Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
696 detections
Filters
Last updated
All Time
Detection languages
332
134
106
55
25
Contributors
115
100
66
62
55
Categories
136
129
107
104
84
Platforms
324
178
85
83
80
Products / Services
134
112
104
52
47
MITRE Techniques
18,108
15,617
12,573
8,385
6,206
696
CVEs
2
2
2
2
1
IDS Classtypes
48
29
11
7
6
IDS Protocols
66
20
11
6
3
This rule detects high-volume DNS resolution of domains ending in the .shop TLD from internal hosts, which may indicate interaction with a cluster of infrastructure used by the DoppelCart fake-shop campaign.
Detects HTTP traffic communicating with known domains (grove-12.com and trekmesh15.com) associated with the Codex ClickFix/AMOS campaign, specifically looking for indicators of payload staging or beaconing activity through specific URI patterns.
Detects HTTP traffic originating from external sources that contains response body patterns associated with a DEBULL-themed phishing lure. This rule specifically identifies content indicators related to device-code broker phishing, where a user is tricked into navigating to a malicious URL (debull.app) to authorize access or provide credentials.
Detects network traffic (DNS, TLS SNI, and HTTP Host header) to the domain 'couldinstallup.com', which is associated with Command and Control (C2) activity by the threat group Mustang Panda.
Detects specific URI patterns associated with the DEBULL (also known as CloakGuard) Phishing-as-a-Service (PhaaS) platform. These URI paths are commonly used by attackers managing phishing campaigns, including administrative authentication or deployment script execution on compromised infrastructure acting as a phishing panel.
Detects process, named pipe, or mutex events that contain the specific string 'BEAST HERE?', which is often associated with the presence of malicious tools or backdoors using this hardcoded string for identification or synchronization.
This rule detects potential bulk domain registration activity by grouping registrations by registrar, name server, and a 18-minute window. It specifically flags cases where multiple domains are registered with privacy protection enabled, which is a common tactic for adversaries setting up large-scale C2 or phishing infrastructure.
This rule detects the creation of specific mutexes known to be associated with malicious software. Mutexes are often used by malware to ensure that only one instance of the malicious process is running on the host at a time, or to signal presence to other components.
Detects DNS queries for known typosquatted domains associated with Command and Control (C2) activity. The rule monitors for queries targeting lookalike domains impersonating well-known brands such as Microsoft, Google, Facebook, and various VPN services.
Detects the execution of 'FortiGateSniffer', a tool identified as Golang-based, used to perform passive network packet capture on compromised FortiGate devices. The rule also analyzes captured traffic for sensitive authentication protocols including RADIUS, Kerberos, and NTLM.
Detects the LEASHTEST MIPS-compiled test binary linked to UAT-7810 ORB network R&D activity; presence indicates device compromise
Detects the execution or presence of processes associated with the 'dogleash' tool, specifically identifying command lines or file paths that contain architectural references such as 'mips', 'arm', or 'x64', which is indicative of potential cross-platform malware or backdoor deployment.
Detects HTTP POST requests to LLM chat completion API endpoints containing keywords associated with phishing kit generation, malware scaffolding, and automated credential harvesting. This behavior is consistent with attackers using LLM-assisted supply chain or phishing campaigns.
This rule monitors network traffic for DNS queries or remote IP connections to domains that appear to be typosquatting or lookalike domains targeting specific organizations (Boeing, Airbus, Teledyne FLIR). The rule identifies potential phishing or malicious infrastructure by looking for the string 'career' combined with specific entity names or specific suspicious TLD patterns like '.com.de'.
Detects network, DNS, proxy, and email interactions with known Microsoft-themed lookalike domains used in Adversary-in-the-Middle (AiTM) phishing campaigns. These domains impersonate Microsoft login portals to facilitate credential and session token harvesting by kits such as EvilProxy, Sneaky2FA, and Tycoon.
Detects HTTP POST requests sent to Large Language Model (LLM) chat completion API endpoints where the URI query parameters contain keywords strongly associated with the creation of phishing kits, credential harvesting forms, or malware scaffolding. This rule aims to identify the use of AI tools to accelerate malicious development workflows.
Detects artifacts and network activity associated with a malicious Chromium extension (ID: flkebkiofojicogddingbdmcmkpbplcd) that uses declarativeNetRequest rules to redirect browser search traffic to a typosquatted domain (perplexity-ai.online). The rule correlates file creation, registry modifications, and outbound network connections to the malicious domain from common web browsers.
Detects the execution of potential malware disguised as 'winupdate.exe' and specific network traffic associated with it. The rule identifies suspicious file paths (e.g., in AppData cache) and execution by the binary while communicating with external domains such as pastebin.com or discord.com, which are often abused for command-and-control or payload delivery.
This rule monitors for security alerts related to Azure AI services, specifically detecting credential theft attempts and LLM jailbreak attempts that have been blocked or detected by Azure's built-in content filtering mechanisms.
This rule detects DNS queries for domain names that exhibit patterns indicative of 'phantom squatting' targeting postal and courier services. These patterns often involve concatenating brand-related keywords (e.g., 'post', 'parcel', 'delivery') with service-oriented suffixes (e.g., '-login', '-verify', '-app') to create lookalike domains intended for phishing, credential harvesting, or infrastructure staging.
This rule detects potential phishing emails originating from the gasparinutrition.com domain. It identifies suspicious email delivery patterns involving the use of Google Workspace relay (gappssmtp.com) combined with DKIM misalignment and DMARC failures, indicating possible domain spoofing or unauthorized relay usage.
Page 3 of 34