Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
30 detections
Filters
Last updated
All Time
Detection languages
24
3
1
1
1
Contributors
16
9
2
1
1
Categories
19
19
15
14
9
Platforms
24
3
2
2
1
Products / Services
23
20
7
2
2
MITRE Techniques
18,123
15,639
12,580
8,394
6,215
IDS Classtypes
19
3
1
1
IDS Protocols
10
7
4
2
1
Detects high-volume, potentially malicious activity where a client requests a large number of distinct hostnames ending in .shop from a single destination IP address within a short time frame, which may indicate infrastructure used for phishing or fraudulent e-commerce storefronts similar to DoppelCart-style activity.
Detects high-volume, potentially malicious activity where a client requests a large number of distinct hostnames ending in .shop from a single destination IP address within a short time frame, which may indicate infrastructure used for phishing or fraudulent e-commerce storefronts similar to DoppelCart-style activity.
BlueNoroff ClickFix - Traffic to Known-Malicious Watchlist IP
Detects HTTP traffic originating from external sources that contains response body patterns associated with a DEBULL-themed phishing lure. This rule specifically identifies content indicators related to device-code broker phishing, where a user is tricked into navigating to a malicious URL (debull.app) to authorize access or provide credentials.
Detects endpoint devices navigating through a sequence of two or more distinct cloud-native redirector platforms (specifically Azure Websites, Cloudflare Pages, and AWS S3 buckets) within a 5-minute window, followed by a connection to a non-cloud final destination. This behavior is highly characteristic of adversaries utilizing Traffic Direction Systems (TDS) or Bulletproof Redirect Engines to obfuscate malicious payloads and evade network security controls.
This rule detects network connections to Azure infrastructure (azurewebsites.net) that utilize specific API paths associated with the MiniJunk C2 framework. The paths include '/api/app/check', '/api/app/update', and '/api/app/comment', which are indicative of command and control beaconing activity.
This rule detects a high volume of outbound TCP communication from the home network to any destination on port 8080. This pattern can indicate a compromised server acting as a proxy or engaging in other suspicious network activity, potentially for resource development or command and control.
Detects indicators of React2shell exploitation originating from 'node' or 'next' processes on web-facing or internet-facing assets. This rule identifies suspicious network connections to common web ports (3000, 8080, 443, 80) or process executions containing command-line arguments indicative of prototype pollution exploitation (e.g., '__proto__', 'constructor:constructor', 'process.mainModule.require', 'execSync', 'vm.runInThisContext', 'fs.readFileSync') or common post-exploitation commands ('whoami', '/etc/passwd', 'id', 'env', 'hostname').
Original Sigma Rule: https://github.com/Neo23x0/sigma/blob/master/rules/apt/apt_babyshark.yml.
Questions via Twitter: @janvonkirchheim.
Questions via Twitter: @janvonkirchheim.
Page 2 of 2