Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,989 detections
Filters
Last updated
All Time
Detection languages
1,774
868
397
195
188
Contributors
1,070
924
756
221
96
Categories
2,448
1,307
1,164
785
713
Platforms
2,415
1,310
658
528
133
Products / Services
1,307
886
808
561
337
MITRE Techniques
18,128
15,651
12,599
8,410
6,235
3,989
CVEs
6
5
5
5
5
IDS Classtypes
564
275
11
8
6
IDS Protocols
537
174
64
64
12
Detects network connections to command-and-control infrastructure associated with the JeetBot/Twitch Enhanced Viewer malicious browser extension. The rule triggers on connections to known malicious domains or IPs, as well as specific API endpoints on ambiguous domains that are used for exfiltrating Twitch OAuth tokens.
Detects network connections to command-and-control infrastructure associated with the JeetBot/Twitch Enhanced Viewer malicious browser extension. The rule triggers on connections to known malicious domains or IPs, as well as specific API endpoints on ambiguous domains that are used for exfiltrating Twitch OAuth tokens.
Detects network connections to command-and-control infrastructure associated with the JeetBot/Twitch Enhanced Viewer malicious browser extension. The rule triggers on connections to known malicious domains or IPs, as well as specific API endpoints on ambiguous domains that are used for exfiltrating Twitch OAuth tokens.
Detects network connections to JeetBot/Twitch Enhanced Viewer malicious browser extension infrastructure exfiltrating Twitch OAuth tokens. Apex domains (jeetbot.cc, api.jeetbot.cc) are gated on a token-forwarding indicator to avoid false positives.
This rule detects potential web skimmer activity where a user's browser performs a network connection to known payload delivery hosts (e.g., paste.sh or Google Sheets API) followed by a clipboard modification event on the same device within a one-hour window. This behavior is consistent with malicious scripts attempting to replace copied cryptocurrency wallet addresses with an attacker-controlled address.
Detects browser-based network requests to the Google Sheets Visualization API (gviz/tq) that appear to be used for fetching malicious JavaScript payloads from public Google Sheets. The rule specifically identifies instances where a process initiates these requests without any corresponding active browser session associated with standard Google Docs or Sheets editing activity.
Detects browser-based network requests to the Google Sheets Visualization API (gviz/tq) that appear to be used for fetching malicious JavaScript payloads from public Google Sheets. The rule specifically identifies instances where a process initiates these requests without any corresponding active browser session associated with standard Google Docs or Sheets editing activity.
This rule detects activity associated with known indicators of compromise (IOCs) related to European political targeting campaigns. It monitors network, email, and authentication logs for connections to specific malicious domains (including .onion addresses) and IP addresses. The rule spans multiple data sources, including device network events, Entra ID sign-in logs, cloud application events, and email communications.
Detects network communication to known malicious infrastructure associated with the GRAYRABBIT malware campaign. The rule correlates TCP connections on port 443 to the domain 'mail.uaiubifas.top' with process events attempting to discover system and user information (GetAdaptersAddresses, gethostname, GetUserNameA), which is characteristic of the malware's initial beaconing behavior.
Detects network communication to known malicious infrastructure associated with the GRAYRABBIT malware campaign. The rule correlates TCP connections on port 443 to the domain 'mail.uaiubifas.top' with process events attempting to discover system and user information (GetAdaptersAddresses, gethostname, GetUserNameA), which is characteristic of the malware's initial beaconing behavior.
Detects network traffic associated with SloppyRAT C2 beacons by identifying specific user-agent strings ('CommandExecutor/1.0', 'Mozilla/5.0 (compatible; DLLMemLoader/1.0)') or anomalous API path requests containing 'X-API-Key' or 'Authorization: Bearer' headers.
Detects an HTTP POST request targeting the host 'tt.yeyoujs.com' at the URI path '/api/agent/enroll', containing a specific Python aiohttp User-Agent string. This pattern is characteristic of a C2 agent attempting to register or enroll with an external command-and-control server.
Detects Adblock.dll used by Docro Hijacker to bypass Chrome Secure Preferences HMAC-SHA256 integrity checks and register infected browser UUID via vendralo[.]info
Detects Adblock.dll used by Docro Hijacker to bypass Chrome Secure Preferences HMAC-SHA256 integrity checks and register infected browser UUID via vendralo[.]info
Detects HVNC final payload masquerading as Windows Update Assistant, combining Firefox credential theft strings, hardcoded AV process names, and XOR-encoded C2 host configuration
Detects the download of ZIP files with filenames matching known phishing patterns associated with NFe (Nota Fiscal Eletrônica) campaigns, correlated with access to specific malicious or suspicious download URLs within a 15-minute window.
Detects outbound HTTP POST requests to suspicious .ru domains and DNS queries for these domains, indicative of C2 beaconing activity likely associated with a supply chain compromise affecting the Pub.dev ecosystem.
Detects specific outbound HTTP POST requests to a known Amatera Stealer command and control domain. The rule looks for the unique URI path '/T.@w' and a specific 'Command: GetEndpoints' header structure commonly used by this malware family to beacon to its C2 infrastructure.
Detects specific outbound HTTP POST requests to a known Amatera Stealer command and control domain. The rule looks for the unique URI path '/T.@w' and a specific 'Command: GetEndpoints' header structure commonly used by this malware family to beacon to its C2 infrastructure.
Detects network communication to Firebase infrastructure (.firebaseio.com) initiated by Android devices, which may indicate command-and-control (C2) activity associated with the Mantax Otax malware family. This rule tracks initial connections and should be correlated with specific suspicious domains for higher confidence.
Detects repeated manual HTTP GET requests from many distinct source IPs to a canary token resource. The URI pattern follows a format indicative of a tracked canary token resource, and the threshold of 49 unique source IPs accessing the resource within a prolonged period suggests potential unauthorized reconnaissance or probing activities.
Page 85 of 190