Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,989 detections
Filters
Last updated
All Time
Detection languages
1,774
868
397
195
188
Contributors
1,070
924
756
221
96
Categories
2,448
1,307
1,164
785
713
Platforms
2,415
1,310
658
528
133
Products / Services
1,307
886
808
561
337
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
3,989
CVEs
6
5
5
5
5
IDS Classtypes
564
275
11
8
6
IDS Protocols
537
174
64
64
12
Detects sustained WebSocket connections to known C2 infrastructure associated with the JWR phishing framework. The rule identifies long-running sessions or frequent reconnection patterns characteristic of a live human operator interacting with a victim, as opposed to automated, one-time form submissions.
Detects the AnonyMousKIT vishing activity pattern by monitoring Twilio API call creation events followed by specific status or gather webhook callbacks from the same host within a one-hour window, consistent with automated voice phishing to collect DTMF-entered passcodes.
Detects HTTP beaconing activity characteristic of the OnyxC2 stealer malware, specifically identifying the synchronization command ('action=sync') containing hardcoded parameters for host identification and bot versioning.
Detects network activity associated with the GhostCode kit's bot-filter challenge, which performs session token/hash chaining prior to a device-code phishing redirect. The rule monitors for specific URL patterns containing 'check=1' and a session identifier, coupled with a mandatory 'js_enabled=1' cookie, commonly used to filter automated security scanners and verify bot activity before serving malicious content.
Detects indicators associated with the exploitation of CVE-2025-3248 in Langflow. The rule identifies anomalous web requests targeting the /api/v1/validate/code endpoint, subsequent suspicious process creation (base64 encoded payloads in Python/shell), and network communication with identified command and control (C2) or data exfiltration IP addresses. It also includes alerts for observed contact with known extortion email addresses.
Detects indicators associated with the exploitation of CVE-2025-3248 in Langflow. The rule identifies anomalous web requests targeting the /api/v1/validate/code endpoint, subsequent suspicious process creation (base64 encoded payloads in Python/shell), and network communication with identified command and control (C2) or data exfiltration IP addresses. It also includes alerts for observed contact with known extortion email addresses.
This rule detects devices that have both accessed a specific suspicious external domain ('thefatshallot.com') and performed file operations involving HTML files or files containing 'chromecache' in their name within the same 24-hour period. This behavior pattern suggests a potential download of malicious web content or drive-by-download attempt where browser cache files are utilized for file staging or persistence.
Detects network traffic patterns indicative of adversary-in-the-middle (AiTM) phishing infrastructure. The rule identifies suspicious TLS Server Name Indication (SNI) strings matching common SaaS login portals (Microsoft, Okta, Google) paired with SSL/TLS certificates issued by 'Let's Encrypt' that contain suspicious subject names, suggesting a freshly generated infrastructure for credential harvesting.
Detects outbound TCP traffic originating from internal hosts to known command and control infrastructure associated with the SilkParasite campaign and the SpiceRAT malware family.
Detects outbound TCP traffic originating from internal hosts to known command and control infrastructure associated with the SilkParasite campaign and the SpiceRAT malware family.
Detects network activity (DNS, HTTP, and direct IP connections) associated with known command-and-control infrastructure shared by SpiceRAT, NodeEdgeRAT, and NomadRAT malware, identified as part of the SilkParasite campaign.
This rule monitors for execution of suspicious files or processes and network communication associated with known malicious indicators (hashes, domains, and IP addresses) typically used by specific threat actors for command and control (C2) and payload delivery.
Detects suspicious PowerShell command lines that utilize both 'Invoke-Expression' (iex) and 'Invoke-RestMethod' (irm), often used to download and execute code directly from remote sources. The rule specifically monitors for known indicators like specific IP addresses, file paths, or the concurrent use of these cmdlets in a single command line.
This rule detects the presence of compiled Python 3.10 bytecode (.pyc) files that have been renamed to or disguised with a .cat extension. It specifically looks for the 'settingenv.cat' file associated with the Chinotto backdoor, as well as associated C2 URL patterns or command-line artifacts indicative of its download and execution chain.
Detects outbound network traffic attempting to interact with a specific Polygon smart contract address using eth_call. This behavior is indicative of the EtherHiding technique, where adversaries leverage blockchain infrastructure as a dead-drop resolver for command-and-control (C2) operations to bypass traditional network defenses.
Detects the execution of PowerShell scripts that use Invoke-Expression and Invoke-RestMethod in combination with specific suspicious domains, file extensions, or indicators of web-based payload retrieval. This pattern is commonly used for staging and executing malicious payloads directly from the internet.
This rule monitors network, file, and process telemetry for matches against a predefined list of malicious IP addresses, domain names, and file hashes. It flags suspicious network connections to known C2 infrastructure and the presence or execution of known malicious files based on SHA256 and SHA1 indicators.
This rule monitors network, file, and process telemetry for matches against a predefined list of malicious IP addresses, domain names, and file hashes. It flags suspicious network connections to known C2 infrastructure and the presence or execution of known malicious files based on SHA256 and SHA1 indicators.
This rule monitors network, file, and process telemetry for matches against a predefined list of malicious IP addresses, domain names, and file hashes. It flags suspicious network connections to known C2 infrastructure and the presence or execution of known malicious files based on SHA256 and SHA1 indicators.
This rule monitors network, file, and process telemetry for matches against a predefined list of malicious IP addresses, domain names, and file hashes. It flags suspicious network connections to known C2 infrastructure and the presence or execution of known malicious files based on SHA256 and SHA1 indicators.
This rule detects network connections and DNS queries directed towards specific malicious domains or domains matching a pattern hosted on pages.dev, a service frequently abused for hosting malicious infrastructure such as phishing pages or command-and-control beacons.
Page 41 of 190