Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
404 detections
Filters
Last updated
All Time
Detection languages
193
104
95
4
3
Contributors
90
77
62
50
22
Categories
231
151
101
83
77
Platforms
270
109
39
18
9
Products / Services
10,665
9,773
6,704
4,421
3,749
404
MITRE Techniques
138
119
74
64
47
CVEs
4
2
2
2
1
IDS Classtypes
1
IDS Protocols
1
Detects the generation of core dump files by the Squid proxy server process, which could indicate a crash, segmentation fault, or an attempt to exploit a vulnerability like Squidbleed. This rule specifically looks for 'squid.exe' processes with command line arguments related to core dumps or crashes.
Detects attempts to exploit the Squidbleed vulnerability (C11 strchr() Null Terminator Behavior Exploitation) by monitoring 'squid.exe' process command lines for the presence of null terminator characters or their string representations. This indicates an attempt to manipulate string handling functions.
Detects potential exploitation attempts related to the Squidbleed vulnerability by monitoring 'squid.exe' or processes with 'squid' in their command line for AddressSanitizer related keywords indicating memory safety issues like overflow, underflow, or use-after-free.
Detects network traffic matching the specific HTTP GET request URI used by the OceanLotus SPECTRALVIPER backdoor for command and control beaconing.
Detects HTTP POST requests directed to the specific URI path '/api/validate/keyboard-events', which is used by a North Korean-linked npm malware to exfiltrate keylogger data.
Detects HTTP requests where the Cookie header contains the specific prefixes 'euconsent-v2=' or 'zd_cs_pm=', which are used by the OceanLotus SPECTRALVIPER backdoor to exfiltrate encrypted host profiling data.
This rule detects internal network traffic to port 3128, which is commonly used by Squid proxy servers. The rule is specifically looking for a high volume of such connections (10 connections within 60 seconds from the same source IP) within the home network, suggesting the use of a Squid proxy for internal command and control (C2) routing. The 'flow:to_server,established' indicates that the rule triggers on established connections from a client within the home network to a server within the home network on port 3128.
Detects C2 beaconing and token validation activity via GitHub API commit searches using the exact strings hardcoded in the Miasma payload. The worm uses these searches to validate connectivity and verify stolen token legitimacy.
Detects HTTP requests utilizing a specific, highly verbose, and legacy Internet Explorer 8 User-Agent string. This exact hardcoded string is utilized by a fileless .NET loader (originating from a malspam campaign) to download subsequent payload stages from its staging server.
Detects network requests associated with FallSpy, an Android spyware utilized by the Russia-nexus threat group GREYVIBE. FallSpy is deployed via fake persona lures and spoofed applications to harvest critical intelligence. While the original YARA rule targets file-based artifacts (e.g., class names like DataCollectorWork), this Sigma rule adapts the logic to focus on the highly reliable exfiltration URL parameters observable in proxy and web gateway logs.
Detects the specific User-Agent string 'NSIS_InetLoad (Mozilla)' associated with the SessionGate multi-stage loader during its command and control (C2) check-ins. SessionGate is delivered via impersonated open-source tooling websites and gated TDS redirection chains.
This rule detects network connections originating from clients using a specific User-Agent string associated with the SessionGate malware. The User-Agent string 'NSIS_InetLoad' combined with 'Mozilla' is indicative of SessionGate C2 check-ins, leveraging the NSIS (Nullsoft Scriptable Install System) InetLoad plugin. The rule searches across common proxy and web logs for this pattern.
Detects web requests containing the specific user-agent or custom secret headers used by the Moika campaign beacon to retrieve its stage 2 payload.
Detects web requests containing the specific user-agent or custom secret headers used by the Moika campaign beacon to retrieve its stage 2 payload.
Detects outbound web requests or GitHub API interactions containing the specific description string "Miasma: The Spreading Blight". This string is used as a signature by the Miasma malware (a Shai-Hulud variant involved in the @redhat-cloud-services npm supply chain attack) when creating malicious GitHub repositories to exfiltrate stolen credentials.
Detects HTTP requests containing specific URL query parameter combinations (`ia=` and `df=`) or POST bodies containing `a=iz&b=`, which are unique to the JS.MonoGlyphRAT check-in and beaconing protocol.
Detects web traffic indicating client-side injection loading JavaScript from the known malicious domain hello-mywordl.info, which is associated with a WordPress malware campaign.
Detects outbound web requests or GitHub API interactions containing the specific description string "Miasma: The Spreading Blight". This string is used as a signature by the Miasma malware (a Shai-Hulud variant involved in the @redhat-cloud-services npm supply chain attack) when creating malicious GitHub repositories to exfiltrate stolen credentials.
Detects network connections or web requests to the specific malicious GitHub repository paths used to host the 5th and 6th stage payloads of the Miasma malware (a Shai-Hulud variant).
Detects the malformed User-Agent string used by CL-STA-1132 during exploitation
of CVE-2026-0300 (PAN-OS Captive Portal buffer overflow). The UA is structurally
invalid (Safari token precedes Mozilla token, Mozilla/5.5 is non-standard) and
has no known legitimate origin.
of CVE-2026-0300 (PAN-OS Captive Portal buffer overflow). The UA is structurally
invalid (Safari token precedes Mozilla token, Mozilla/5.5 is non-standard) and
has no known legitimate origin.
Detects a specific combination of HTTP GET, POST, and PUT requests to the GitHub API (api.github.com) within a short timeframe. This sequence matches the behavior of the AdaptixC2 custom listener used by Tropic Trooper, which uses GitHub issues for beaconing/task polling and the contents API for data exfiltration. The detection has been refined to look for specific AdaptixC2 operational keywords ('beat', 'upload', 'download') to reduce noise.
Page 11 of 20