Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20 detections
Filters
Last updated
All Time
Detection languages
14
4
1
1
Contributors
5
5
3
2
2
Categories
11
9
7
7
5
Platforms
9
5
5
4
4
Products / Services
6
5
5
2
2
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
IDS Classtypes
4
IDS Protocols
4
Detects clicks on sponsored search engine ads that redirect users to Google Cloud Storage (GCS) buckets with names or paths designed to impersonate the 'Ledger' brand. These artifacts are indicative of a malvertising campaign using typosquatted storage paths to deliver malicious payloads or credential harvesting pages.
Detects clicks on sponsored search engine ads that redirect users to Google Cloud Storage (GCS) buckets with names or paths designed to impersonate the 'Ledger' brand. These artifacts are indicative of a malvertising campaign using typosquatted storage paths to deliver malicious payloads or credential harvesting pages.
Detects clicks on sponsored search engine ads that redirect users to Google Cloud Storage (GCS) buckets with names or paths designed to impersonate the 'Ledger' brand. These artifacts are indicative of a malvertising campaign using typosquatted storage paths to deliver malicious payloads or credential harvesting pages.
Detects clicks on sponsored search engine ads that redirect users to Google Cloud Storage (GCS) buckets with names or paths designed to impersonate the 'Ledger' brand. These artifacts are indicative of a malvertising campaign using typosquatted storage paths to deliver malicious payloads or credential harvesting pages.
Detects clicks on sponsored search engine ads that redirect users to Google Cloud Storage (GCS) buckets with names or paths designed to impersonate the 'Ledger' brand. These artifacts are indicative of a malvertising campaign using typosquatted storage paths to deliver malicious payloads or credential harvesting pages.
Detects outbound HTTP requests to a known domain associated with 'ClickFix' campaign activity. The rule identifies attempts to fetch a specific JavaScript tracker file, which is often used in social engineering campaigns to trick users into executing malicious commands in their shell or console.
This rule detects network connections or DNS queries to known typosquatted and malicious domains associated with the SilverFox campaign. These domains impersonate legitimate software (e.g., SteelSeries GG, Bcut, DeepSeek) to lure users into downloading malware via SEO poisoning and deceptive downloads.
Detects network activity related to 'ClickFix' social engineering campaigns. The rules monitor for DNS queries, TLS SNI requests, and HTTP requests to the malicious domain 'cdnsuicaches.com' used for hosting malicious scripts, as well as the identification of the 'cookie-captcha-complete' string in HTTP traffic, which is a known indicator of a ClickFix social engineering overlay.
This rule detects potential browser-based manipulation or phishing campaigns where a user visits a known loader script host (paste.sh) and subsequently visits cryptocurrency trading sites (SimpleSwap, SwapZone) within a short time window. This behavior is indicative of an injected script modifying the browser's view of trading sites to display deceptive 'Loyalty Bonus' or discount banners to lure users into transactions.
This rule detects potential browser-based manipulation or phishing campaigns where a user visits a known loader script host (paste.sh) and subsequently visits cryptocurrency trading sites (SimpleSwap, SwapZone) within a short time window. This behavior is indicative of an injected script modifying the browser's view of trading sites to display deceptive 'Loyalty Bonus' or discount banners to lure users into transactions.
This rule detects potential browser-based manipulation or phishing campaigns where a user visits a known loader script host (paste.sh) and subsequently visits cryptocurrency trading sites (SimpleSwap, SwapZone) within a short time window. This behavior is indicative of an injected script modifying the browser's view of trading sites to display deceptive 'Loyalty Bonus' or discount banners to lure users into transactions.
Detects HTTP requests to the malicious 'verify' WordPress plugin serving the fake CAPTCHA ClickFix overlay.
Detects node.exe spawning powershell.exe as a child process, consistent with malicious npm postinstall lifecycle hooks used by the PostCSS typosquatting campaign (postcss-minify-selector-parser / postcss-minify-selector). The attack chain decrypts an AES-256-GCM blob at runtime and executes a PowerShell downloader stage.
Detects suspicious NPM package installations that may indicate typosquatting or supply chain compromise attempts. The rule looks for `npm install` or `npm add` commands with package names containing special characters (@, ^, ~) and common prefixes used in typosquatting (typosquatting-, common-, util-), while excluding 'json' to reduce false positives. A high count of such installations within an hour from a single user and computer is flagged.
Detects suspicious NPM package installations that may indicate typosquatting or supply chain compromise attempts. The rule looks for `npm install` or `npm add` commands with package names containing special characters (@, ^, ~) and common prefixes used in typosquatting (typosquatting-, common-, util-), while excluding 'json' to reduce false positives. A high count of such installations within an hour from a single user and computer is flagged.
This rule detects HTTP responses that indicate a potential drive-by download infrastructure redirect. Specifically, it looks for HTTP responses to clients that contain the word "redirect" (case-insensitive) in the URI and also contain the "MZ" magic bytes at the beginning of the file data, suggesting an executable file is being served. This combination implies a server is redirecting to or serving an executable file, which is a common tactic in drive-by download attacks.
This rule detects potential watering hole attacks by identifying HTTP responses (flow to client) that contain a combination of HTML script tags, 'document.write', and 'eval(' within the file data. This pattern is indicative of malicious JavaScript injection designed to execute code on the client side.
This detection identifies network traffic to domains known to be used as command and control (C2) infrastructure in recent SharePoint exploitation campaigns. Communication with these domains is a strong indicator of compromise.
ZLoader was delivered in a campaign in late summer 2021 using malvertising to download malicious .msi files onto affected machines. This campaign was originally tweeted by @MsftSecIntel on Twitter.
In this campaign, the malicious .msi files create registry keys that use that attacker-created comapny names.
In this campaign, the malicious .msi files create registry keys that use that attacker-created comapny names.
ZLoader was delivered in a campaign in summer 2021 via malvertising. This campaign was tweeted about by @MsftSecIntel on twitter.