Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
408 detections
Filters
Last updated
All Time
Detection languages
405
2
1
Contributors
144
114
48
39
36
Categories
281
276
132
105
60
Platforms
381
25
16
7
5
Products / Services
388
318
30
5
4
MITRE Techniques
174
103
44
30
28
CVEs
4
1
1
IDS Classtypes
201
121
21
19
14
IDS Protocols
2,431
868
408
324
97
ET MALWARE TA569 Middleware Server Domain in TLS SNI (parserapiprocess .com)
ET INFO Observed RMM Domain (meshcentral .com in TLS SNI)
ET MALWARE TA569 Middleware Server Domain in TLS SNI (taskrunnersrvmod .com)
ET MALWARE TA569 Gholoader CnC Domain in TLS SNI (plesk .breeconsulting .net)
ET INFO Remote Monitoring and Management (RMM) Tool in TLS SNI (gorelo .tech)
ET INFO Blockchain RPC Domain in TLS SNI (cloudflare-eth .com)
ET INFO Observed Commonly Actor Abused Cloud Hosting Service Domain (caspio .com in TLS SNI)
ET INFO Observed Commonly Actor Abused Cloud Hosting Service Domain (vercel .app in TLS SNI)
ET MALWARE TA569 Middleware Server Domain in TLS SNI (cronapiworkersvc .com)
ET INFO Blockchain RPC Domain in TLS SNI (rpc .ftm .tools)
ET INFO Blockchain RPC Domain in TLS SNI (arbitrum .one)
ET EXPLOIT_KIT LandUpdate808 Domain (virtvan .com) in TLS SNI
ET EXPLOIT_KIT LandUpdate808 Domain (edentista .com) in TLS SNI
ET EXPLOIT_KIT LandUpdate808 Domain in TLS SNI (graffetti .com)
ET EXPLOIT_KIT LandUpdate808 Domain (guiasexo .com) in TLS SNI
ET EXPLOIT_KIT ZPHP Domain in TLS SNI (fellsminjs .com)
ET EXPLOIT_KIT LandUpdate808 Domain in TLS SNI (varorg .com)
ET EXPLOIT_KIT ZPHP Domain in TLS SNI (prajsm .com)
ET INFO Observed Observed Commonly Actor Abused Online Service Domain (getenjoyment .net in TLS SNI)
ET EXPLOIT_KIT LandUpdate808 Domain (saeam .com) in TLS SNI
ET EXPLOIT_KIT LandUpdate808 Domain (dolmain .com) in TLS SNI
Page 19 of 20