Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
330 detections
Filters
Last updated
All Time
Detection languages
158
115
22
15
10
Contributors
147
71
32
32
7
Categories
167
156
109
109
96
Platforms
199
104
22
21
17
Products / Services
161
150
64
56
37
MITRE Techniques
18,108
15,614
12,573
8,384
6,204
CVEs
2
IDS Classtypes
107
17
10
10
8
IDS Protocols
86
35
28
3
1
Detects DNS/TLS/IP traffic to known CaptiveCrunch AitM doppelganger domains and C2/redirect IP infrastructure via exact-match indicators.
This rule detects DNS queries, HTTP Host headers, and TLS SNI values indicative of interaction with specific doppelganger domains designed to impersonate Microsoft online services (ms365-device.com, ms365-live.com, m365-owa.com, owa-ms365.com). Such activity is commonly associated with phishing or C2 infrastructure targeting Microsoft 365 environments.
This rule monitors outbound TLS traffic for Server Name Indication (SNI) fields matching known C2 or phishing domains associated with the JadeProx activity. This indicates a potential connection from an internal host to malicious infrastructure.
Detection of network communications associated with the TAG-195 campaign, specifically targeting the 'ClickFix' social engineering lure. The rules identify TLS SNI, DNS queries, and HTTP requests involving known C2/staging domains 'screenly.cam' and 'xtrafftrck.net', as well as specific payload retrieval patterns for OCX files and 'curl' usage involving the infrastructure IP 70.34.205.43.
This rule detects network activity associated with a phishing campaign impersonating the RENAPO CURP lookup service. It monitors for TLS SNI and HTTP Host headers containing the typosquatted domain 'gobf.mx', as well as HTTP responses containing specific keywords related to the Mexican CURP registration form originating from this domain.
Detects network communication associated with the Blind Eagle (APT-C-36) threat actor's use of AsyncRAT. This rule identifies DNS queries for a specific DuckDNS domain, matching TLS SNI for the same domain, and network connections to a known historic C2 IP address historically used via a shared VPN egress.
Detects network traffic (DNS, TLS SNI, and HTTP Host header) to the domain 'couldinstallup.com', which is associated with Command and Control (C2) activity by the threat group Mustang Panda.
Detects DNS queries for domains associated with Kratos Phishing-as-a-Service (PhaaS) hosting infrastructure. This activity is indicative of a user or system attempting to resolve domains used for phishing campaigns or command and control communication.
This rule detects potential bulk domain registration activity by grouping registrations by registrar, name server, and a 18-minute window. It specifically flags cases where multiple domains are registered with privacy protection enabled, which is a common tactic for adversaries setting up large-scale C2 or phishing infrastructure.
Detects DNS queries for known typosquatted domains associated with Command and Control (C2) activity. The rule monitors for queries targeting lookalike domains impersonating well-known brands such as Microsoft, Google, Facebook, and various VPN services.
This rule monitors network traffic for DNS queries or remote IP connections to domains that appear to be typosquatting or lookalike domains targeting specific organizations (Boeing, Airbus, Teledyne FLIR). The rule identifies potential phishing or malicious infrastructure by looking for the string 'career' combined with specific entity names or specific suspicious TLD patterns like '.com.de'.
Detects network, DNS, proxy, and email interactions with known Microsoft-themed lookalike domains used in Adversary-in-the-Middle (AiTM) phishing campaigns. These domains impersonate Microsoft login portals to facilitate credential and session token harvesting by kits such as EvilProxy, Sneaky2FA, and Tycoon.
Detects artifacts and network activity associated with a malicious Chromium extension (ID: flkebkiofojicogddingbdmcmkpbplcd) that uses declarativeNetRequest rules to redirect browser search traffic to a typosquatted domain (perplexity-ai.online). The rule correlates file creation, registry modifications, and outbound network connections to the malicious domain from common web browsers.
This rule detects DNS queries for domain names that exhibit patterns indicative of 'phantom squatting' targeting postal and courier services. These patterns often involve concatenating brand-related keywords (e.g., 'post', 'parcel', 'delivery') with service-oriented suffixes (e.g., '-login', '-verify', '-app') to create lookalike domains intended for phishing, credential harvesting, or infrastructure staging.
Detects DNS queries for domains matching a specific typosquatting pattern ('[a-z]{3,20}business.com') associated with the Montana Empire campaign, likely used for corporate banking credential harvesting.
Detects network requests originating from common package manager User-Agents (e.g., pip, npm, cargo) targeted at external domains that do not match known legitimate repositories. This behavior is indicative of potential command and control (C2) activity or malicious package staging using lookalike or arbitrary domains to bypass standard package registry traffic patterns.
Detects the presence of the malicious Chromium extension 'Search for perplexity ai' (ID flkebkiofojicogddingbdmcmkpbplcd) on disk. This extension hijacks browser default search settings to redirect queries through the typosquatted domain perplexity-ai[.]online.
Detects DNS queries for domains that mimic software package naming conventions (e.g., [name]-utils, [name]-api, [name]-client) that do not resolve to known legitimate registry domains. This behavior is indicative of potential dependency confusion attacks or malicious package installation attempts, where an attacker registers a domain designed to lure developers into downloading malicious code.
Detects CI/CD package manager traffic (e.g., pip, npm) attempting to connect to domains that mimic legitimate PyPI or npm registry domains. This behavior is indicative of a dependency confusion or supply chain attack where an adversary uses typosquatted or phantom-squatted domains to intercept or redirect package requests.
Detects HTTP requests where the referrer is a major LLM service (e.g., ChatGPT, Claude) but the destination host uses keywords indicative of phantom squatting (e.g., parcel, delivery, login) suggesting an attempt to use LLM-generated content or platforms to facilitate malicious redirects or phishing.
This rule detects DNS queries for domains that mimic legitimate package registry domains (such as PyPI, npm, etc.) using common typosquatting or lookalike patterns often exploited for dependency confusion or supply chain attacks. It identifies when systems reach out to domains attempting to impersonate trusted package management services.
Page 13 of 16