Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,989 detections
Filters
Last updated
All Time
Detection languages
1,774
868
397
195
188
Contributors
1,070
924
756
221
96
Categories
2,448
1,307
1,164
785
713
Platforms
2,415
1,310
658
528
133
Products / Services
1,307
886
808
561
337
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
3,989
CVEs
6
5
5
5
5
IDS Classtypes
564
275
11
8
6
IDS Protocols
537
174
64
64
12
This rule detects network connections and DNS queries directed towards specific malicious domains or domains matching a pattern hosted on pages.dev, a service frequently abused for hosting malicious infrastructure such as phishing pages or command-and-control beacons.
Detects a suspected malicious sequence associated with RatHat activity. The rule identifies a device fetching an injection template configuration from a remote URL, followed by the exfiltration of credentials or form data to specific API endpoints on the same device within a 15-minute window.
Detects network activity associated with the 'RatHat' Android malware, specifically identifying attempts to retrieve tunnel configuration, deployment confirmation, and the initial reverse tunnel handshake using the fatedier/frp (Fast Reverse Proxy) tool.
Detects outbound WebSocket connections from endpoints containing specific JWR phishing framework session tokens (JWRCID/JWRCVV) or known C2 path suffixes. This pattern indicates active communication with a malicious C2 server used for session hijacking or proxy-based phishing operations.
Detects network activity associated with Mirage2FA Adversary-in-the-Middle (AiTM) phishing infrastructure. The rules monitor for HTTP responses containing specific spoofed Microsoft 365 sign-in page content, DNS resolutions for known proxy-associated domain suffixes, and client requests fetching malicious loader scripts from suspected AiTM hosting infrastructure.
Detects network traffic associated with Mirage2FA Phishing-as-a-Service (PhaaS), including HTTP requests to specific URI patterns characteristic of their backend loader and DNS queries to known malicious domain families (cheecker.store and volatilesour.store), as well as direct TCP connections to identified hosting infrastructure.
Detects communication patterns associated with the OnyxC2 malware, including host-fingerprint synchronization over HTTP, potential reverse SOCKS5 proxy tunnel initialization, and inbound HTTP responses containing command tasking such as cmd.exe.
Detects network activity associated with the KREMLIN browser extension communicating with a known command and control domain (luizestrelhashapr.online). The rule monitors DNS queries, TLS SNI connections, and HTTP WebSocket upgrade requests to identify potential C2 communication.
This rule correlates a suspicious process execution (identified by specific command-line indicators), with subsequent persistence modification in Windows Registry Run/RunOnce keys, and a subsequent external network connection (excluding internal IP ranges). The activity is captured within a 15-minute window, suggesting a multi-stage attack pattern involving execution, establishing persistence, and initiating C2 communication.
This rule detects a multi-stage malicious behavior chain: the execution of a suspected loader (identified by hash or specific mutex), followed by network communication to a known C2 domain or IP, and concluded by the placement of a file in the Windows Telemetry folder (typically mimicking msedge.exe). The events are correlated within a short time window (2 hours between each stage) on the same device.
Detects browser-based network requests to 'script.google.com'. This can indicate usage of Google Apps Scripts, which are sometimes abused by attackers for Command and Control (C2) infrastructure, data exfiltration, or as a proxy for malicious payloads, by blending in with legitimate Google traffic.
Detects the GHAPPIER four-stage malware loader, specifically targeting npm-based JavaScript files. The rule identifies malicious activity through specific artifacts including hardcoded C2 URLs (vercel.app domains), campaign markers, file paths, and eval-based execution patterns.
Detects outbound network traffic from internal hosts to a known Cobalt Strike-compatible C2 server at 45.32.253.166 on port 8088. This activity is indicative of a compromised host establishing a command-and-control connection.
This rule detects malicious network traffic generated by the ClearFake malware, which uses a specific JSON-RPC 'eth_call' request to the Binance Smart Chain (BSC) testnet to retrieve C2 instructions from a designated dead-drop smart contract. This method allows the adversary to maintain persistent command and control communication by leveraging blockchain technology.
Detects outbound HTTP requests where the user-agent starts with 'PHP/' and the URI contains the path for the Admin Menu Editor Pro plugin, suggesting communication between a trojanized WordPress plugin and a remote command-and-control server.
Detects high-volume file and data access events within Microsoft 365 services (SharePoint, OneDrive, Exchange) originating from Python-based user agents (e.g., 'python-requests', 'python-httpx'). This pattern is indicative of automated scraping, data exfiltration, or bulk activity performed by unauthorized scripts.
This rule detects activities associated with the AMOS (Atomic macOS Stealer) malware family by monitoring for known malicious file hashes on endpoints and network communication with domains linked to its command-and-control infrastructure.
This rule detects activities associated with the AMOS (Atomic macOS Stealer) malware family by monitoring for known malicious file hashes on endpoints and network communication with domains linked to its command-and-control infrastructure.
Detects outbound network traffic from internal hosts to public Telegram Bot API or Slack webhooks, indicative of potential data exfiltration by the npm indexed-btree malware or similar malicious actors utilizing these services for command and control or exfiltration.
Detects potential Command and Control (C2) beaconing activity associated with Xray-core, where the TLS Server Name Indication (SNI) field is spoofed to 'dl.google.com' to masquerade malicious traffic as legitimate Google-related traffic.
This rule monitors for network connections to known malicious domains and IP addresses, as well as the presence or execution of files with specific SHA256 hashes known to be associated with threat activity. The indicators focus on Vercel-hosted domains and specific file hashes linked to recent campaign activity.
Page 49 of 190