Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,989 detections
Filters
Last updated
All Time
Detection languages
1,774
868
397
195
188
Contributors
1,070
924
756
221
96
Categories
2,448
1,307
1,164
785
713
Platforms
2,415
1,310
658
528
133
Products / Services
1,307
886
808
561
337
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
3,989
CVEs
6
5
5
5
5
IDS Classtypes
564
275
11
8
6
IDS Protocols
537
174
64
64
12
Detects DNS lookups, TLS connections, and network traffic associated with the PoeLLM cryptominer communicating with Kryptex mining pools, as well as Stratum mining protocol login attempts.
This rule detects network communication, DNS queries, email interactions, and URL clicks associated with known TA419 threat actor infrastructure. It monitors multiple telemetry sources to identify indicators of compromise (IOCs) such as specific domains, IP addresses, and email addresses.
This rule monitors endpoint telemetry for indicators of compromise (IOCs) associated with known malicious activity. It checks for file creation, process execution, and network connections that match a defined list of malicious file hashes (SHA256, SHA1, MD5), C2 IP addresses, and malicious domains or URL patterns.
Detects repeated octet-stream POST polling of /window.rs (5+ in 20s, alerting once per window), matching the ~3s Mir0Auth session polling while the victim completes device login. SID de-duplicated from another rule.
Detects repeated octet-stream POST polling of /window.rs (5+ in 20s, alerting once per window), matching the ~3s Mir0Auth session polling while the victim completes device login. SID de-duplicated from another rule.
Detects bursts (3+ in 60s) of octet-stream POSTs to URI paths ending in .cs/.go/.rs, matching Mir0Auth XOR-obfuscated C2. Path must be a single short segment and the threshold is raised to cut noise from dev/API traffic.
Detects P7 DarkSword implant C2 beaconing: HTTP/1.0 JSON POSTs to /beacon, /event or /a with the hardcoded iPhone OS 18_5 Safari 18.5 User-Agent. Requires the full combination of protocol version, method, URI, UA and content type, and alerts only after 3 matching requests from one source within 120 seconds (detection_filter) to suppress one-off matches.
Sweeps network connection, HTTP/proxy, file, and process telemetry for exact matches against known Cling botnet indicators: dedicated STUN C2/operator IPs, Cling MIPS loader staging URLs, and known Cling sample SHA256 hashes. Tightened to exclude broad domain-level matching on stun.l.google.com (legitimate, ubiquitous Google STUN infrastructure that Cling spoofs/abuses rather than owns) and to match payload-staging hosts only by full URL rather than bare IP, reducing false positives from shared/compromised hosting and unrelated legitimate STUN traffic.
Sweeps network connection, HTTP/proxy, file, and process telemetry for exact matches against known Cling botnet indicators: dedicated STUN C2/operator IPs, Cling MIPS loader staging URLs, and known Cling sample SHA256 hashes. Tightened to exclude broad domain-level matching on stun.l.google.com (legitimate, ubiquitous Google STUN infrastructure that Cling spoofs/abuses rather than owns) and to match payload-staging hosts only by full URL rather than bare IP, reducing false positives from shared/compromised hosting and unrelated legitimate STUN traffic.
This Splunk query analyzes web logs to identify and categorize user agents, detecting various types of malware. This activity can signify possible compromised hosts on the network.
Detects a sequential pattern where a browser process (Chrome, Edge, or Safari) accesses an AI chat platform's conversation API, followed within 5 minutes by a network connection to a known unauthorized exfiltration destination (api.pbapi.xyz). This pattern suggests the potential use of a browser-based tool or extension (e.g., Poper Blocker or similar) to intercept and exfiltrate AI chat history.
Detects network communication associated with the Bear C2 framework by identifying specific beacon URI patterns (/beacon?id=<uuid>) and connections to known non-standard listener ports (4321, 8080). The rule also monitors for process command lines containing specific hardcoded identifiers associated with this C2 implant.
Detects indicators associated with the ChatGPT Custom GPT ClickFix campaign across process, network connection, DNS, and HTTP telemetry: known malicious file hashes, C2 IP addresses, the chattypetty.com domain, and known payload-hosting URLs.
Detects a multi-stage compromise sequence involving anomalous authentication followed by VPN session establishment and a burst of outbound connections from Citrix ADC/Gateway appliances. Tightened to reduce false positives from legitimate admin access, routine VPN sessions, and authorized appliance telemetry/updates.
This rule detects successful network connections to known malicious IP addresses or the domain 'forgitlab.com', which are associated with the Azazel malware threat infrastructure.
Detects a network connection handshake indicating the use of Chisel, a fast TCP/UDP tunnel over HTTP, specifically identifying potential command-and-control beaconing activity.
Detects a network connection handshake indicating the use of Chisel, a fast TCP/UDP tunnel over HTTP, specifically identifying potential command-and-control beaconing activity.
Detects a network connection handshake indicating the use of Chisel, a fast TCP/UDP tunnel over HTTP, specifically identifying potential command-and-control beaconing activity.
Detects network activity related to the 'Blinder Tunnel' C2 infrastructure. The rules identify a Chisel tunnel client initiating a WebSocket handshake (identifiable by the 'chisel-v3-channel' header) to external infrastructure and a DNS lookup for a specific domain (soroshpasargad.com) identified as a relay nameserver used by the threat actor CL-STA-1178.
Detects connections from internal hosts to the ARTEX-linked actor host 38.244.50.120, including requests for the exposed .claude/CLAUDE.md file and its open-directory port 18899.
Detects network traffic (DNS, TLS SNI, and HTTP) associated with Wazza phishkit infrastructure, specifically looking for malicious domains like boegl-krysl.eu and coppietersrecherche.eu, as well as Cloudflare workers.dev domains used for beaconing and lures.
Page 4 of 190