Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4 detections
Filters
Last updated
All Time
Detection languages
2
1
1
Contributors
3
1
Categories
2
2
1
1
Platforms
3
2
1
Products / Services
2
1
1
1
1
MITRE Techniques
18,114
15,633
12,576
8,388
6,215
IDS Classtypes
1
IDS Protocols
1
Detects non-browser automated HTTP clients (e.g., Python, Wget, Curl, Scrapy) downloading audio/video files from corporate public-facing pages such as Investor Relations, Press Releases, and Executive profiles. This activity is indicative of malicious reconnaissance used to harvest voice or video samples for synthetic media (deepfake) creation for future social engineering or impersonation attacks.
Detects bulk access to Crunchbase or ZoomInfo for corporate intelligence
Detects queries to passive DNS databases for historical DNS resolution data
This rule detects suspicious DNS lookups for 'pastebin.com'. It triggers an alert if a source IP performs 5 or more DNS queries for 'pastebin.com' within a 60-second window. This activity is often associated with reconnaissance, as attackers may use Pastebin to host command and control (C2) information, exfiltrated data, or other malicious content.