Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
19 detections
Filters
Last updated
All Time
Detection languages
15
2
2
Contributors
5
4
3
2
1
Categories
8
7
7
6
3
Platforms
8
5
5
4
3
Products / Services
7
6
2
1
1
MITRE Techniques
18,114
15,633
12,576
8,388
6,215
IDS Classtypes
2
IDS Protocols
2
Detects phishing emails that utilize document-themed subjects (e.g., invoices, shared documents) containing Windows Internet Shortcut (.url) attachments that redirect users to Cloudflare Workers-based 'docviewer' pages, often linked in conjunction with suspicious SharePoint file shares.
Detects network connections to a specific suspicious IP address (94.156.181.89) or to domains associated with Cloudflare Tunnel (.trycloudflare.com). This could indicate command and control activity, data exfiltration, or other malicious network communication.
Detects network connections to a specific suspicious IP address (94.156.181.89) or to domains associated with Cloudflare Tunnel (.trycloudflare.com). This could indicate command and control activity, data exfiltration, or other malicious network communication.
Detects serverless function deployments used as C2 infrastructure
Detects compromised serverless functions being used as C2 relay infrastructure
Detects serverless function deployments used as C2 infrastructure
This rule detects HTTP requests where the 'Host' header matches patterns commonly associated with serverless function domains, specifically AWS Lambda URLs, Azure Websites, and Google Cloud Functions. The rule is designed to identify potential command and control (C2) infrastructure utilizing serverless platforms. It triggers an alert if 10 such requests are observed from a single source IP within a 60-second window.
This rule detects HTTP traffic where the 'Host' header contains 'workers.dev'. This domain is associated with Cloudflare Workers, which can be used by attackers to deploy attack infrastructure such as command and control (C2) servers, phishing pages, or data exfiltration points. The rule is configured to trigger a threshold alert if 10 such connections are observed from a single source IP within 60 seconds, indicating potential automated activity or repeated attempts to access or deploy malicious worker scripts.
KQL Query from file: Cloudflare Eviltokens: Gotta catch’em all
(Originally Authored by: Steven Lim (SlimKQL)
Expanded the original query to provide more context useful for investigation.
Original: https://systemtwosecurity.com/share/rule/Mn1XS6n9?utm_source=social&utm_medium=copy_link&utm_campaign=share&utm_content=detection
(Originally Authored by: Steven Lim (SlimKQL)
Expanded the original query to provide more context useful for investigation.
Original: https://systemtwosecurity.com/share/rule/Mn1XS6n9?utm_source=social&utm_medium=copy_link&utm_campaign=share&utm_content=detection
Detects web requests to Cloudflare workers.dev subdomains containing specific keywords commonly used in the EvilTokens device code phishing campaign. The rule specifically looks for a pattern like '[lure-type]-[3char-id].[username]-[domain]...workers.dev' to identify malicious URLs.
Detects web requests to Cloudflare workers.dev subdomains containing specific keywords commonly used in the EvilTokens phishing campaign lures. Attackers rely on this PaaS platform to host device code phishing pages and bypass domain reputation checks.
This rule detects instances where a user clicks on a URL in an email, and the final redirected URL is hosted on 'workers.dev', which is often abused for phishing campaigns, particularly OAuth device code phishing. It correlates email delivery events with URL click events and analyzes the full redirect chain to identify the final destination.
Detects network connections to a specific suspicious IP address (94.156.181.89) or to domains associated with Cloudflare Tunnel (.trycloudflare.com). This could indicate command and control activity, data exfiltration, or other malicious network communication.
This rule detects the creation of Scalable Vector Graphics (SVG) files on a system, particularly those initiated by common applications like Outlook, web browsers, or archive utilities. It then correlates this file creation with subsequent network activity from a browser process within a 5-minute window. The network activity is further scrutinized for suspicious URLs, specifically those using Cloudflare Workers domains with a specific pattern or URLs containing an '@' symbol, which can indicate obfuscation or malicious redirection attempts. This behavior is indicative of SVG smuggling techniques used to deliver malicious payloads or redirect users to phishing sites.
KQL Query
KQL Query
KQL Query from file: Enhanced Cloudflare Phishing Email Detections
KQL Query from file: BlueAlpha GammaDrop Detection
This rule detects DNS queries made to domains frequently used by threat actors for hosting malware payloads or for URL redirection via shortener services. The identified domains include those associated with platforms like Cloudflare Workers, TryCloudflare, InfinityFree, and URL shorteners such as tinyurl and lihi.cc. Such DNS activity can be an indicator of potential malware delivery attempts or command-and-control (C2) communications.
