Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
189 detections
Filters
Last updated
All Time
Detection languages
82
65
21
5
5
Contributors
32
28
21
20
10
Categories
62
58
53
43
38
Platforms
104
68
17
13
9
Products / Services
80
47
41
16
8
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
CVEs
2
IDS Classtypes
43
27
4
4
1
IDS Protocols
55
13
12
This rule detects network traffic indicative of an Adversary-in-the-Middle (AiTM) phishing attack targeting Microsoft 365. The rule identifies HTTP response bodies containing 'login.microsoftonline.com' and 'Enter Password' being served from a web server identified as 'openresty'. This configuration is common for phishing kits that proxy traffic between the victim and the legitimate service to harvest credentials and session cookies.
Detects network indicators associated with the Exvicy ClickFix campaign, including HTTP callbacks to embed endpoints, DNS queries for the 'cloudflare-check.net' domain, direct connections to the identified C2 IP address (94.26.90.126), and HTTP responses containing fake 'Security Check' iframe content.
Detects network activity associated with the 'ClickFix' campaign, specifically targeting the cdnsuicaches[.]com domain. The rules identify the initial DNS query, the subsequent TLS SNI connection, and the retrieval of malicious JavaScript containing the 'cookie-captcha-complete' overlay signature. This behavior is indicative of a browser-based social engineering attack.
Detects network indicators associated with 'ClickFix' social engineering campaigns. The rules identify connections to known malicious domains and IP addresses involved in serving fake CAPTCHA prompts or error-resolution instructions, as well as the delivery and subsequent transmission of specific overlay cookies ('cookie-captcha-complete') used in these attacks.
Detects browser extensions that inject hidden or invisible DOM elements (using display:none, visibility:hidden, or opacity:0) into specific AI assistant web pages (such as gemini.google.com or perplexity.ai). This behavior is characteristic of 'Prompt-Forcing' or 'BragJack' techniques, where malicious scripts attempt to smuggle unauthorized prompts into the AI's input channel through hidden fields, leading to unintended command execution.
This KQL inventories activity associated with a specified root domain and its subdomains across DeviceNetworkEvents, EmailUrlInfo, CloudAppEvents.
Detects the creation or modification of specific dropper/loader files and service worker registration within WordPress directory structures (wp-content/plugins, wp-content/themes, wp-content/uploads). These files are often associated with the injection of malicious scripts (e.g., on-chain resolvers) to facilitate drive-by compromises by site visitors.
This rule detects potential browser-based manipulation or phishing campaigns where a user visits a known loader script host (paste.sh) and subsequently visits cryptocurrency trading sites (SimpleSwap, SwapZone) within a short time window. This behavior is indicative of an injected script modifying the browser's view of trading sites to display deceptive 'Loyalty Bonus' or discount banners to lure users into transactions.
Detects network activity (HTTP, TLS SNI, and DNS) associated with the domain 'noht1ng.top', which is linked to the GRAYRABBIT malware utilized by the threat actor UNC3569.
Detects network activity (HTTP, TLS SNI, and DNS) associated with the domain 'noht1ng.top', which is linked to the GRAYRABBIT malware utilized by the threat actor UNC3569.
Detects network activity (HTTP, TLS SNI, and DNS) associated with the domain 'noht1ng.top', which is linked to the GRAYRABBIT malware utilized by the threat actor UNC3569.
Detects the creation or modification of specific dropper/loader files and service worker registration within WordPress directory structures (wp-content/plugins, wp-content/themes, wp-content/uploads). These files are often associated with the injection of malicious scripts (e.g., on-chain resolvers) to facilitate drive-by compromises by site visitors.
This rule detects potential browser-based manipulation or phishing campaigns where a user visits a known loader script host (paste.sh) and subsequently visits cryptocurrency trading sites (SimpleSwap, SwapZone) within a short time window. This behavior is indicative of an injected script modifying the browser's view of trading sites to display deceptive 'Loyalty Bonus' or discount banners to lure users into transactions.
This rule detects potential browser-based manipulation or phishing campaigns where a user visits a known loader script host (paste.sh) and subsequently visits cryptocurrency trading sites (SimpleSwap, SwapZone) within a short time window. This behavior is indicative of an injected script modifying the browser's view of trading sites to display deceptive 'Loyalty Bonus' or discount banners to lure users into transactions.
Detects evidence of malicious file tampering on public CDNs (bootcdn.net, bootcss.com, staticfile.org) associated with the Funnull campaign. The rules identify specific malicious file hashes and anomalous oversized file sizes that indicate the presence of injected malicious loaders within common JavaScript libraries.
Detects evidence of malicious file tampering on public CDNs (bootcdn.net, bootcss.com, staticfile.org) associated with the Funnull campaign. The rules identify specific malicious file hashes and anomalous oversized file sizes that indicate the presence of injected malicious loaders within common JavaScript libraries.
Detects the creation or modification of specific dropper/loader files and service worker registration within WordPress directory structures (wp-content/plugins, wp-content/themes, wp-content/uploads). These files are often associated with the injection of malicious scripts (e.g., on-chain resolvers) to facilitate drive-by compromises by site visitors.
This rule detects patterns characteristic of the ClearFake/EtherHiding campaign, specifically identifying the injection of malicious JavaScript within HTTP responses. The rule monitors for the creation of a script element and the use of base64-encoded javascript content, which is a known technique used in these attacks to facilitate drive-by compromises.
This rule detects two components of a malicious campaign using Google Sites to host fake OpenAI Codex installer lures. The first rule detects when a response body from an external server contains an iframe pointing to the domain 'bright-links.com'. The second rule detects client-side requests to Google Sites paths containing 'codex', indicating a user is navigating to the lure page.
Detects ClickFix-style clipboard/paste-and-run execution: PowerShell, PowerShell ISE, mshta, or cmd spawned from the Windows Run dialog (explorer.exe/RunMRU) with IEX/Invoke-Expression/DownloadString/FromBase64String or mshta HTTP(S) invocation, consistent with the UNC5142 ClickFix lure delivering the DeviceManager RAT.
Detects instances where Zscaler web security logs identify malware, threats, or viruses, specifically flagging users and destination hosts involved in these blocked or allowed security events.
Page 3 of 9