Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,989 detections
Filters
Last updated
All Time
Detection languages
1,774
868
397
195
188
Contributors
1,070
924
756
221
96
Categories
2,448
1,307
1,164
785
713
Platforms
2,415
1,310
658
528
133
Products / Services
1,307
886
808
561
337
MITRE Techniques
18,128
15,651
12,599
8,410
6,235
3,989
CVEs
6
5
5
5
5
IDS Classtypes
564
275
11
8
6
IDS Protocols
537
174
64
64
12
This rule monitors for network connections to known malicious domains and IP addresses, as well as the presence or execution of files with specific SHA256 hashes known to be associated with threat activity. The indicators focus on Vercel-hosted domains and specific file hashes linked to recent campaign activity.
Detects outbound HTTP requests to the Telegram Bot API containing hardcoded bot tokens and chat IDs associated with the malicious 'indexed-btree' npm package campaign. This indicates active data exfiltration or command-and-control communication.
This rule detects potential Xray-core command-and-control (C2) activity where a client initiates a TLS connection using 'dl.google.com' as the Server Name Indication (SNI) but connects to a destination IP address that does not belong to Google's infrastructure. This technique is often used to mask C2 traffic as legitimate traffic to Google services.
Detects HTTP requests directed at the 'noah-ssh.com.cn' domain targeting '/api.php' with a specific 13-digit millisecond timestamp pattern. This behavior is indicative of a relay or dispatcher mechanism associated with SilverFox SEO poisoning campaigns, used to manage or redirect traffic.
Detects suspicious network traffic to Ethereum Sepolia testnet RPC endpoints (Alchemy and Infura) indicative of the 'indexed-btree' malware campaign. The rule monitors for characteristic C2 polling patterns, specifically requests involving malicious contract addresses and specific RPC methods (eth_call, eth_getStorageAt) associated with this activity.
Detects outbound TLS traffic behavior consistent with the WaterPlum RAT, characterized by periodic, low-volume connections to non-CDN/cloud providers. The rule identifies potential beaconing activity by monitoring TLS SNI fields against a list of known legitimate service providers and applying a frequency threshold.
Detects outbound TLS traffic behavior consistent with the WaterPlum RAT, characterized by periodic, low-volume connections to non-CDN/cloud providers. The rule identifies potential beaconing activity by monitoring TLS SNI fields against a list of known legitimate service providers and applying a frequency threshold.
Detects outbound TLS traffic behavior consistent with the WaterPlum RAT, characterized by periodic, low-volume connections to non-CDN/cloud providers. The rule identifies potential beaconing activity by monitoring TLS SNI fields against a list of known legitimate service providers and applying a frequency threshold.
This rule detects activity related to specific known fabricated news infrastructure domains and associated social media handles, which are indicative of influence operations. It monitors network connection events, email URL clicks, email communication patterns involving these domains, and process executions that reference these specific accounts or handles.
This rule monitors for network and email activity associated with known fraudulent AI reseller infrastructure. It aggregates data from device network connections, email URL inspections, and email header analysis to identify potential interactions with malicious domains known to facilitate AI-related fraud.
Detects network activity or command line parameters initiated by the Jarte text processor (Jarte.exe or GRrte.exe) originating from a JartePortable directory, indicating potential C2 activity involving the domain 'castanaksa.com' or the IP address '192.64.119.189'.
Detects outbound HTTP POST requests to known public Ethereum RPC gateways (Alchemy and Infura) containing embedded, hardcoded API keys or references to specific contract addresses associated with the 'indexed-btree' malware campaign. This pattern indicates a compromised host leveraging legitimate Web3 infrastructure for Command and Control (C2) communication.
This rule detects network connections to known command-and-control (C2) infrastructure associated with the KREMLIN browser extension. The extension exfiltrates browser data (cookies, sessionStorage, localStorage) by masquerading data transfer within requests to .css files hosted on the attacker-controlled domain 'luizestrelhashapr.online'.
Detects network activity and HTTP request headers associated with the GhostCode phishing kit. The rule identifies specific URI patterns, custom site keys, malicious User-Agent strings, and session cookie artifacts indicative of interaction with a phishing server.
This rule detects outbound network communications (TLS, MQTT, and HTTP) to HiveMQ infrastructure. The pattern of activity suggests the presence of 'Bird Agent' malware utilizing the MQTT protocol for command and control (C2) communication, as well as periodic HTTP beaconing to HiveMQ broker endpoints.
Detects Python scripts that exhibit behavioral characteristics of agentic or LLM-generated malicious code. This is identified by the presence of self-narrating comments describing intent, next steps, or staging/exfiltration actions, combined with hardcoded indicators for the JADEPUFFER staging infrastructure.
This rule detects outbound network connections from internal devices to a list of known malicious IP addresses associated with adversary command and control infrastructure. The rule specifically monitors connections over common ports, potentially indicating established communication with malicious servers.
Detects specific malformed HTTP request patterns associated with the Casbaneiro (Metamorfo) banking trojan. The rules identify suspicious beaconing attempts, including specific URI structures ('/$p', '/$or?u=') and malformed headers (missing Host header combined with specific Content-Length anomalies).
Detects network communication associated with the Casbaneiro (Metamorfo) banking trojan, specifically identifying DNS queries, TLS SNI headers, HTTP Host headers, and direct IP connections to known malicious C2 infrastructure.
Detects network communication associated with the Casbaneiro (Metamorfo) banking trojan, specifically identifying DNS queries, TLS SNI headers, HTTP Host headers, and direct IP connections to known malicious C2 infrastructure.
This rule monitors endpoint telemetry for known indicators of compromise associated with the Casbaneiro/Ousaban banking trojan. It identifies activity across network connections (IPs and domain patterns), DNS queries for specific C2 domains, and the presence or execution of known malicious file hashes (e.g., PDF lures, HTA, AutoIt scripts, and payload binaries).
Page 57 of 190