Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
38 detections
Filters
Last updated
All Time
Detection languages
38
Contributors
16
6
5
5
3
Categories
28
23
14
11
6
Platforms
35
1
1
Products / Services
35
27
6
1
MITRE Techniques
12
12
7
6
6
CVEs
1
1
1
IDS Classtypes
23
6
4
2
2
IDS Protocols
2,431
868
408
324
97
38
Detects inbound network traffic originating from IP addresses known to be associated with an exploit campaign targeting the Super Forms plugin (CVE-2026-14894). The rule acts as an indicator of compromise (IoC) match for potential exploitation attempts directed at internal network infrastructure.
Detects inbound network traffic originating from IP addresses known to be associated with exploitation attempts targeting the Elementor Pro CVE-2026-32475 vulnerability. This rule monitors for connections to internal network assets from these identified threat actor sources.
Detects inbound network connections from known IP addresses associated with the StyleSmuggler malware distribution, which is used to inject malicious scripts into web applications.
Network signature matching known Gunra C2 IP addresses, the datapub.news leak/paste domain, and Gunra-associated .onion leak/negotiation sites.
This rule detects sustained network communication (at least 5 connections within a 300-second window) between internal hosts and a specific list of IP addresses identified by Unit 42 as malicious infrastructure used for AI token jacking. These servers operate as transfer stations, likely utilizing platforms like new-api or one-api to facilitate the illicit resale of stolen frontier-AI API keys. The rule incorporates an exclusion for internal security scanning and proxy infrastructure to minimize false positives, and it is specifically designed to flag exfiltration or unauthorized API usage patterns associated with stolen credentials (T1539) and potential proxy-based obfuscation of command and control or data relay (T1090).
Network traffic to Aeza Group bulletproof-hosting IP (loader/payload delivery)
BlueNoroff ClickFix - Traffic to Known-Malicious Watchlist IP
This rule detects network traffic originating from the internal network directed towards a hardcoded IP address associated with the CrashStealer malware. The rule flags outbound traffic to this specific destination, which is indicative of command and control communication or data exfiltration.
Detects outbound network traffic from internal hosts to known IP addresses associated with AnyDesk relay infrastructure, which may indicate unauthorized use of remote access tools.
Detects outbound network traffic originating from internal assets destined for IP addresses identified as Command and Control (C2) infrastructure associated with the UAT-7810 threat actor group.
Detects outbound network communication to an IP address (64.20.53.230) identified as a staging server associated with the JadePuffer activity. This activity involves potential data exfiltration following self-narrated deletion payloads.
This rule detects NAT traversal attempts using GRE (Generic Routing Encapsulation) protocol. It specifically looks for IP packets with protocol number 47 (GRE) and triggers an alert if 5 such packets are observed from the same source IP within a 30-second window. This could indicate an attempt to bypass network address translation or firewalls.
This rule detects the presence of GRE (Generic Routing Encapsulation) tunnel traffic (IP protocol 47) originating from any source IP address to the local network. It triggers an alert if three such GRE packets are observed from the same source within a 60-second window. This could indicate an attempt to establish a GRE tunnel, potentially for defense evasion or to bypass network security controls.
This rule detects Address Resolution Protocol (ARP) poisoning attempts on a network segment, specifically looking for ARP reply packets (opcode 2). It uses a thresholding mechanism to trigger an alert if 10 such packets are observed from the same source within a 5-second window, indicating a potential malicious ARP spoofing activity.
This rule detects Address Resolution Protocol (ARP) spoofing attempts by looking for ARP reply packets (opcode 2) on the network. A threshold is applied to trigger an alert if 20 or more ARP replies are observed from the same source within a 10-second window, which is indicative of malicious ARP activity.
This rule detects Address Resolution Protocol (ARP) announcements from new or unknown devices on the network. Specifically, it looks for ARP packets with an opcode of '2', which signifies an ARP reply. The rule uses a threshold to trigger an alert if a new ARP reply is observed from a source within a 5-second window, indicating a potential new device joining the network or an attempt at ARP spoofing.
ET TROJAN Microsoft ClickFix IOC IP
Page 2 of 2