Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
485 detections
Filters
Last updated
All Time
Detection languages
151
136
74
42
39
Contributors
103
95
90
56
41
Categories
88
80
76
66
65
Platforms
210
208
110
108
71
Products / Services
10,660
9,755
6,689
4,418
3,748
485
MITRE Techniques
102
93
89
64
54
CVEs
6
6
5
4
4
Detection rule monitoring for indicators of compromise related to SolarWinds Serv-U, including anomalous Content-Encoding headers, unexpected child process execution, large file staging indicative of data exfiltration (Cl0p-style), outbound exfiltration, SQL injection artifacts, and unauthorized LDAP/Active Directory object enumeration by the Serv-U process.
This rule identifies indicators of compromise associated with the DragonReturn malware and DcRAT, including malicious file names, suspicious process execution, DNS resolution of known malicious phishing domains, and network communication with documented C2 infrastructure.
Detects web traffic containing specific randomized CSS filter properties on top-level elements, frequently seen in Bluekit PhaaS toolkits. These properties are used to alter the visual hash of the rendered page, complicating automated screenshot or pixel-based analysis by security vendors. This technique is often combined with suspicious URL patterns indicative of credential harvesting sites.
Detects network communication associated with the Bluekit phishing framework and the use of the rrweb library to capture web sessions, including WebSocket upgrade attempts which may indicate unauthorized user activity monitoring or credential harvesting.
This rule detects multiple failed SSL login attempts from a single source IP to a destination IP within a 24-hour period. A threshold of 10 failed attempts is used to identify potential brute-force attacks or credential stuffing against SSL-enabled services.
Detects execution of specific scripts or suspicious child processes indicative of a MyBB 'limited_acp_to_admin' exploit attempt. This rule looks for known script names related to the PoC and suspicious process lineage where a PHP web server process spawns command shells or scripting interpreters commonly used in post-exploitation activities.
Detects the execution of the 'aa-exec' process with specific command-line arguments ('trinity', 'chrome', or 'flatpak') that are often associated with malicious tools, persistence, or bypass techniques.
Detects suspicious execution patterns involving 'npm' or 'node' processes, specifically looking for command-line arguments or folder paths related to 'apintegrationpost' or known components of the MYRA malware family (libcache.so, memfd_loader, proc_hide, injector, agent_launcher). This rule aims to identify potential supply chain compromise or malicious activity leveraging Node.js environments.
Monitors for the use of 'sshpass' to automate SSH logins using specific accounts commonly associated with Oracle/PeopleSoft administration (psoft, oracle, linuxadm) with disabled strict host key checking. This technique was observed in ShinyHunters attacks.
Monitors for the use of 'sshpass' to automate SSH logins using specific accounts commonly associated with Oracle/PeopleSoft administration (psoft, oracle, linuxadm). This technique was observed in ShinyHunters attacks.
This rule detects potentially malicious web content by identifying the use of randomized or specific combinations of CSS filters (saturate, hue-rotate, brightness, contrast) within HTML responses. These techniques are often used by attackers to obfuscate malicious content, such as phishing pages, from automated scanners and security filters. The rule also incorporates a check for unusually large JavaScript bundle sizes, which may indicate the presence of injected malicious scripts.
Detects exploitation attempts against LB-LINK routers via parameter injection in the 'set_LimitClient_cfg' endpoint (CVE-2023-26801) and subsequent command-and-control behavior, including outbound connections to known RondoDox staging IPs and DNS queries for associated malicious domains.
Detection rule monitoring for indicators of compromise related to SolarWinds Serv-U, including anomalous Content-Encoding headers, unexpected child process execution, large file staging indicative of data exfiltration (Cl0p-style), outbound exfiltration, SQL injection artifacts, and unauthorized LDAP/Active Directory object enumeration by the Serv-U process.
Lumma C2Beacon
YARA
Infostealer-as-a-service targeting browser credentials and crypto wallets
Infostealer distributed via fake open-source tool impersonation sites
Stealthy backdoor MLTBackdoor linked to KongTuke ClickFix and ModeloRAT campaigns
Fraud framework powering scam domains for crypto and gambling schemes
Fraud framework powering scam domains for crypto and gambling schemes
Banking trojan and loader using malicious Office macro delivery
Rust-based ransomware family targeting enterprise environments
Credential and browser data stealer distributed via OXLOADER campaigns
Page 15 of 24