Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,594 detections
Filters
Last updated
All Time
Detection languages
2,463
65
36
12
11
Contributors
991
707
594
140
61
Categories
2,159
1,453
1,273
576
444
Platforms
2,418
272
203
71
63
Products / Services
10,670
9,758
6,693
4,421
3,749
2,594
MITRE Techniques
808
512
383
246
210
CVEs
18
12
12
12
10
IDS Classtypes
1,144
447
282
188
105
IDS Protocols
1,378
413
318
209
34
Detects network activity related to the exploitation of the CVE-2025-31702 vulnerability in Dahua P2P Relay services. The rules monitor for probe attempts, device parameter fetching (randsalt), serial number enumeration bursts, and successful no-auth channel responses, indicating a bypass of authentication mechanisms on vulnerable Dahua devices.
Detects a multi-stage network communication pattern characteristic of agent sandbox evasion and subsequent data exfiltration. The rule first identifies an unusual volume of connections to URL-shorteners using encoded fragments in the URI, and subsequently flags calls to common screenshot or rendering services containing 'url=' parameters, suggesting possible pixel-based data exfiltration over a command and control channel.
Detects network traffic consistent with a hardcoded C2 channel used by PolinRider or NullReceiver malware families. The rule monitors TCP traffic directed to a specific IP address (193.26.115.131) and port (15152) that contains serialized command/status structures formatted with specific JSON-like content patterns.
Detects network activity, including HTTP requests and TLS SNI traffic, directed towards the known GRIMWEDGE C2 domain 'ocr.opusaccel.top'. This includes monitoring for repeated polling behavior indicative of a command and control heartbeat mechanism.
Detects a network request to download a file named 'msgbox.exe' using the curl command-line utility, consistent with the activity observed from threat actor UTA0560 (GRIMWEDGE). This rule monitors for HTTP GET requests targeting the specific file path while the User-Agent string begins with 'curl/'.
Detects network indicators associated with the BambooToken C2 infrastructure, including DNS lookups for specific domains, TLS SNI mismatches, non-standard MQTT port usage, and specific command-and-control tasking keywords within MQTT payloads.
This rule detects HTTP GET requests containing suspicious URL query parameters (nfe_valid_access_key_2026_secure or chave_tecl_cresol) that are associated with phishing kits targeting Brazilian taxpayers, often used to deliver or facilitate HVNC (Hidden Virtual Network Computing) remote access tools.
Detects periodic outbound network traffic to the Telegram Bot API (api.telegram.org) indicative of potential command and control (C2) beaconing, specifically monitoring for repeating connections over extended time intervals.
Detects outbound HTTP GET requests containing an 'auth=' parameter with a long string of alphanumeric characters, characteristic of an OAuth token exfiltration attempt by a malicious Twitch extension (JeetBot). The rule flags requests to external destinations that are not official Twitch, Twitch Video Network, or JTV domains.
Detects network traffic associated with the WallStealer malware, including the download of malicious payloads from a known C2 server, communication with a cryptominer C2, and the use of Steam Community profiles as dead-drop resolvers for C2 instructions.
Detects network communication associated with the Cyclops Blink modular malware, specifically targeting known Sandworm C2 IP addresses and non-standard ports used for firewall rule manipulation and C2 beaconing. The rule identifies both inbound and outbound traffic, including potential TLS handshakes on specific non-standard ports.
Detects network traffic associated with the RatHat Android RAT, specifically monitoring for HTTP and TLS connections to the command and control (C2) delivery domain 'kingbss.com', as well as detecting characteristic FRP (Fast Reverse Proxy) client login handshake patterns used for tunnel establishment.
Detects network communication associated with the Rapuncel MaaS (Malware-as-a-Service) campaign, specifically identifying the Command and Control (C2) connection, GitHub Pages-based redirect chains, and subsequent delivery of large, suspicious ZIP archives containing renamed executable/system files.
This rule detects potential NTLM relay or authentication downgrade attempts by monitoring HTTP POST requests to the Certificate Enrollment Service (CES) endpoint. It specifically flags when an 'Authorization' header contains an NTLM-wrapped 'Negotiate' token, which is often indicative of an attacker attempting to coerce or relay authentication material to the service.
Detects malicious network activity associated with TokenGrabber stealer malware, specifically identifying outbound HTTP requests to public IP lookup services (api.ipify.org) followed by chained geolocation lookups (ip-api.com). This behavior is characteristic of an initial reconnaissance phase where the malware determines the victim's external network footprint.
Detects malicious network activity associated with TokenGrabber stealer malware, specifically identifying outbound HTTP requests to public IP lookup services (api.ipify.org) followed by chained geolocation lookups (ip-api.com). This behavior is characteristic of an initial reconnaissance phase where the malware determines the victim's external network footprint.
This rule detects network traffic containing the specific 'Xwormmm' string in the payload, which serves as a handshake or banner characteristic of XWorm command-and-control (C2) communications.
Detects HTTP responses containing SocGholish (FakeUpdates) malware delivery signatures. The rule monitors for a 200 HTTP status code, a content type of 'javascript', and the presence of the specific string 'NDSW' in the response body, which is a known indicator of the SocGholish JavaScript-based loader.
Detects outbound HTTP POST requests to known blockchain RPC endpoints (bsc-dataseed and rpc.ankr.com) that utilize the 'eth_call' method. This behavior is associated with the ClearFake malware strain using the EtherHiding technique, where malicious scripts or payloads are hidden or retrieved via blockchain smart contracts.
This rule monitors HTTP traffic for requests containing 'bp.dat', which is associated with the registration phase of the Latrodectus malware downloader. It detects both URI-based and request body-based attempts by an infected host to register with a command and control server.
Detects HTTP traffic patterns associated with the SocGholish Traffic Distribution System (TDS). The rule identifies an HTTP 302 redirect response where the 'Location' header points to a URL containing 'update' and a .js extension, a characteristic behavioral signature used by SocGholish for its drive-by-download campaigns.
Page 23 of 124