Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,594 detections
Filters
Last updated
All Time
Detection languages
2,463
65
36
12
11
Contributors
991
707
594
140
61
Categories
2,159
1,453
1,273
576
444
Platforms
2,418
272
203
71
63
Products / Services
10,670
9,758
6,693
4,421
3,749
2,594
MITRE Techniques
808
512
383
246
210
CVEs
18
12
12
12
10
IDS Classtypes
1,144
447
282
188
105
IDS Protocols
1,378
413
318
209
34
Detects outbound network communication to known malicious hosting infrastructure used for the distribution of Antino Stage 2 payloads, specifically targeting CloudFront and Cloudflare R2 object storage locations.
Detects Heartbleed (CVE-2014-0160) exploitation attempts by monitoring for malformed TLS heartbeat requests (undersized payload) followed by oversized responses from the server that indicate potential memory disclosure.
Detects Heartbleed (CVE-2014-0160) exploitation attempts by monitoring for malformed TLS heartbeat requests (undersized payload) followed by oversized responses from the server that indicate potential memory disclosure.
Detects SQL injection exploitation attempts against MOVEit Transfer targeting the CVE-2023-34362 vulnerability, followed by the deployment and subsequent interaction with the 'human2.aspx' webshell associated with Cl0p ransomware mass-exploitation campaigns.
Detects network requests to specific GitHub, Blogspot, and Telegram endpoints, which are known to be used by the 'VPN-for-X' extension to fetch proxy configuration files. This behavior is indicative of C2 channel configuration retrieval.
Detects network traffic attempting to connect to known proxy farm fallback hostnames using TLS SNI or HTTP CONNECT methods. These hostnames are often associated with command-and-control infrastructure designed to proxy traffic and mask the true destination of communications.
Detects HTTP GET requests for the path '/wmglb', which is indicative of a SectopRAT stage-two module download (specifically WbElevation.dll) from a Command and Control server.
Detects network activity associated with SectopRAT malware. The rule identifies C2 beaconing behavior on a non-standard port using a custom protocol with a specific 5-byte length header and 16-byte initialization vector, filtering out standard HTTP/TLS traffic.
This rule detects high-frequency HTTP GET requests containing abnormally long Base64-encoded strings within the URI. This pattern is often indicative of automated payload assembly or exfiltration where data is fragmented across multiple requests, or the use of URL-shortener services to facilitate C2 communication.
Detects network activity (TCP, DNS, TLS, HTTP) associated with the UNC6240 threat actor's infrastructure, specifically targeting communications with known malicious IP addresses and domains used in a campaign leveraging PeopleSoft-related lures.
Detects established, bidirectional TCP connections between internal hosts and known infrastructure associated with the SIDEEYE backdoor on specific control and data ports (3333 and 3334).
Detects network activity associated with the LONGTALE malware family (attributed to APT31/JungleBamboo). This includes identification of specific malicious browser extension IDs in HTTP traffic and signature-based detection of periodic HTTPS/HTTP beaconing patterns indicative of session or cookie exfiltration.
Detects DNS queries and TLS SNI traffic directed towards the suspicious domain 'corp.tripswithengine.com', which is associated with the NeedyMantis malware C2 infrastructure.
Detects network activity associated with the NeedyMantis malware, specifically identifying C2 beaconing behavior. The rule looks for HTTPS GET requests to specific URI paths ('/library/zip/') with a WebSocket upgrade header and suspicious cookie patterns, as well as TLS SNI traffic targeting the hardcoded domain 'corp.tripswithengine.com'.
Detects HTTP beaconing and WebSocket command-and-control (C2) communication associated with the AgtaBackup RAT. This includes identifying specific check-in URIs, hardcoded 'X-Agent-Secret' header authentication, and the initialization of a WebSocket connection.
Detects network requests to known domains (acrobat-reader-installer.com, 03webzoominvite.us) masquerading as Microsoft Store resources to deliver malicious MSI installers. This activity is associated with RMM-based RAT deployment chains.
This rule detects network traffic originating from internal hosts to the domain 'msfconfig.icu'. It specifically monitors for GET requests to '/tmp/system.txt' and TLS connections using the same domain as an SNI, which are associated with the delivery of ClickFix XMRig miner payloads.
This rule detects HTTP GET requests to Vercel subdomains targeting a specific path (/secure.html). This behavior is characteristic of phishing campaigns, specifically those masquerading as RMM-related lures to trick users into providing access codes or credentials.
Detects network traffic (TLS SNI and HTTP Host headers) attempting to connect to known command-and-control infrastructure associated with the NodeRabbit RAT and Mirage Kitten campaign. The rule monitors for unauthorized connectivity to specific domains including 'oracle-challenge.s3.us-east-1.amazonaws.com', 'plugplay.azurewebsites.net', and 'lifespotify.com'.
Detects anomalous network traffic associated with Vidar Stealer 2.0, where an HTTP GET request for a .jpg file is directed to a bare IP address, and the server's response header fails to indicate an image content type despite the requested file extension.
Detects outbound HTTP POST requests destined for 'aware-cr1.com' targeting the URI '/api/beacon', which is indicative of command-and-control (C2) communication associated with the 2CLoader malware.
Page 17 of 124