detects payload callbacks to the Rognar Telegram-bot-linked DOUBLECUP C2 URL (hxxp://67.219.107.181/hgflssvslvidfugvbldiuv).
ChainDrop Shai-Hulud 2.0 EtherHiding C2 Domain Lookup via eth_call
Detects HTTP POST requests to an Apache Tomcat server containing a Java serialized-object header (AC ED 00 05) in a request body larger than 512 bytes, consistent with CVE-2026-34486 deserialization exploitation.
Detects HTTP GET requests for sync.dat runtime configuration files with a JSON accept header, consistent with CornFlake RAT's custom C2 protocol, excluding known legitimate cloud-sync/update CDN hosts.
ChainDrop Shai-Hulud npm Worm C2 beacon POST /router Bun/1.3.13 UA to npm-cache.com
Detects possible kernel-level WFP redirection of outbound HTTP connections to an unexpected local loopback proxy port while the original destination host header is retained, consistent with Phantom Mantis G12/G13 network redirection.
TOKYOCORE RansomAgent User-Agent HTTP Traffic to Public File Hosting Service
Detects HTTP traffic to the hardcoded Heroku-hosted SNOWGLAZE C2 endpoint (sad4w7h913-b4a57f9c36eb.herokuapp.com) where the client requests a WebSocket upgrade on the /ws URI and sends a JSON body containing login, password, and uuid fields used to authenticate the tunnel to the actor's C2 infrastructure.
Detects a phishing page's /api/config fetch used to stage ClickFix instructions, requiring a Referer indicating an impersonated CRM login page (NetSuite, Odoo, HubSpot, or Salesforce) while excluding requests to the genuine vendor domains.
Larva-24009 HeptaX C2 beacon to shared infrastructure (get-command/index/new-upload/post_proc)
AiTM Phishing - PHPSESSID Cookie with Preload Flag and Word-Number Route Token
Detects likely exfiltration of encrypted synced passkey (WebauthnCredentialSpecifics) blobs to external C2 infrastructure, correlated with a prior non-browser read of Chrome's Sync Data LevelDB store, consistent with the collection-and-exfiltration stage of a Pass-ta-key credential-theft chain. Excludes traffic destined to Google's own domains.
Detects unauthenticated WebSocket upgrade requests to a terminal/shell-related URI path or subprotocol, lacking Authorization or Cookie headers, indicative of unauthenticated web-terminal exploitation.
Detects CVE-2026-3055 Citrix NetScaler out-of-bounds memory-read exploitation via a GET request eliciting an oversized HTTP response body containing a leaked NSC_AAAC session cookie.
Detects DeviceManager DNS TXT/A tunneling traffic occurring within 60 seconds after an eth_call blockchain RPC request from the same host, consistent with DeviceManager resolving C2 via EtherHiding before tunneling.
Detects DeviceManager's EtherHiding C2 resolution: an eth_call JSON-RPC request using get_data_selector 0x1dcf296b against the known-malicious contract address 0xc027490af56a9d7050fc259ecd03da1580b84aae, excluding requests with a browser-like User-Agent.
SNOWBELT time-based DGA S3 bucket manifest retrieval
UNC6692 fake Outlook Updates Management Console phishing page served from S3
Detects network communication associated with the TOKYOCORE malware C2 infrastructure. The rule monitors for specific API endpoints (/api/victim/(log|data|command|archive)) combined with known malicious User-Agent strings (RansomAgent or fsociety/1.0), as well as suspicious multipart form data uploads that may indicate data staging or exfiltration.
CaptiveCrunch ChocoShell disguised C2 URI pattern to known Storm-2945 C2 IP (/t/event, /t/pixel.gif, polyfill payload)
Page 55 of 116