Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,421 detections
Filters
Last updated
All Time
Detection languages
4,217
105
40
25
13
Contributors
1,327
1,003
725
627
332
Categories
2,253
2,239
1,434
1,144
973
Platforms
4,107
453
295
83
82
Products / Services
10,670
9,758
6,693
4,421
3,749
MITRE Techniques
886
774
552
505
456
CVEs
18
12
12
12
10
IDS Classtypes
1,868
466
446
362
230
IDS Protocols
2,366
846
388
301
93
This rule detects outbound TLS connections to known temporary file sharing services, which can be indicative of data exfiltration. The rule inspects the Server Name Indication (SNI) field in TLS traffic for specific domain names associated with these services.
This rule detects Command and Control (C2) beaconing activity associated with the UNC1549 threat group and the LIGHTRAIL malware. It specifically looks for HTTP traffic with a URI containing '/news', an 'Upgrade: websocket' header, and a distinct User-Agent string 'Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Safari/537.36 Edge/12.10136'. This combination of indicators suggests an attempt to tunnel C2 communications over HTTP, potentially masquerading as legitimate WebSocket traffic.
This rule detects TLS connections to domains associated with Gh0st RAT impersonation campaigns, specifically 'Campaign Trio' and 'Campaign Chorus'. It looks for specific strings ('i4tools', 'youdao', 'deepseek') in the TLS Server Name Indication (SNI) field, combined with top-level domains like '.top' or '.vip'. This pattern indicates potential command and control (C2) communication from Gh0st RAT malware.
This rule detects network connections to external hosts exhibiting a specific JARM fingerprint (27d40d40d00040d00042d43d00041df04c41293ba84f6efe3a613b22f983e6) that has been associated with a phishing campaign, specifically targeting Harbor Freight. JARM fingerprints are used to identify unique TLS server configurations, and this particular hash indicates a known malicious infrastructure.
This rule detects Command and Control (C2) communication associated with the Amatera Stealer malware. It specifically looks for TLS traffic where the Server Name Indication (SNI) field contains the string "aether100pronotification.table.core.windows.net". This SNI is considered bogus and indicative of Amatera Stealer's C2 activity.
DOS Sustained ICMP Flood Attempt
Suricata
This rule detects a sustained ICMP flood attempt, which is a type of Denial of Service (DoS) attack. It triggers an alert if more than 100 ICMP packets (type 8, echo request) are observed from an external network to the home network within a 10-second window, tracked per source IP. This indicates an adversary is attempting to overwhelm the target system or network with ICMP traffic.
This rule detects a high rate of ICMP echo requests from a single source to a server within the home network, indicating a potential Denial of Service (DoS) attack. It triggers an alert if more than 50 ICMP echo requests are observed from the same source within a 1-second interval.
This rule detects network traffic indicative of Kraken Ransomware activity, specifically looking for connections to Cloudflared tunnels. It identifies TLS SNI (Server Name Indication) containing '.trycloudflare.com', which is a domain used by Cloudflare for its tunnel services. This behavior is often leveraged by adversaries for command and control or data exfiltration, as it can help bypass traditional firewall rules and obscure the true destination of the traffic.
This rule detects network traffic to specific JSON storage services (jsonkeeper.com, jsonsilo.com, npoint.io) that have been observed to be abused by the DPRK-linked 'Contagious Interview' threat actors for malware delivery. The detection is based on TLS Server Name Indication (SNI) patterns.
This rule detects inbound HTTP requests containing the User-Agent string 'Salesforce-Multi-Org-Fetcher/1.0'. This specific User-Agent has been associated with data theft from Salesforce instances, as detailed in a Google Cloud blog post. The detection aims to identify potential malicious activity targeting web server applications, specifically Salesforce environments, where an attacker might be attempting to exfiltrate data.
This rule detects inbound HTTP requests containing the User-Agent string 'Salesforce-CLI/1.0'. This activity is considered suspicious as it may indicate reconnaissance or data theft attempts targeting Salesforce instances, potentially leveraging compromised credentials or systems. The presence of this specific User-Agent inbound to a network could be an indicator of malicious activity, as Salesforce CLI is typically used by developers and administrators for managing Salesforce organizations and is not expected to be seen in inbound traffic from external networks to internal systems.
ET MOBILE_MALWARE Klopatra CnC Domain in DNS Lookup (guncel-tv-player-lnat .]com)
ET MOBILE_MALWARE Observed Klopatra Domain (guncel-tv-player-lnat .]com) in TLS SNI
ET MOBILE_MALWARE Observed Klopatra Domain (adsservice2 .org) in TLS SNI
This rule detects inbound network traffic attempting to exploit a path traversal vulnerability (CVE-2025-8088) related to RAR files and Alternate Data Streams (ADS). The detection logic specifically looks for a pattern indicative of path traversal attempts within the RAR file structure over raw TCP connections, excluding HTTP traffic. This exploit could allow an attacker to write files to arbitrary locations on a compromised system.
SQL Database Version Discovery
Suricata
This rule detects attempts to discover the version of a SQL database, often a precursor to SQL injection attacks or other reconnaissance activities. It specifically looks for SQL queries containing keywords like 'select' and 'version' in various common formats used to retrieve database version information.
ET MOBILE_MALWARE Observed Klopatra Domain (adsservices .uk) in TLS SNI
This rule detects network traffic indicative of a Windows Shortcut Link (LNK) file containing an unusually large amount of padded whitespace in its command line arguments. This technique is often used to obfuscate malicious commands or exploit vulnerabilities like ZDI-CAN-25373, which was a zero-day exploit related to Windows shortcuts. The rule specifically looks for the LNK file header signature and then uses a PCRE to identify repeated whitespace characters (tab, newline, vertical tab, form feed, carriage return, space) within the file data, suggesting padding for obfuscation or to bypass security controls.
This rule detects an attempt to exploit a path traversal vulnerability (CVE-2025-8088) in RAR files delivered via HTTP. The exploit leverages Alternate Data Streams (ADS) and specific path traversal patterns to potentially write files outside of the intended directory. The detection is based on the presence of 'STM' in the HTTP response body and a PCRE regex matching a specific path traversal pattern.
ET MOBILE_MALWARE Klopatra CnC Domain in DNS Lookup (adsservice2 .org)
ET WEB_SPECIFIC_APPS VMware Workspace ONE Access OAuth2TokenResourceController ACS Authentication Bypass (CVE-2022-22956)
Page 192 of 211