Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
53 detections
Filters
Last updated
All Time
Detection languages
45
6
2
Contributors
23
15
4
4
2
Categories
36
33
33
9
9
Platforms
46
3
1
1
Products / Services
44
37
3
2
2
MITRE Techniques
18,108
15,614
12,573
8,384
6,204
IDS Classtypes
31
4
3
2
2
IDS Protocols
31
8
3
2
1
Detects DNS queries, HTTP host headers, and TLS SNI traffic associated with the SilverFox relay and dispatch infrastructure. These indicators are commonly used by the SilverFox malware for command and control (C2) communications.
This rule detects suspicious outbound HTTP GET requests to a known domain (noah-ssh.com.cn) targeted by the SilverFox malware relay dispatcher. It specifically monitors for requests to '/api.php' containing a 13-digit numeric timestamp parameter, which is a characteristic pattern of its C2 communication.
Detects outbound network communication attempts by the SilverFox malware to known Cloudflare Workers relay infrastructure, specifically targeting hostnames associated with 'noah-relay' instances. The rule monitors DNS lookups, TLS SNI headers, and HTTP Host headers to identify potential Command and Control (C2) traffic.
Detects HTTP downloads from GitHub involving specific repositories and archive naming patterns commonly associated with the 'NightEagle GhostContainer' threat activity. These patterns involve downloading ZIP files disguised as development or resource packages (e.g., 'mirror-js', 'browserthemes', 'resource-pack').
Detects network activity associated with the SilverFox relay dispatcher, including specific cache-busting URI patterns, C2 infrastructure hosted on Cloudflare Workers, and the delivery of decoy WeChat installer links.
This rule detects HTTP requests directed at suspicious URI patterns associated with 'LeakySensey' logs. It specifically monitors for attempts to access transaction or compromise log endpoints, which could indicate an attacker attempting to enumerate leaked data or verify compromised credentials from an exposed log repository.
This rule detects HTTP requests directed at suspicious URI patterns associated with 'LeakySensey' logs. It specifically monitors for attempts to access transaction or compromise log endpoints, which could indicate an attacker attempting to enumerate leaked data or verify compromised credentials from an exposed log repository.
Detects network activity related to the SilverFox modular malware framework, including relay/dispatcher discovery, contact with known C2 infrastructure (noah-ssh.com.cn and Cloudflare Workers), and specific HTTP response patterns associated with its relay discovery process.
This rule detects HTTP requests directed at suspicious URI patterns associated with 'LeakySensey' logs. It specifically monitors for attempts to access transaction or compromise log endpoints, which could indicate an attacker attempting to enumerate leaked data or verify compromised credentials from an exposed log repository.
Detects TCP connections on standard web ports from internal hosts to known IronToll C2 IPs on Tencent/Alibaba Cloud. Scoped to web ports and an established handshake, with a per-source hourly alert cap to reduce repeat noise.
This rule monitors for network traffic related to known fake GitHub pages and malicious loader sites impersonating LastPass Authenticator. It detects attempts to access specific malicious domains and organization pages on GitHub, as well as the delivery of malicious pages containing spoofed trust badges and branding, commonly used in phishing campaigns.
Detects HTTP downloads from GitHub involving specific repositories and archive naming patterns commonly associated with the 'NightEagle GhostContainer' threat activity. These patterns involve downloading ZIP files disguised as development or resource packages (e.g., 'mirror-js', 'browserthemes', 'resource-pack').
Detects HTTP downloads from GitHub involving specific repositories and archive naming patterns commonly associated with the 'NightEagle GhostContainer' threat activity. These patterns involve downloading ZIP files disguised as development or resource packages (e.g., 'mirror-js', 'browserthemes', 'resource-pack').
Detects HTTP downloads from GitHub involving specific repositories and archive naming patterns commonly associated with the 'NightEagle GhostContainer' threat activity. These patterns involve downloading ZIP files disguised as development or resource packages (e.g., 'mirror-js', 'browserthemes', 'resource-pack').
Detects TCP connections on standard web ports from internal hosts to known IronToll C2 IPs on Tencent/Alibaba Cloud. Scoped to web ports and an established handshake, with a per-source hourly alert cap to reduce repeat noise.
Detects TCP connections on standard web ports from internal hosts to known IronToll C2 IPs on Tencent/Alibaba Cloud. Scoped to web ports and an established handshake, with a per-source hourly alert cap to reduce repeat noise.
This rule detects HTTP GET requests for static image assets (jpg, jpeg, png, gif, webp, svg) where the Referer header originates from a .shop top-level domain. This behavior may indicate an unauthorized use of brand image assets, often associated with fraudulent e-commerce sites or phishing campaigns using lookalike or disposable infrastructure.
This rule detects HTTP GET requests for static image assets (jpg, jpeg, png, gif, webp, svg) where the Referer header originates from a .shop top-level domain. This behavior may indicate an unauthorized use of brand image assets, often associated with fraudulent e-commerce sites or phishing campaigns using lookalike or disposable infrastructure.
This rule detects HTTP GET requests for static image assets (jpg, jpeg, png, gif, webp, svg) where the Referer header originates from a .shop top-level domain. This behavior may indicate an unauthorized use of brand image assets, often associated with fraudulent e-commerce sites or phishing campaigns using lookalike or disposable infrastructure.
Detects network traffic associated with the GemStone malicious browser extension, including initial registration to a command-and-control (C2) server on Cloudflare Workers, periodic heartbeat beacons, command polling, and external public IP address lookups for victim identification.
Detects HTTP traffic directed to known abused web hosting platforms and SaaS site builders frequently used by the BengalSEO campaign to host search engine optimization (SEO) poisoning lures. These lures typically mimic service activation or support pages to trick users into downloading malicious content.
Page 2 of 3