Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
408 detections
Filters
Last updated
All Time
Detection languages
405
2
1
Contributors
144
114
48
39
36
Categories
281
276
132
105
60
Platforms
381
25
16
7
5
Products / Services
388
318
30
5
4
MITRE Techniques
174
103
44
30
28
CVEs
4
1
1
IDS Classtypes
201
121
21
19
14
IDS Protocols
2,431
868
408
324
97
Detects outbound HTTPS traffic to domains using file-sharing or cloud-sync themed keywords in combination with specific top-level domains (TLD) often associated with suspicious infrastructure. The rule specifically excludes well-known legitimate services such as OneDrive, SharePoint, Dropbox, Box, iCloud, and Google, and includes a detection threshold to minimize alerts for incidental traffic.
This rule detects established TLS connections to external hosts that utilize a specific self-signed certificate associated with TA419 phishing infrastructure. The rule specifically flags connections presenting a TLS certificate with Subject and Issuer fields containing 'C=US, ST=Kansas, L=Millsstad, O=Castro Inc, CN=CI'.
This rule detects established TLS connections to external hosts that utilize a specific self-signed certificate associated with TA419 phishing infrastructure. The rule specifically flags connections presenting a TLS certificate with Subject and Issuer fields containing 'C=US, ST=Kansas, L=Millsstad, O=Castro Inc, CN=CI'.
This rule detects established TLS connections to external hosts that utilize a specific self-signed certificate associated with TA419 phishing infrastructure. The rule specifically flags connections presenting a TLS certificate with Subject and Issuer fields containing 'C=US, ST=Kansas, L=Millsstad, O=Castro Inc, CN=CI'.
This rule detects established TLS connections to external hosts that utilize a specific self-signed certificate associated with TA419 phishing infrastructure. The rule specifically flags connections presenting a TLS certificate with Subject and Issuer fields containing 'C=US, ST=Kansas, L=Millsstad, O=Castro Inc, CN=CI'.
This rule detects established TLS connections to external domains that exhibit characteristics often associated with phishing campaigns. Specifically, it looks for domain names in the SNI field that contain common brand names (e.g., microsoft, google, paypal) combined with typical login-related keywords (e.g., login, verify, auth) on high-churn or suspicious Top-Level Domains (TLDs) such as .top, .xyz, or .icu.
Detects Heartbleed (CVE-2014-0160) exploitation attempts by monitoring for malformed TLS heartbeat requests (undersized payload) followed by oversized responses from the server that indicate potential memory disclosure.
REVSTEALER REF2859 - TLS SNI match to known lure/delivery domain
Detects network requests to the domain 'cloud-ack.workers.dev', which is known to be used as a redirector for hosting Microsoft authentication lookalike pages to conduct phishing attacks.
Detects outbound network traffic from internal hosts to the domain 'skyleen.fr' over TLS/HTTPS, which is characteristic of credential exfiltration associated with the Sckit supply chain worm.
Detects network traffic directed towards known public DNS over HTTPS (DoH) resolvers, such as Cloudflare, Google, and Quad9. Adversaries often abuse DoH to tunnel Command and Control (C2) communication, effectively blending in with legitimate web traffic to evade traditional DNS monitoring.
Detects outbound HTTPS traffic to domains using file-sharing or cloud-sync themed keywords in combination with specific top-level domains (TLD) often associated with suspicious infrastructure. The rule specifically excludes well-known legitimate services such as OneDrive, SharePoint, Dropbox, Box, iCloud, and Google, and includes a detection threshold to minimize alerts for incidental traffic.
Detects outbound HTTPS traffic to domains using file-sharing or cloud-sync themed keywords in combination with specific top-level domains (TLD) often associated with suspicious infrastructure. The rule specifically excludes well-known legitimate services such as OneDrive, SharePoint, Dropbox, Box, iCloud, and Google, and includes a detection threshold to minimize alerts for incidental traffic.
Detects network traffic associated with the BotHelper RAT communicating with its C2 domain 'easyllms.xyz'. The rule monitors for TLS SNI connections to this domain and specific HTTP API paths (/api/v1/ping, /api/v1/connect, etc.) indicative of command-and-control heartbeats and task execution.
This rule monitors outbound TLS traffic to detect communication between a potentially compromised internal host and the DeepSeek API. This behavior is associated with the 'CLOSEDQUORUM' malware family, which utilizes LLM-based voting mechanisms for command and control (C2) operations via third-party AI services.
Detects network activity associated with the NeedyMantis malware command and control (C2), including DNS queries for the domain corp.tripswithengine.com, TLS SNI identification, and specific HTTP beaconing patterns to /library/zip/ with a hardcoded user agent.
This rule detects potentially malicious Command and Control (C2) traffic utilizing DNS over HTTPS (DoH) to interact with public resolvers like Cloudflare, Google, and Quad9. It identifies both high-frequency, repeated direct-to-resolver TLS sessions and specific HTTP requests to these resolvers that resolve domains associated with known C2 infrastructure, such as the ClickFix campaign.
This rule detects established TLS connections to external domains that exhibit characteristics often associated with phishing campaigns. Specifically, it looks for domain names in the SNI field that contain common brand names (e.g., microsoft, google, paypal) combined with typical login-related keywords (e.g., login, verify, auth) on high-churn or suspicious Top-Level Domains (TLDs) such as .top, .xyz, or .icu.
Detects Heartbleed (CVE-2014-0160) exploitation attempts by monitoring for malformed TLS heartbeat requests (undersized payload) followed by oversized responses from the server that indicate potential memory disclosure.
Detects Heartbleed (CVE-2014-0160) exploitation attempts by monitoring for malformed TLS heartbeat requests (undersized payload) followed by oversized responses from the server that indicate potential memory disclosure.
Detects network requests to specific GitHub, Blogspot, and Telegram endpoints, which are known to be used by the 'VPN-for-X' extension to fetch proxy configuration files. This behavior is indicative of C2 channel configuration retrieval.
Page 2 of 20