Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
117 detections
Filters
Last updated
All Time
Detection languages
40
39
17
6
6
Contributors
26
25
18
11
6
Categories
45
39
31
19
18
Platforms
49
42
16
11
5
Products / Services
39
36
17
11
10
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
IDS Classtypes
29
8
2
1
IDS Protocols
17
14
7
1
Detects a multi-stage Wazza phishkit communication chain over HTTP, involving initial configuration retrieval, token minting, token firing, and subsequent redirection with signed tokens.
Detects a multi-stage Wazza phishkit communication chain over HTTP, involving initial configuration retrieval, token minting, token firing, and subsequent redirection with signed tokens.
Detects outbound network connections (HTTPS/TLS) to known malicious domains used by TA419 for AitM (Adversary-in-the-Middle) phishing campaigns. These domains are identified as part of a spoofed OneDrive document/file sharing theme intended to steal user credentials.
Detects outbound network connections (HTTPS/TLS) to known malicious domains used by TA419 for AitM (Adversary-in-the-Middle) phishing campaigns. These domains are identified as part of a spoofed OneDrive document/file sharing theme intended to steal user credentials.
Detects outbound network connections (HTTPS/TLS) to known malicious domains used by TA419 for AitM (Adversary-in-the-Middle) phishing campaigns. These domains are identified as part of a spoofed OneDrive document/file sharing theme intended to steal user credentials.
Detects a multi-stage Wazza phishkit communication chain over HTTP, involving initial configuration retrieval, token minting, token firing, and subsequent redirection with signed tokens.
Detects outbound network connections (HTTPS/TLS) to known malicious domains used by TA419 for AitM (Adversary-in-the-Middle) phishing campaigns. These domains are identified as part of a spoofed OneDrive document/file sharing theme intended to steal user credentials.
This rule detects established TLS connections to external hosts that utilize a specific self-signed certificate associated with TA419 phishing infrastructure. The rule specifically flags connections presenting a TLS certificate with Subject and Issuer fields containing 'C=US, ST=Kansas, L=Millsstad, O=Castro Inc, CN=CI'.
This rule detects established TLS connections to external hosts that utilize a specific self-signed certificate associated with TA419 phishing infrastructure. The rule specifically flags connections presenting a TLS certificate with Subject and Issuer fields containing 'C=US, ST=Kansas, L=Millsstad, O=Castro Inc, CN=CI'.
This rule detects established TLS connections to external hosts that utilize a specific self-signed certificate associated with TA419 phishing infrastructure. The rule specifically flags connections presenting a TLS certificate with Subject and Issuer fields containing 'C=US, ST=Kansas, L=Millsstad, O=Castro Inc, CN=CI'.
This rule detects established TLS connections to external hosts that utilize a specific self-signed certificate associated with TA419 phishing infrastructure. The rule specifically flags connections presenting a TLS certificate with Subject and Issuer fields containing 'C=US, ST=Kansas, L=Millsstad, O=Castro Inc, CN=CI'.
Detects network traffic attempting to connect to known proxy farm fallback hostnames using TLS SNI or HTTP CONNECT methods. These hostnames are often associated with command-and-control infrastructure designed to proxy traffic and mask the true destination of communications.
Detects Neo-reGeorg tunnel.jsp/tunnel.jspx servlets used by UNC6240 to establish SOCKS5-over-HTTP(S) tunneling from compromised PeopleSoft PSEMHUB.war hosts
Detects Neo-reGeorg tunnel.jsp/tunnel.jspx servlets used by UNC6240 to establish SOCKS5-over-HTTP(S) tunneling from compromised PeopleSoft PSEMHUB.war hosts
Detects Neo-reGeorg tunnel.jsp/tunnel.jspx servlets used by UNC6240 to establish SOCKS5-over-HTTP(S) tunneling from compromised PeopleSoft PSEMHUB.war hosts
Detects Neo-reGeorg tunnel.jsp/tunnel.jspx servlets used by UNC6240 to establish SOCKS5-over-HTTP(S) tunneling from compromised PeopleSoft PSEMHUB.war hosts
Detects network activity associated with the RatHat Android malware, specifically focusing on its use of WebSocket-based FRP (Fast Reverse Proxy) tunnels for command and control, session initialization, configuration retrieval, and local loopback proxy communication.
Detects network activity associated with Adversary-in-the-Middle (AiTM) phishing kits that perform client-side fingerprinting and geolocation tracking. The rules identify the initial fingerprinting request, the subsequent setting of a geolocation cookie by the proxy, and the query to a third-party geolocation service, using state tracking to correlate the chain of events.
Detects Azure AD sign-in events indicative of a session token replay attack. The rule identifies successful sign-ins where the traffic source originates from known residential proxy infrastructure (anonymizing services often used by attackers) and the authentication process lacks a fresh interactive MFA challenge, suggesting the use of a stolen, valid session token.
Detects outbound network traffic, including DNS lookups, TLS connections, and HTTP requests, directed towards IPRoyal or LightningProxies. These services are commonly used as residential or datacenter proxies and may be leveraged by adversaries for command-and-control (C2) communication, including traffic tunneling for services like Telegram.
Flags individual authentication events against services WaterPlum/North Korean IT worker operations are known to touch (laptop-farm remote-access tooling, freelance/crowdsourcing platforms, job-application and recruitment portals). This rule matches on a SINGLE qualifying event and does not itself prove IP reuse across contexts -- this Sigma dialect has no native cross-event correlation construct, so confirming that the SAME source IP appears across two or more of these categories (the actual WaterPlum indicator reported by investigators) requires a downstream correlation search, SOAR playbook, or UEBA rule that groups these flagged events by SourceIp over a rolling window.
Page 1 of 6