Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,989 detections
Filters
Last updated
All Time
Detection languages
1,774
868
397
195
188
Contributors
1,070
924
756
221
96
Categories
2,448
1,307
1,164
785
713
Platforms
2,415
1,310
658
528
133
Products / Services
1,307
886
808
561
337
MITRE Techniques
18,128
15,651
12,599
8,410
6,235
3,989
CVEs
6
5
5
5
5
IDS Classtypes
564
275
11
8
6
IDS Protocols
537
174
64
64
12
Detects network connections to JeetBot/Twitch Enhanced Viewer malicious browser extension infrastructure exfiltrating Twitch OAuth tokens. Apex domains (jeetbot.cc, api.jeetbot.cc) are gated on a token-forwarding indicator to avoid false positives.
Detects OAuth2 JWT bearer-grant token requests to Google's OAuth endpoint using the attacker-controlled service-account identity and Sheets API scope observed in the fake GlobalProtect campaign
Detects a process that has established a connection to the Telegram Bot API subsequently performing a large volume of file deletions across multiple folders within a 15-minute window. This behavior is indicative of a remote-controlled destructive attack, such as the deployment of a wiper malware (e.g., HEAVYGRAM or CHOSEN BRICK) triggered via Telegram C2 commands.
Detects outbound network traffic to the Telegram Bot API characteristic of malware command and control (C2). This rule specifically identifies Python-based requests using the 'python-requests' user agent performing common Telegram API operations (getUpdates, sendDocument, sendPhoto, getFile) typical of C2 frameworks like HEAVYGRAM or CHOSEN BRICK.
Detects network activity associated with the KREMLIN browser extension communicating with a known command and control domain (luizestrelhashapr.online). The rule monitors DNS queries, TLS SNI connections, and HTTP WebSocket upgrade requests to identify potential C2 communication.
This rule monitors network traffic for requests directed at a specific domain ('luizestrelhashapr.online') and path ('/google_api/b83fa72d.css'), which is identified in threat intelligence as an indicator of browser history exfiltration.
Detects outbound network communication from common web browsers (chrome.exe, msedge.exe) to a specific malicious domain and path associated with suspected Kremlin-linked screenshot exfiltration activities.
Detects outbound network communication from common web browsers (chrome.exe, msedge.exe) to a specific malicious domain and path associated with suspected Kremlin-linked screenshot exfiltration activities.
Detects host-based activity or network communication associated with the SloppyRAT remote access trojan. The rule monitors for specific malicious file hashes and connection attempts to known C2 IP addresses and domains.
This rule monitors HTTP POST requests for patterns indicative of armored malware (specifically StealC) beaconing to a Command and Control (C2) server. The rule looks for established connections that use POST requests while avoiding common patterns found in standard web traffic (like JSON, XML, or standard form data) and having a specific request body size threshold. The thresholding mechanism helps reduce noise by only alerting when multiple occurrences are observed within a short time frame, suggesting automated beaconing behavior.
Detects outbound HTTP POST requests to a known StealC malware command-and-control (C2) endpoint. This rule monitors for established TCP connections and HTTP traffic directed towards a specific IP address associated with malicious exfiltration activity.
Detects file hash hits matching known malicious IOCs or network connections to suspicious domains/URLs.
Detects outbound HTTP POST beaconing behavior to a known C2 IP address associated with the StealC malware and ClickFix campaign. This rule monitors for established connections to the hardcoded infrastructure used for exfiltrating data or receiving commands.
Detects network indicators associated with the StealC information stealer, including DNS lookups for identified C2 domains, HTTPS traffic to known C2 endpoints, and suspicious POST requests using multipart/form-data indicative of credential or session data exfiltration.
Detects outbound HTTP POST requests directed at a known StealC command-and-control IP address. The rule identifies suspicious beaconing behavior by looking for POST requests that lack a standard User-Agent, do not utilize common HTTP content types, and contain a request body exceeding 16 bytes, suggesting custom binary protocol usage.
Detects outbound HTTP POST requests directed at a known StealC command-and-control IP address. The rule identifies suspicious beaconing behavior by looking for POST requests that lack a standard User-Agent, do not utilize common HTTP content types, and contain a request body exceeding 16 bytes, suggesting custom binary protocol usage.
Detects anomalous network traffic patterns characterized by rapid domain rotation, where multiple distinct domains resolve to a known set of IronToll C2 infrastructure IP addresses within a short timeframe (48 hours). Added an explicit 2-day lookback window — the original query had no time bound at all, so every scheduled run re-scanned the table's entire retention period and would keep re-surfacing the same historical match indefinitely instead of only genuinely recent activity.
Detects execution patterns associated with 'NinjaMare' style malware, where a process masquerading as a browser (e.g., tenbrowser.exe, fireflybrowser.exe) performs an external IP geolocation lookup followed by suspicious registry or file modifications indicative of browser hijacking or extension installation within a five-minute window.
Detects periodic POST requests to an external endpoint containing specific request parameters (name, value, type) and a 'User-token' header, consistent with the expected beaconing intervals of the curlRAT malware (12h or 30s fast-poll).
Detects network connections from common Linux system binaries (agetty, atd, polkitd, crond) to identified suspicious external domains. These binaries typically do not communicate with external internet services, suggesting potential process masquerading or compromise.
Detects network requests to unpkg.com or npmmirror for 'index.html' files directly under a package path. This behavior deviates from standard package management usage (which typically fetches tarballs or specific JavaScript modules) and is often associated with adversaries using npm packages as hosting infrastructure for phishing landing pages.
Page 74 of 190