Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
53 detections
Filters
Last updated
All Time
Detection languages
45
6
2
Contributors
23
15
4
4
2
Categories
36
33
33
9
9
Platforms
46
3
1
1
Products / Services
44
37
3
2
2
MITRE Techniques
18,108
15,613
12,573
8,384
6,203
IDS Classtypes
31
4
3
2
2
IDS Protocols
31
8
3
2
1
Detects HTTP responses and TLS client connections associated with Adobe-themed device code phishing lure pages hosted on workers.dev, utilizing specific patterns and keywords such as 'Confirm to open document', 'VERIFICATION CODE', and long hyphenated domain structures.
Detects network traffic (DNS, TLS SNI, and HTTP) associated with Wazza phishkit infrastructure, specifically looking for malicious domains like boegl-krysl.eu and coppietersrecherche.eu, as well as Cloudflare workers.dev domains used for beaconing and lures.
Detects network traffic (DNS, TLS SNI, and HTTP) associated with Wazza phishkit infrastructure, specifically looking for malicious domains like boegl-krysl.eu and coppietersrecherche.eu, as well as Cloudflare workers.dev domains used for beaconing and lures.
Detects HTTP responses and TLS client connections associated with Adobe-themed device code phishing lure pages hosted on workers.dev, utilizing specific patterns and keywords such as 'Confirm to open document', 'VERIFICATION CODE', and long hyphenated domain structures.
Detects network traffic (DNS, TLS SNI, and HTTP) associated with Wazza phishkit infrastructure, specifically looking for malicious domains like boegl-krysl.eu and coppietersrecherche.eu, as well as Cloudflare workers.dev domains used for beaconing and lures.
Detects network traffic (DNS, TLS SNI, and HTTP) associated with Wazza phishkit infrastructure, specifically looking for malicious domains like boegl-krysl.eu and coppietersrecherche.eu, as well as Cloudflare workers.dev domains used for beaconing and lures.
Detects HTTP responses and TLS client connections associated with Adobe-themed device code phishing lure pages hosted on workers.dev, utilizing specific patterns and keywords such as 'Confirm to open document', 'VERIFICATION CODE', and long hyphenated domain structures.
Detects HTTP responses and TLS client connections associated with Adobe-themed device code phishing lure pages hosted on workers.dev, utilizing specific patterns and keywords such as 'Confirm to open document', 'VERIFICATION CODE', and long hyphenated domain structures.
This rule detects potentially malicious traffic patterns associated with 'ClickFix' phishing campaigns, specifically those leveraging a combination of Google Ads redirects through ChatGPT Custom GPT URLs and malicious landing pages hosted on Google Sites that contain 'antibot' identifiers.
Detects network activity associated with ngrok tunnel domains or suspicious lookalike Microsoft SSO domains (microsoft-sso.com) attempting to perform OIDC discovery, JWKS retrieval, or MFA-related EAM endpoint interactions. This behavior is indicative of adversary-in-the-middle (AiTM) attacks targeting authentication processes.
Detects HTTP proxy requests for ZIP archives where the Referer header indicates a navigation originated from a GitHub Pages (github.io) site, but the destination is not a GitHub domain. This behavior is indicative of a multi-hop redirect chain used in campaigns to deliver malicious payloads, such as infostealers, by abusing GitHub Pages to redirect users to external hosting for ZIP archive downloads.
Detects endpoint network connections to Heroku-hosted domains containing Google Ads tracking parameters (gclid, gad_source, gad_campaignid). This activity is associated with the initial staging phase of 'ShopEase' style malware delivery chains, where users are directed to decoy pages that prepare the environment for subsequent malicious browser-based actions.
Detects HTTP requests to Vercel deployment domains where the requested resource is a specific phishing kit asset ('font1.woff2'). This pattern is commonly associated with phishing campaigns hosted on free web hosting platforms.
Detects endpoint network connections to Heroku-hosted domains containing Google Ads tracking parameters (gclid, gad_source, gad_campaignid). This activity is associated with the initial staging phase of 'ShopEase' style malware delivery chains, where users are directed to decoy pages that prepare the environment for subsequent malicious browser-based actions.
Detects endpoint network connections to Heroku-hosted domains containing Google Ads tracking parameters (gclid, gad_source, gad_campaignid). This activity is associated with the initial staging phase of 'ShopEase' style malware delivery chains, where users are directed to decoy pages that prepare the environment for subsequent malicious browser-based actions.
Detects HTTP and TLS traffic directed toward Vercel subdomains (vercel.app) that are consistent with known patterns for document-lure phishing or gated ZIP file distribution, often used for RMM-phishing campaigns.
Detects network traffic associated with the NPM Btree malware campaign, specifically identifying command-and-control (C2) polling activities directed toward blockchain RPC endpoints like Alchemy and Infura. The rules monitor for specific API keys, C2 smart contract addresses via 'eth_call' JSON-RPC requests, and overall traffic patterns to known malicious infrastructure.
This rule detects network activity associated with the SilverFox malware, specifically targeting communication patterns between the compromised host and identified relay infrastructure. The detection focuses on unique URL query patterns for relay discovery and dispatcher requests, as well as the identification of staging/download links within server responses.
This rule detects HTTP requests directed at suspicious URI patterns associated with 'LeakySensey' logs. It specifically monitors for attempts to access transaction or compromise log endpoints, which could indicate an attacker attempting to enumerate leaked data or verify compromised credentials from an exposed log repository.
This rule monitors for network traffic related to known fake GitHub pages and malicious loader sites impersonating LastPass Authenticator. It detects attempts to access specific malicious domains and organization pages on GitHub, as well as the delivery of malicious pages containing spoofed trust badges and branding, commonly used in phishing campaigns.
Detects network activity associated with the SilverFox multi-tier relay infrastructure, specifically identifying HTTP requests to known relay domains and dispatcher endpoints used for command-and-control (C2) communication.
Page 1 of 3