Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
30 detections
Filters
Last updated
All Time
Detection languages
24
3
1
1
1
Contributors
16
9
2
1
1
Categories
19
19
15
14
9
Platforms
24
3
2
2
1
Products / Services
23
20
7
2
2
MITRE Techniques
18,123
15,639
12,580
8,394
6,215
IDS Classtypes
19
3
1
1
IDS Protocols
10
7
4
2
1
Detects network traffic involving TLS certificates or Server Name Indication (SNI) values that attempt to impersonate the Uzbekistan state railway authority (azure.uzrailwaystax.com). The rules also flag connections associated with certificates issued by 'TLC DV TLS CA' and known C2 infrastructure using the spoofed railway certificate.
Detects network traffic involving TLS certificates or Server Name Indication (SNI) values that attempt to impersonate the Uzbekistan state railway authority (azure.uzrailwaystax.com). The rules also flag connections associated with certificates issued by 'TLC DV TLS CA' and known C2 infrastructure using the spoofed railway certificate.
Detects network communication with infrastructure identified as SilkParasite command and control by matching specific TLS certificate subjects and SHA-256 fingerprints associated with SpiceRAT.
Detects successful authentication attempts in Azure AD or Microsoft 365 logs originating from known proxy/VPN service providers or identified by suspicious Python-requests user agent strings. The rule specifically filters for events where MFA was not satisfied, indicating potentially bypassed or failed security controls from potentially malicious infrastructure.
Detects DNS queries to known malicious subdomains and direct TCP connections to an IP address associated with the SilkParasite, NodeEdgeRAT, and NomadRAT malware infrastructure. The rule specifically monitors for communication with identified C2 infrastructure hosts and legacy domain registration points.
Detects the presence of injected 'ganalytics-tracker-js' script on compromised webpages and the subsequent browser-initiated requests for the malicious 't.js' script. This is associated with ClickFix attack campaigns where users are socially engineered into executing malicious code.
Detects network traffic involving TLS certificates that impersonate the Uzbekistan state railway authority, specifically using certificates issued by 'TLC DV TLS CA' or specific known malicious certificate fingerprints. This activity is attributed to the threat actor SilkParasite.
Detects network activity associated with the 'ClickFix' campaign, specifically targeting the cdnsuicaches[.]com domain. The rules identify the initial DNS query, the subsequent TLS SNI connection, and the retrieval of malicious JavaScript containing the 'cookie-captcha-complete' overlay signature. This behavior is indicative of a browser-based social engineering attack.
Detects network traffic attempting to impersonate the Uzbekistan railway authority via suspicious TLS certificates. The rules identify specific SNI domains, certificate subjects, and issuers associated with the 'SilkParasite' campaign, which uses Chinese state-affiliated certificate authorities to facilitate C2 communications.
Detects network activity associated with the 'ClickFix' campaign, specifically targeting the cdnsuicaches[.]com domain. The rules identify the initial DNS query, the subsequent TLS SNI connection, and the retrieval of malicious JavaScript containing the 'cookie-captcha-complete' overlay signature. This behavior is indicative of a browser-based social engineering attack.
Detects network activity associated with the 'ClickFix' campaign, specifically targeting the cdnsuicaches[.]com domain. The rules identify the initial DNS query, the subsequent TLS SNI connection, and the retrieval of malicious JavaScript containing the 'cookie-captcha-complete' overlay signature. This behavior is indicative of a browser-based social engineering attack.
Detects suspicious FTP command and control traffic originating from internal hosts to known compromised servers in Taiwan. The rules monitor for specific FTP commands such as STOR (to upload archive4.zip), RETR (to download archive1.zip), and initial authentication (USER command) associated with C2 communication.
Detects network traffic associated with SilkParasite SpiceRAT malware, including direct IP connections, DNS queries for known malicious domains, and corresponding TLS SNI or HTTP Host header metadata indicating command-and-control (C2) activity.
Detects HTTP responses containing content that clones the RTX Corporation homepage, often associated with SilkParasite C2 infrastructure. The rule flags matches based on embedded text in the HTTP body combined with specific nginx server header fingerprints.
Detects network activity associated with the 'ClickFix' campaign, specifically targeting the cdnsuicaches[.]com domain. The rules identify the initial DNS query, the subsequent TLS SNI connection, and the retrieval of malicious JavaScript containing the 'cookie-captcha-complete' overlay signature. This behavior is indicative of a browser-based social engineering attack.
Detects network activity, including DNS queries and TLS certificate usage, related to the impersonation of the Uzbekistan state railway authority through the domain 'uzrailwaystax.com' and associated SSL/TLS certificates.
Detects potential installation of compromised Admin Menu Editor Pro plugin updates by identifying sequential download events for specific plugin versions from the 'adminmenueditor.com' domain within a 24-hour window. This behavior is indicative of a supply chain attack where a legitimate update mechanism is leveraged to deliver malicious payloads without integrity verification.
This rule detects network activity associated with GhostCode phishing campaigns. It monitors for suspicious TLS SNI fields and HTTP Host headers matching known device-code phishing subdomain patterns (e.g., [service]-access-[8-chars].[domain]). Additionally, it detects requests to specific known malicious hostnames and high-entropy URI paths indicative of phishing kit redirects.
Detects high-volume, potentially malicious activity where a client requests a large number of distinct hostnames ending in .shop from a single destination IP address within a short time frame, which may indicate infrastructure used for phishing or fraudulent e-commerce storefronts similar to DoppelCart-style activity.
Detects network activity (TCP, DNS, and HTTP) directed towards a known rogue infrastructure IP identified in a supply chain compromise affecting the Coder registry. The rule alerts on attempts to resolve or communicate with this infrastructure to download backdoored Terraform modules or interact with malicious resources.
Detects network activity (TCP, DNS, and HTTP) directed towards a known rogue infrastructure IP identified in a supply chain compromise affecting the Coder registry. The rule alerts on attempts to resolve or communicate with this infrastructure to download backdoored Terraform modules or interact with malicious resources.
Page 1 of 2