Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,989 detections
Filters
Last updated
All Time
Detection languages
1,774
868
397
195
188
Contributors
1,070
924
756
221
96
Categories
2,448
1,307
1,164
785
713
Platforms
2,415
1,310
658
528
133
Products / Services
1,307
886
808
561
337
MITRE Techniques
18,128
15,651
12,599
8,410
6,235
3,989
CVEs
6
5
5
5
5
IDS Classtypes
564
275
11
8
6
IDS Protocols
537
174
64
64
12
Detects DNS resolution, network connections, or email-embedded URLs matching known JWR phishing framework hosting domains and IP addresses, including banking/government/logistics brand-impersonation lookalikes and smishing-delivered typosquats.
Detects an egress transfer of 100-120KB to known ACRStealer C2 IPs (45.155.68.45, 104.21.70.245) immediately followed within 60 seconds by an ingress transfer of 4-8MB, matching the campaign's post-collection exfiltration-then-payload-ingress pattern.
Detects HTTP traffic to StopAndProtect's compromised-WordPress C2 operational endpoints, heartbeat beaconing, encrypted-archive exfiltration, and victim data directory access.
Detects network activity associated with the PureLogs Stealer, specifically connections to identified infrastructure hosting payloads on Pixeldrain and attempts to retrieve steganographic payloads via specific API endpoints.
Detects HTTP POST tasking check-ins to /version/check.php using the backdoor's hardcoded, obsolete Chrome 78.0.3904.108 user-agent string.
Detects C2Looper v1 HTTP beaconing and result reporting to hardcoded C2 IP addresses over port 8888 via the /api/beacon and /api/result endpoints.
Detects network traffic indicating potential Command and Control (C2) tasking communication via Microsoft SharePoint. The rule monitors for requests to specific SharePoint paths associated with the TWINLOOT campaign, which leverages legitimate cloud infrastructure for malicious command delivery.
Detects the JWR phishing kit's WebSocket upgrade request to its hardcoded C2 path pattern combined with a JWRCVV-format session token, identifying the framework's persistent live-operator channel.
Detects endpoint network connections to the JWR phishing framework's static WebSocket path and worker script, used to carry AES-256-CTR encrypted exfiltration payloads via the JwrCrypto module.
Detects outbound HTTP POST requests to a URI path '/api/beacon' containing a specific JSON structure ('id', 'user', 'host', 'pid'), which is characteristic of the C2Looper beaconing behavior.
Detects TLS sessions to Sapphire Sleet/UNC1069 Hostwinds C2 infrastructure presenting the exact self-signed certificate issuer string linked to the Mastra/axios campaigns.
Detects ACRStealer C2 data-transfer bursts (outbound credential-data exfiltration >100KB, inbound follow-on payload >1MB) correlated with prior credential-sweep and process-injection-stage flowbits, rather than raw transfer size alone.
This rule detects high-frequency security alerts from Zscaler ZIA indicating that a single source IP has encountered three or more distinct threat signatures within a 15-minute window. This behavior is indicative of a host engaging in malicious activity, such as automated scanning, malware communication attempts, or accessing infrastructure associated with multiple malicious categories.
Detects outbound network traffic from internal hosts to known malicious IP addresses associated with AdaptixC2 infrastructure. This rule identifies both general TCP connections and HTTP beaconing activity to these C2 servers, which are used for command and control purposes.
Detects endpoint security scanner hits indicating the presence of msaRAT malware, specifically identifying its characteristic double-layer encryption scheme (DTLS transport paired with application-layer ChaCha-Poly1305 encryption) triggered by a 0xFE handshake frame.
This rule detects potential infection by fake-VPN browser extensions associated with the 'Myxa VPN' campaign by monitoring for specific file paths and filenames linked to known malicious extension IDs. Additionally, it monitors for network connections to known command-and-control IP addresses associated with this campaign.
Detects the ACRStealer Telegram Dead Drop Resolver handoff: a non-Telegram-client TLS/SNI contact into Telegram's IP range immediately followed by a DNS/TLS/HTTP connection to the resolved C2 domain res.explicittweak.cc.
Detects HTTP requests using JWR's e-commerce integration masquerade, where a base64-encoded 's' parameter carries harvested card data or a 'cart_data' parameter resolves to a non-Shopify checkout domain used to spoof the WebSocket C2 origin.
Detects DNS queries for suspicious subdomains on known Mirage2FA phishing kit domains ('cheacker.store' and 'volatilesour.store'). The rule identifies queries where the subdomain is Base64-encoded and decodes into an email-like format, which is a technique used by this phishing kit to track or validate victim-specific session tokens or email addresses.
Detects JWR's real-time keystroke/card exfiltration by matching the hardcoded WebSocket C2 path token together with an instructionAck message containing instruction_id and cvv_id fields.
Detects HTTP requests to the JWR phishing framework's REST-based alternate C2 API surface, covering beaconing, exfiltration POSTs, CVV capture, instruction polling/acknowledgment, and device/IP fingerprint sync across five distinct endpoints.
Page 95 of 190