Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
53 detections
Filters
Last updated
All Time
Detection languages
45
6
2
Contributors
23
15
4
4
2
Categories
36
33
33
9
9
Platforms
46
3
1
1
Products / Services
44
37
3
2
2
MITRE Techniques
18,108
15,614
12,573
8,384
6,204
IDS Classtypes
31
4
3
2
2
IDS Protocols
31
8
3
2
1
Detects outbound network traffic to the Telegram Bot API (api.telegram.org) via TLS SNI or HTTP requests, which is a common communication channel for Command and Control (C2) or management for Phishing-as-a-Service (PhaaS) platforms.
Detects DNS queries to Cloudflare Workers subdomains that mimic the QUICAgent beaconing pattern. Adversaries utilize these workers as dead-drop resolvers to retrieve updated C2 instructions or redirection information, effectively blending in with legitimate traffic to the workers.dev domain.
Detects Microsoft Defender XDR UrlClickEvents where a clicked URL or extracted clicked domain matches known Coinbase Cartel-related URL, onion, messaging, or infrastructure indicators.
UNC6692 Edgecution phishing/payload page hosted on AWS S3 static website hosting (patch.html/.a payload)
BlueNoroff ClickFix - Traffic to Known-Malicious Watchlist IP
Detects HTTP GET requests associated with the Blind Eagle (APT-C-36) campaign JC-46, specifically targeting GitHub for payload delivery and fetching dropper files (such as .vbs, .bat, .js, or .pif) from known command-and-control staging infrastructure.
ARTokenC2NetworkTraffic - fully-featured phishing-as-a-service (PhaaS) operator panel, branded "ARToken," that shares infrastructure, API contracts, and operational patterns with the EvilTokens platform.
Detects specific URI patterns associated with the DEBULL (also known as CloakGuard) Phishing-as-a-Service (PhaaS) platform. These URI paths are commonly used by attackers managing phishing campaigns, including administrative authentication or deployment script execution on compromised infrastructure acting as a phishing panel.
This rule detects HTTP POST requests to known paste sites (pastebin.com, paste.ee, hastebin.com) with a data size greater than 500 bytes. This behavior is often associated with adversaries using these sites to host malicious payloads or exfiltrate data.
This rule detects HTTP requests where the 'Host' header contains patterns indicative of free hosting services (000webhost, infinityfree, byethost). These services are often abused by attackers to host malicious infrastructure due to their low cost and ease of setup. The rule specifically looks for these patterns in HTTP traffic flowing from the home network to any destination.
Detects inbound emails containing Mailchimp click-tracking links that redirect to ActiveCampaign landing pages, a known ESP chaining technique used to obscure credential harvesters. This technique is often used in phishing campaigns to bypass email security controls.
Page 3 of 3