Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
404 detections
Filters
Last updated
All Time
Detection languages
193
104
95
4
3
Contributors
90
77
62
50
22
Categories
231
151
101
83
77
Platforms
270
109
39
18
9
Products / Services
10,665
9,773
6,704
4,421
3,749
404
MITRE Techniques
138
119
74
64
47
CVEs
4
2
2
2
1
IDS Classtypes
1
IDS Protocols
1
Detects HTTP POST requests destined for specific PHP endpoints (/res.php, /tele.php) frequently used by the BlobPhish campaign to exfiltrate stolen credentials from memory-resident phishing pages.
Detects network requests to known malicious domains associated with the fake RedAlert Android malware campaign used by pro-Iranian actors, acting as a payload host or C2 endpoint.
Detects HTTP POST requests to /panel.php. This endpoint is frequently used by the BlobPhish campaign for backend C2 interaction or validation checks, often accompanied by an empty request body and a specific JSON error response.
Detects the presence of specific JavaScript functions used to generate and handle Blob objects in memory. This technique is utilized by the BlobPhish campaign to keep the phishing payload in memory, thereby evading file and network scanning.
Detects cobalt strike malleable profiles patterns (URI, User-Agents, Methods).
Detects direct access to raw pastes in different paste services often used by malware in their second stages to download malicious code in encrypted or encoded form
Telegram API Access
Sigma
Detects suspicious requests to Telegram API without the usual Telegram User-Agent
Detects a potentially suspicious empty user agent strings in proxy log.
Could potentially indicate an uncommon request method.
Could potentially indicate an uncommon request method.
Detects Windows PowerShell Web Access
Detects outbound HTTP POST requests using a specific, hardcoded Internet Explorer 8 User-Agent string over a specific port. This combination is highly indicative of the cross-platform RAT deployed via the compromised Axios npm packages.
This detection rule identifies network activity associated with the Torg Grabber infostealer. It specifically looks for connections to known command and control (C2) domains and specific URL paths used by the malware for authentication, data upload, or core functionality. The rule leverages network proxy, firewall, or Zeek HTTP logs to extract and analyze URLs. A match indicates a strong reason to investigate the affected host and user, check for expected access, and review nearby activity for further compromise.
This detection rule identifies network traffic associated with the Powercat malware campaign by looking for specific URL patterns or domains mentioned in threat intelligence. It focuses on high-confidence indicators such as 'powercat.dog/(cool|watermelon5)' or 'ce953a0eb08246617b7f849486c4b26a7af37e9d2e8f0e13b3ae1bf0da8a70a.xyz' within network proxy, traffic, or HTTP logs. A match indicates potential communication with Powercat command and control infrastructure or distribution points, warranting further investigation into the source and destination IPs, URLs, and surrounding network activity.
Detects outbound web requests to the Anthropic API containing the specific beta header required to upload files. This can be abused by attackers to exfiltrate sensitive data from the Claude sandbox to an attacker-controlled Anthropic account.
Detects access to the claude.com open redirect endpoint pointing to external domains. Attackers can abuse this trusted domain to bypass ad validation and email filters to deliver malicious payloads, such as prompt injections.
Detects the presence of HTML tags within the URL query parameters of Claude chat application pre-fill URLs. Attackers can use this to embed invisible instructions (prompt injection) that the AI processes but the user does not see in the chat interface.
Detects network traffic matching the specific URI structure used by LeakNet for command-and-control beaconing. This behavior has been consistently observed across multiple LeakNet incidents following initial access.
Detects HTTP/HTTPS traffic where the User-Agent string is explicitly set to 'MicroStealer/1.0', which is used by the malware when communicating with Discord webhooks or its C2.
Detects command and control (C2) communication to a specific Telegram Bot API endpoint hardcoded in the LampoRAT malware. This activity is associated with the Boggy Serpens (MuddyWater) threat actor.
Detects the beaconing activity of the HeaconLoad Golang downloader, a component of the BoryptGrab campaign. This malware sends HTTP POST requests containing system information to the "/healthcheck" endpoint on port 8088.
Detects HTTP requests to download the BoryptGrab stealer, which uses a specific URL pattern containing a hardcoded build name. This activity is characteristic of the initial launchers used in the BoryptGrab campaign to fetch the main stealer component from a C2 server.
This rule is based on a phishing method that abuses normal sign-in links instead of relying on an obviously fake website at the start. The trick works by sending a person to a real sign-in service with settings that force an error and then pass the browser along to the attacker’s page. The rule stays narrow by looking for both the hidden sign-in setting and the clearly bad scope value together. That matters because silent sign-in by itself can appear in normal environments, but the bad scope value changes the story and makes the pattern much more suspicious. In plain language, this rule is trying to spot a link that pretends to be a normal sign-in step but is really being used as a doorway to a phishing or malware page after the trusted service does the redirect. Keeping both parts together helps the rule stay tied to the abusive redirect trick instead of ordinary sign-in traffic.
Page 12 of 20