Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
330 detections
Filters
Last updated
All Time
Detection languages
158
115
22
15
10
Contributors
147
71
32
32
7
Categories
167
156
109
109
96
Platforms
199
104
22
21
17
Products / Services
161
150
64
56
37
MITRE Techniques
18,108
15,614
12,573
8,384
6,204
CVEs
2
IDS Classtypes
107
17
10
10
8
IDS Protocols
86
35
28
3
1
Detects issuance of free SSL certificates for newly registered attack domains
Detects DNS lookups to typosquatted package registry domains for supply chain attacks
This rule detects network connections and DNS resolution requests to known typosquatted domains used by the TeamPCP threat actor for command and control (C2) and data exfiltration. These domains are associated with a compromised Trivy scanner. Detection indicates successful execution of the compromised scanner and attempted exfiltration.
This rule detects network connections and DNS resolution requests to known typosquatted domains used by the TeamPCP threat actor for command and control (C2) and data exfiltration. These domains are associated with a compromised Trivy scanner. Detection indicates successful execution of the compromised scanner and attempted exfiltration.
Detects DNS queries for domains associated with an active adversary-in-the-middle (AiTM) phishing campaign targeting AWS credentials.
This rule detects phishing attempts related to a Booking.com campaign. It identifies suspicious URLs containing 'op_token' or 'tpo_token' parameters, often combined with paths like 'complaint' or 'reserv', on non-Booking.com domains. It specifically looks for punycode domains (e.g., 'xn--*'), lookalike domains (e.g., '*booklng*', '*mgmnt*', '*portal*'), and specific high-signal punycode domains identified in reports. The rule also includes a pattern for partner kit redirect URLs with 'tpo_token' on 'booklng' subdomains. Additionally, it suggests looking for specific email patterns from Gmail senders with subjects like 'Automatic reply', 'Availability', or 'Reservation' that contain embedded URLs matching 'complaint?op_token='.
Detects Booking.com partner phishing lures described by Bridewell by identifying complaint/reserv URLs with op_token hosted on punycode or lookalike domains, plus the booklng sign-in tpo_token pattern.
This rule detects network connections or email URLs that match a list of known Indicators of Compromise (IOCs) associated with Signal-targeted phishing infrastructure and explicit phishing destination domains. These IOCs were identified in Unit 42's research on QR code attack vectors. The rule queries email URL information, URL click events, device network events, and common security logs (proxy/firewall/WAF) to identify activity related to these malicious domains.
Detects Booking.com partner phishing kit artifacts described by Bridewell (op_token complaint lures, tpo_token sign-in flow, booklng subdomain, punycode homograph infra).
Identifies network connections or DNS queries to known phishing domains mimicking Windows 11 update sites, which are used to distribute infostealer malware. These domains are highly specific to this campaign.
Detects potential spam campaigns originating from disposable or trial Jira Cloud instances with randomized subdomain names. The rule identifies emails from '.atlassian.net' domains where the subdomain is longer than 12 characters and contains a mix of letters and numbers, indicating a potentially randomized or disposable instance. It then alerts if more than 5 emails with the same subject are sent from such a suspicious subdomain.
Detects DNS queries for subdomains that match a specific pattern used by the threat actor GS7. The actor uses a semi-automated infrastructure with highly specific subdomain naming conventions, such as 'rss.[random]-auth.com' or 'cpcalendars.[random]-verify.online', to host phishing pages and payloads.
This rule detects network connections to domains and IP addresses associated with the malicious OpenClawCLI campaign, which uses social engineering to trick users into running obfuscated commands.
This rule detects network connections or DNS queries to a predefined list of malicious domains. These domains are likely associated with typosquatting or other malicious infrastructure used by adversaries.
Detects DNS queries to domains using common AWS typosquatting patterns such as 'awscloud', 'compute-aws', or billing/security lures.
Detects network traffic to domains associated with the TAG-160 cluster's phishing campaigns, which primarily target the logistics sector.
Detects network connections to dedicated IP addresses previously used to host Evilginx phishing proxies. While the threat actor has reportedly shifted to using Cloudflare, these IPs represent past infrastructure and should be monitored for potential reuse.
Detects when multiple distinct domains, where at least one is known malicious, share the same HTTP body SHA1 hash or favicon MD5 hash. This pattern is indicative of threat actor infrastructure reuse and templating, as described in analysis of campaigns like LaundryBear and FreeDrain.
ET MALWARE Observed Malicious Domain (tamku .shoplerter .opnetorologies .net in TLS SNI)
This analytic detects suspicious Python package installations where the package name resembles popular Python libraries but may be typosquatted or slightly altered. Typosquatting is a common technique used by attackers to trick users into installing malicious packages that mimic legitimate ones. This detection leverages Cisco NVM flow telemetry and checks for pip or poetry package managers with the "install" or "add" flags, making outbound connections to package repository such as `pypi.org` with known or suspected typo package names.
Detects DNS queries to domains that are suspiciously similar to trusted ones, which may indicate typosquatting, phishing, or user deception tactics. The detection compares unknown domains to a known safe allowlist using a fuzzy character-difference heuristic.
Page 15 of 16