Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,594 detections
Filters
Last updated
All Time
Detection languages
2,463
65
36
12
11
Contributors
991
707
594
140
61
Categories
2,159
1,453
1,273
576
444
Platforms
2,418
272
203
71
63
Products / Services
10,670
9,758
6,693
4,421
3,749
2,594
MITRE Techniques
808
512
383
246
210
CVEs
18
12
12
12
10
IDS Classtypes
1,144
447
282
188
105
IDS Protocols
1,378
413
318
209
34
Detects outbound HTTP POST requests destined for 'aware-cr1.com' targeting the URI '/api/beacon', which is indicative of command-and-control (C2) communication associated with the 2CLoader malware.
Detects outbound HTTP POST requests destined for 'aware-cr1.com' targeting the URI '/api/beacon', which is indicative of command-and-control (C2) communication associated with the 2CLoader malware.
This rule detects HTTP GET requests to a specific IP address (62.60.226.185) attempting to download a file named 't0907.exe'. This pattern is associated with the delivery phase of the 2CLoader malware.
This rule detects HTTP GET requests to a specific IP address (62.60.226.185) attempting to download a file named 't0907.exe'. This pattern is associated with the delivery phase of the 2CLoader malware.
This rule detects HTTP GET requests to a specific IP address (62.60.226.185) attempting to download a file named 't0907.exe'. This pattern is associated with the delivery phase of the 2CLoader malware.
Detects anomalous HTTP traffic directed to githubusercontent.com containing a custom, non-standard request header 'aohvcoehfg'. This pattern is associated with Kimsuky threat actor activity, specifically related to the 'GitPower' operation involving C2 communication via GitHub repositories.
Detects network activity (DNS queries, TLS SNI, and HTTP Host headers) associated with known RedFlick command-and-control (C2) infrastructure domains: etia.ca, groy.cc, and secure-dns-hub.com.
Detects incoming HTTP requests to a FortiSandbox device that contain suspicious command injection patterns. The rule monitors both the URI and the request body for shell metacharacters such as ';', '|', '`', '$(', or '&&', followed by common binary execution commands (e.g., cat, wget, curl, bash, rm). This behavior is indicative of an exploit attempt targeting CVE-2026-39808.
Detects TLS traffic featuring certificates where both the subject and issuer common name (CN) are set to 'SLIVER', which is the default configuration for the Sliver C2 framework's self-signed certificates.
Detects HTTP GET requests to network appliance management interfaces containing query parameters commonly used to trigger remote command or shell execution (e.g., cmd, exec, shell, command), which is characteristic of web shell activity.
Detects HTTP GET requests to the URI '/dpixel', which is a known default beacon URI pattern associated with the Brute Ratel C4 command and control framework's 'Badger' implant.
Detects anomalous network traffic patterns characteristic of the PetitPotam exploit, specifically targeting the MS-EFSRPC interface on Windows SMB pipes. This behavior is used to force a remote system to initiate authentication to a specified target, facilitating NTLM relay attacks.
Detects the presence of self-signed TLS certificates with the common name 'JDYFJ' in the certificate subject or issuer fields. This pattern has been associated with the KV-Botnet, which has been utilized by the Volt Typhoon threat actor to obfuscate command and control traffic through compromised SOHO routers.
This rule detects malicious HTTP POST requests attempting a path traversal attack against Grav CMS, specifically targeting the __unique_form_id__ parameter. The rule looks for directory traversal sequences ('..') following the parameter, which is characteristic of attempts to read sensitive files outside the intended web directory.
Detects HTTP responses containing a file named 'ClaudeDesktop.exe' served from paths containing '/artifacts/' on the 'claude.ai' host where the request referrer is not 'claude.ai' or 'anthropic.com', suggesting a malvertising or supply chain delivery attempt of a malicious installer.
This rule detects a potential SYN flood denial-of-service attack, characterized by a high volume of TCP SYN packets directed at a target within a short timeframe. Such activity is indicative of attempts to exhaust server resources by leaving TCP handshakes incomplete.
Detects DNS queries and TLS SNI traffic directed at known actor-controlled domains and subdomains associated with ScreenConnect remote management software usage in malicious RMM chains.
Detects DNS queries and TLS SNI traffic directed at known actor-controlled domains and subdomains associated with ScreenConnect remote management software usage in malicious RMM chains.
This rule detects suspicious HTTP POST requests to a /collect endpoint that contain tracking parameters (visitorId, stage, variant, events) associated with 'ClickFix' social engineering campaigns. These campaigns typically trick users into copying and pasting malicious code by simulating error prompts or CAPTCHAs.
Detects network activity associated with the AMOS (Atomic macOS Stealer) malware, specifically identifying outbound HTTP POST requests to the '/api/t' URI path occurring on non-standard ports. The detection utilizes a threshold-based trigger to identify potential C2 communication heartbeats.
This rule detects network traffic patterns indicative of the Lumma Stealer 'ClickFix' phishing campaign. It identifies outbound requests to suspicious domains ending in .cyou utilizing specific user agents (WinHttp or Microsoft BITS), which are characteristic of malicious PowerShell scripts attempting to retrieve secondary payloads.
Page 18 of 124