Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
189 detections
Filters
Last updated
All Time
Detection languages
82
65
21
5
5
Contributors
32
28
21
20
10
Categories
62
58
53
43
38
Platforms
104
68
17
13
9
Products / Services
80
47
41
16
8
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
CVEs
2
IDS Classtypes
43
27
4
4
1
IDS Protocols
55
13
12
Detects web requests for specific JavaScript file names that are part of the DarkSword iOS exploit chain. The presence of these requests strongly suggests a device is being targeted with the exploit kit.
Detects the JavaScript XOR-based string reconstruction pattern used by the Coruna iOS exploit kit. This pattern maps an array of integers through String.fromCharCode with XOR to reconstruct code at runtime. Coruna contained 23 iOS exploits targeting iOS 13.0 through 17.2.1 and was used by UNC6353 (Russian espionage) and UNC6691 (Chinese financially motivated).
Detects network connections to known command-and-control (C2) and distribution domains associated with the Coruna exploit kit campaigns. This includes the domain used in the Ukrainian campaign by UNC6353 and the larger set from the financially motivated UNC6691 group.
Hunts for the specific UNC5142 EtherHiding/CLEARSHORT JavaScript patterns and BSC contract addresses published in the referenced report. This is a high-fidelity content match that is intended for scanning suspicious HTML/JS blobs recovered from compromised web content, web proxies that store bodies, or forensic collections.
This query detects network traffic and file events associated with the "AiFrame" malicious browser extension campaign. These extensions pose as AI assistants but exfiltrate user data via remotely controlled iframes.
This rule detects post-social-engineering activity where adversaries trick users into pasting malicious commands into the Windows Run dialog (Win+R). The command is recorded in the RunMRU registry key and typically abuses nslookup.exe to perform DNS lookups against rogue servers that return encoded payloads in the "Name" field of the DNS response. The rule identifies the exact command injected via ClickFix lures, enriches the result with the active user session at the time of execution, and provides a risk score based on the severity of the indicators found. It specifically looks for suspicious RunMRU events with commands longer than 50 characters, excluding common legitimate paths. Detection indicators include obfuscated nslookup using carets, nslookup with hardcoded external DNS server IPs, payload execution via `cmd` and `echo` or `for /f`, registry tampering related to UAC/security policies, and execution of Living Off The Land Binaries (LOLBins) such as `powershell`, `mshta`, `wscript`, `cscript`, `certutil`, `rundll32`, `regsvr32`, `msiexec`, `wmic`, or `bitsadmin`.
Detects JavaScript-based drive-by compromise execution
This is for when we need to investigate user navigation through proxy logs to understand if visit was intentional or if it was a sideload (redirect/iframe/malvertising) causing the navigation.
This query identifies URL access attempts that were blocked by CATO Networks security policies, based on logs in CommonSecurityLog. It allows for filtering by specific devices or target URLs.
Detects network connections to domains identified as part of the IClickFix redirection infrastructure. These domains host the initial JavaScript payloads or act as part of the Traffic Distribution System (TDS).
Detects executable files with names containing PDF-related keywords (e.g., 'pdf', 'convert', 'editor') being dropped in the Downloads folder by a web browser process. This behavior is typical of users downloading potentially unwanted or malicious PDF converters, often delivered via SEO poisoning or malvertising campaigns.
This rule detects the presence and activity of the ShadyPanda malware campaign, specifically focusing on malicious Chrome extensions and their associated command and control (C2) and data exfiltration domains. It identifies the creation of files with known malicious Chrome extension IDs (ending in '.crx') and network connections to hardcoded C2 and exfiltration domains linked to the ShadyPanda campaign.
This rule detects the presence and activity of the ShadyPanda malware campaign, specifically focusing on malicious Chrome extensions and their associated command and control (C2) and data exfiltration domains. It identifies the creation of files with known malicious Chrome extension IDs (ending in '.crx') and network connections to hardcoded C2 and exfiltration domains linked to the ShadyPanda campaign.
This rule detects network connections to or DNS requests for known malicious IP addresses and domains associated with phishing campaigns. The domains often mimic legitimate services like Zoom, Microsoft, and Google, indicating potential credential harvesting or malware distribution attempts.
Extremely basic & rough KQL for the purpose of finding if these extension id's are in any folders across your estate.
Detects indicators associated with a watering hole attack originating from a compromised xubuntu.org website. This includes the creation of a tampered 'tos.txt' file, the dropping and execution of a trojanized dropper ('elzvcf.exe') in AppData\Roaming, and the establishment of persistence via a registry Run key.
Detects XSS attempts injected via GET requests in access logs
This rule detects inbound network traffic attempting to exploit a path traversal vulnerability (CVE-2025-8088) related to RAR files and Alternate Data Streams (ADS). The detection logic specifically looks for a pattern indicative of path traversal attempts within the RAR file structure over raw TCP connections, excluding HTTP traffic. This exploit could allow an attacker to write files to arbitrary locations on a compromised system.
This rule detects an attempt to exploit a path traversal vulnerability (CVE-2025-8088) in RAR files delivered via HTTP. The exploit leverages Alternate Data Streams (ADS) and specific path traversal patterns to potentially write files outside of the intended directory. The detection is based on the presence of 'STM' in the HTTP response body and a PCRE regex matching a specific path traversal pattern.
ET EXPLOIT_KIT LandUpdate808 Domain in DNS Lookup (virtvan .com)
ET EXPLOIT_KIT LandUpdate808 Domain in DNS Lookup (saeam .com)
Page 6 of 9