Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,594 detections
Filters
Last updated
All Time
Detection languages
2,463
65
36
12
11
Contributors
991
707
594
140
61
Categories
2,159
1,453
1,273
576
444
Platforms
2,418
272
203
71
63
Products / Services
10,670
9,758
6,693
4,421
3,749
2,594
MITRE Techniques
808
512
383
246
210
CVEs
18
12
12
12
10
IDS Classtypes
1,144
447
282
188
105
IDS Protocols
1,378
413
318
209
34
This rule detects potentially malicious Command and Control (C2) traffic utilizing DNS over HTTPS (DoH) to interact with public resolvers like Cloudflare, Google, and Quad9. It identifies both high-frequency, repeated direct-to-resolver TLS sessions and specific HTTP requests to these resolvers that resolve domains associated with known C2 infrastructure, such as the ClickFix campaign.
Detects outbound HTTP requests to api.github.com targeting the 'contents' API with patterns indicative of RUSTYSHADE malware command-and-control (C2) communication, including file extensions and filenames typical of its tasking mechanisms.
Detects anomalous HTTP traffic patterns identified in the 'Ted' backdoor used by North Korean-affiliated threat actors (APT37/Kimsuky/Lazarus). The rule specifically monitors the 'Accept-Language' HTTP header for a specific construction containing 'mrt=' followed by 'msc=' or 'mst=', which is used as a covert mechanism for authentication or command signaling.
This rule detects DNS queries for domains associated with DPRK-aligned threat actor backdoors, specifically identified in research as related to curlRAT or similar secondary-stage malware communication. Monitoring these domains can identify potential beaconing or C2 communication from compromised hosts.
Detects the specific TCP handshake pattern characteristic of the Fast Reverse Proxy (FRP) client (frpc) initiating a connection to a command-and-control server. The rule inspects established traffic for specific metadata strings ('privilege_key', 'run_id', 'pool_count') within the initial handshake payload.
This rule detects HTTP POST requests characteristic of the curlRAT malware used by DPRK-affiliated threat actors. The detection looks for a specific POST body format containing 'name=', '&value=', and '&type=' parameters, which indicates C2 communication patterns commonly associated with this specific backdoor.
Detects potential NTLM relay attacks targeting Active Directory Certificate Services (AD CS) web enrollment endpoints, including subsequent certificate requests for sensitive templates. This pattern identifies attackers attempting to relay NTLM authentication to AD CS and potentially requesting certificates for high-privilege templates (e.g., DomainController, SubCA, Machine, or User) to facilitate privilege escalation.
Detects unauthorized HTTP requests to sensitive Cisco Identity Services Engine (ISE) API and administrative paths (/ers/, /admin/, /api/). The rule specifically looks for incoming requests that lack both an Authorization header and a Cookie header, which is indicative of potential exploitation attempts against vulnerabilities such as CVE-2026-76460, where authentication mechanisms might be bypassed or ignored.
Detects network exploitation attempts targeting Fortinet FortiOS and FortiProxy vulnerabilities (CVE-2024-55591, CVE-2025-24472) involving authentication bypass via HTTP header manipulation (Forwarded, X-Forwarded-For) and unauthorized access to the /jsconsole endpoint.
Detects network exploitation attempts targeting Fortinet FortiOS and FortiProxy vulnerabilities (CVE-2024-55591, CVE-2025-24472) involving authentication bypass via HTTP header manipulation (Forwarded, X-Forwarded-For) and unauthorized access to the /jsconsole endpoint.
Detects HTTP beaconing activity associated with the MacSync stealer malware on macOS platforms. The rule monitors for specific URI patterns ('curl', 'dynamic', 'gate') combined with macOS-specific User-Agent strings and potential credential exfiltration headers, indicating established communication with a Command and Control (C2) server.
Detects network traffic (TLS SNI and HTTP Host headers) attempting to connect to known command-and-control infrastructure associated with the NodeRabbit RAT and Mirage Kitten campaign. The rule monitors for unauthorized connectivity to specific domains including 'oracle-challenge.s3.us-east-1.amazonaws.com', 'plugplay.azurewebsites.net', and 'lifespotify.com'.
This rule detects network traffic associated with Lumma Stealer information-stealing malware, specifically identifying HTTP POST requests that utilize the 'TeslaBrowser/5.5' user agent. This pattern is indicative of the malware exfiltrating stolen data to its Command and Control (C2) server.
Detects outbound HTTPS traffic to domains using file-sharing or cloud-sync themed keywords in combination with specific top-level domains (TLD) often associated with suspicious infrastructure. The rule specifically excludes well-known legitimate services such as OneDrive, SharePoint, Dropbox, Box, iCloud, and Google, and includes a detection threshold to minimize alerts for incidental traffic.
Detects outbound HTTPS traffic to domains using file-sharing or cloud-sync themed keywords in combination with specific top-level domains (TLD) often associated with suspicious infrastructure. The rule specifically excludes well-known legitimate services such as OneDrive, SharePoint, Dropbox, Box, iCloud, and Google, and includes a detection threshold to minimize alerts for incidental traffic.
Detects network activity associated with the AgtaBackup RAT, specifically identifying custom HTTP headers for agent authentication, beaconing patterns to check-in endpoints, and establishment of WebSocket-based command and control channels.
Detects outbound HTTP GET requests for common AI model file formats (.pkl, .pt, .bin) from non-authorized or untrusted external domains. This activity is indicative of downloading potentially malicious pre-trained AI models, which can execute arbitrary code during the unpickling process (Supply Chain Compromise).
Detects high-volume web crawling or reconnaissance activities originating from autonomous AI agent frameworks, such as AutoGPT, BabyAGI, LangChain, or CrewAI. These activities are identified by analyzing User-Agent strings and applying threshold-based rate limiting to identify potential automated reconnaissance patterns.
Detects HTTP requests where the User-Agent header matches known strings associated with AI-powered penetration testing or reconnaissance agents, such as PentestGPT, AutoGPT, or AI-Recon tools.
Detects high-frequency POST requests to API endpoints, potentially indicative of automated fuzzing or brute-force parameter mutation attacks, by identifying 50 requests from a single source within a 10-second window.
Detects network traffic containing TLS Server Name Indication (SNI) fields associated with known 'jailbreak-as-a-service' LLM proxies, specifically WormGPT, FraudGPT, and EvilGPT. These services are often used by threat actors to generate malicious content, phishing emails, or exploit code.
Page 13 of 124