Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,989 detections
Filters
Last updated
All Time
Detection languages
1,774
868
397
195
188
Contributors
1,070
924
756
221
96
Categories
2,448
1,307
1,164
785
713
Platforms
2,415
1,310
658
528
133
Products / Services
1,307
886
808
561
337
MITRE Techniques
18,128
15,651
12,599
8,410
6,235
3,989
CVEs
6
5
5
5
5
IDS Classtypes
564
275
11
8
6
IDS Protocols
537
174
64
64
12
Detects country-coded lure path requests (/eg, /ma) followed by a cloaking differential response (desktop UA blocked with 404, mobile UA served content). Fixed a regex bug where the original pattern matched any path merely starting with 'eg' or 'ma' (e.g. /egg.jpg, /mail, /manifest.json) instead of the exact path segment.
Detects the Iron Man System kit's known template artifact path, and separately its randomized per-deployment admin-panel path shape combined with a Host header on a disposable TLD. Splitting these and requiring the disposable-TLD host on the generic admin-path rule avoids matching legitimate multi-tenant apps or hardened CMS installs that use similar random-path-plus-/admin/ obfuscation on ordinary domains.
Detects the Iron Man System kit's known template artifact path, and separately its randomized per-deployment admin-panel path shape combined with a Host header on a disposable TLD. Splitting these and requiring the disposable-TLD host on the generic admin-path rule avoids matching legitimate multi-tenant apps or hardened CMS installs that use similar random-path-plus-/admin/ obfuscation on ordinary domains.
This rule detects DNS queries and network connections to a curated list of domains identified as malicious. It correlates events from DNS logs and device network logs to identify potential command-and-control (C2) or malicious infrastructure interaction.
This rule detects DNS queries for the hardcoded domain 'gsx.uk.com', which is associated with the command-and-control (C2) infrastructure of BabylonRAT malware.
This rule detects DNS queries for the hardcoded domain 'gsx.uk.com', which is associated with the command-and-control (C2) infrastructure of BabylonRAT malware.
This rule detects DNS queries for the hardcoded domain 'gsx.uk.com', which is associated with the command-and-control (C2) infrastructure of BabylonRAT malware.
This rule detects DNS queries for the hardcoded domain 'gsx.uk.com', which is associated with the command-and-control (C2) infrastructure of BabylonRAT malware.
Detects instances where an Artifactory process or user accesses highly sensitive configuration files (system.yaml, join.key) or API endpoints containing configuration data, followed closely (within 15 minutes) by an outbound network connection to a non-standard or external destination. This pattern is indicative of a potential credential theft attempt targeting the Artifactory join key, which is used to authenticate Artifactory nodes in a cluster, followed by potential data exfiltration or C2 communication using these credentials.
This rule detects network traffic patterns associated with the Koktevrat Android RAT, specifically identifying periodic TLS beacons (heartbeats) destined for known C2 domains (streams-tv.lol and stream-plus.lat). The behavior suggests the use of Android's AlarmManager to schedule recurring callbacks to the C2 infrastructure.
This rule detects network traffic patterns associated with the Koktevrat Android RAT, specifically identifying periodic TLS beacons (heartbeats) destined for known C2 domains (streams-tv.lol and stream-plus.lat). The behavior suggests the use of Android's AlarmManager to schedule recurring callbacks to the C2 infrastructure.
Detects outbound network communication patterns (DNS lookups and TLS SNI traffic) associated with the Koktevrat Android RAT. The rule monitors for connections to known malicious domains used for command-and-control (C2) operations.
Detects outbound network communication patterns (DNS lookups and TLS SNI traffic) associated with the Koktevrat Android RAT. The rule monitors for connections to known malicious domains used for command-and-control (C2) operations.
Detects outbound network communication patterns (DNS lookups and TLS SNI traffic) associated with the Koktevrat Android RAT. The rule monitors for connections to known malicious domains used for command-and-control (C2) operations.
This rule detects the execution of processes associated with CLI proxy routers (such as CLIProxyAPI or router-for-me) that establish network connections to multiple AI provider APIs (e.g., Anthropic, OpenAI, Google Gemini) within a short window. This pattern is indicative of efforts to bypass rate-limiting or allowlisting mechanisms commonly used by corporate environments to control and audit AI service interactions.
Detects network connections to known command and control (C2) infrastructure, including hardcoded malicious domains, specific C2 IP addresses, and suspicious GitHub access patterns by processes other than standard web browsers, which may indicate malicious ingress tool transfer or C2 communication.
Detects outbound network traffic to the Telegram Bot API where the request body contains keywords associated with cryptocurrency wallet software (e.g., MetaMask, Phantom, Tron). This behavior is indicative of a malicious script, possibly embedded in a Google Docs sidebar or similar web-based application, exfiltrating host/browser information or wallet-related data to an attacker-controlled Telegram bot.
This rule detects network HTTP requests directed toward Google Scripts (script.google.com) or Google Docs (docs.google.com) where the referrer originates from Twitter or X. It further flags requests containing suspicious keywords like 'coindesk', 'conference', or 'hartmansdoeke', which are often associated with credential harvesting or malicious redirection campaigns leveraging trusted platforms.
Detects outbound network traffic (TCP and TLS) from internal hosts to known command and control (C2) infrastructure associated with the FamousSparrow threat actor and their SparroWocky malware suite.
Detects outbound TLS and HTTP traffic directed towards 'testing.perplexity.com', an unlocked test subdomain reportedly associated with the BragJack campaign for AI agent hijacking. This indicates potential interaction with an adversary-controlled or compromised infrastructure used to intercept or manipulate AI agent sessions.
Detects network activity (DNS queries, TLS SNI, and HTTP requests) directed towards the 'web12api.com' domain, as well as specific HTTP response structures commonly associated with adversary registration or command-and-control communication protocols.
Page 78 of 190