Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,139 detections
Filters
Last updated
All Time
Detection languages
3,217
1,086
504
478
469
Contributors
1,824
1,607
872
505
300
Categories
2,971
2,471
1,060
1,026
908
Platforms
39,762
7,139
6,517
3,851
3,599
Products / Services
1,324
1,067
970
657
487
MITRE Techniques
2,228
1,317
1,314
873
871
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
Detects the execution of known enumeration shell scripts (opsec_enum.sh, oops_enum.sh) using common Unix command interpreters (bash, sh, dash). These scripts are commonly used by threat actors during the post-exploitation reconnaissance phase to gather system or environment information.
Detects anomalous network connections to HTTP/S ports (80, 443, 8080) by suspicious processes (e.g., Python, Netcat, Socat) or those executing known tunneling/web shell scripts (Neo-reGeorg, Chisel). This rule identifies potential egress-blocked environment bypass attempts by monitoring for high-frequency outbound connections that deviate from standard browser or signed-application behavior.
Detects outbound network connections to specific known malicious egress IP addresses associated with Operation Escaneo, utilizing the Wget user agent to request the '/pwned' resource over port 8888, indicative of SOCKS5-tunneled data exfiltration.
Matches the hardcoded VAPID Public Key string used by the extension to bypass browser sandboxes and wake the service worker, indicative of the SNOWBELT malware's command and control mechanism.
Detects the installation of specific Chrome browser extensions associated with the 'BadBlocker' campaign. These extensions are known to request broad host permissions, allowing them to access data across all websites, which can lead to sensitive information theft, credential harvesting, or session hijacking.
Detects HTTPS POST requests to known attacker-controlled infrastructure associated with the BadBlocker campaign (e.g., Unistream SDK, adblock-for-youtube domains). These requests often originate from browser extensions via injected scripts, facilitating the potential exfiltration of sensitive browser session data or credentials.
Detects the 'Adblock for YouTube' browser extension (cmedhionkhpnakcndndgjdbohmhepckk) initiating network connections to api.adblock-for-youtube.com to fetch scriptlets. This behavior is associated with bypassing URL validation to enable script injection on non-YouTube domains.
Detects behavior associated with the 'Adblock for YouTube' browser extension (ID: cmedhionkhpnakcndndgjdbohmhepckk) involving the injection of arbitrary JavaScript into the MAIN world of web pages. This occurs via remotely fetched script rules and the use of 'trusted-create-element' or similar methods to bypass browser sandboxing for script tag insertion and DOM access.
Detects behavior indicative of the 'Adblock for YouTube' browser extension (or associated malicious variants) fetching rule configuration files from 'api.adblock-for-youtube.com', followed by suspicious outbound network traffic to non-Google/YouTube domains. This pattern suggests the extension is performing unauthorized data exfiltration, such as harvesting session cookies or credentials via injected scripts.
Detects DNS requests originating from endpoints targeting the 'adblock-for-youtube.com' domain. This activity may be associated with browser extensions that exhibit unexpected or potentially unwanted network behavior.
This rule detects the execution of common system discovery commands (such as uname, ifconfig, netstat, ip, and file reading of sensitive paths) by interpreter processes (sshd, bash, sh, python) or vmanage-related processes. This activity is often associated with post-exploitation reconnaissance, where an adversary attempts to map system or network configurations.
Detects credential and session data exfiltration by browsers communicating with Bluekit PhaaS-associated domains or Telegram API webhooks. The rule filters network traffic originating from common web browsers to known malicious domains associated with Bluekit infrastructure or to the public Telegram API for automated exfiltration.
Detects the execution of Node.js processes associated with hijacked npm packages 'html-to-gutenberg' and 'fetch-page-assets'. The rule monitors for 'node' or 'node-gyp' processes spawned in conjunction with command-line arguments or file paths referencing these specific malicious packages, which are known to use binding.gyp command expansion for unauthorized code execution.
Detects HTTP requests initiated by common browser adblock extensions to remote API endpoints for retrieving rule configuration files. This behavior can be exploited by adversaries to perform remote scriptlet injection or change extension behavior via server-side updates, potentially enabling unauthorized JavaScript execution in the browser's context.
Detects the execution of a malicious npm package (scope squatting on @withgoogle/stitch-sdk) that runs a preinstall script designed to harvest sensitive credentials (Claude, Git, SSH, GitHub, npm, Docker) and exfiltrate them to the domain 'stitch-production.org'.
Detects the presence of known malicious browser extensions by their extension ID or extensions that declare overly permissive host access ('<all_urls>') in combination with suspicious naming conventions associated with common ad-blocking malware.
This rule detects the use of 'chmod' or 'chown' commands on critical system directories ('/etc', '/bin', '/usr', '/sbin') on Cisco vManage, vSmart, and vEdge networking appliances. Such activity could indicate unauthorized modification of system files, persistence attempts, or privilege escalation by an adversary targeting the networking infrastructure.
This rule detects network activity associated with known malicious browser extensions identified as 'AdBlock' variants. It monitors for connections to the domain 'api.adblock-for-youtube.com' or requests to '/api/v2/rules' made by specific extension IDs that are known to perform unauthorized or suspicious activities.
Detects execution of native Go binaries associated with the Overlord C&C framework (UNK_DeadDrop). The detection logic specifically looks for process events where the filename starts with 'google-update-support-' and contains either 'amd64' or 'arm64', indicating architecture-specific binaries.
Detects indicators of the MYRA Linux RAT, including fileless execution via memory-based techniques (memfd_create/fexecve), process masquerading as systemd-userdbd, and persistence mechanisms leveraging LD_PRELOAD and malicious cron jobs.
Detects a multi-stage infection sequence characteristic of common IoT botnets (such as Mirai variants). The detection triggers when a sequence of events occurs on the same device within a 5-minute window: downloading a file from a URL using wget or curl to /tmp/, modifying the file permissions using chmod 777, and subsequently executing the binary. An optional cleanup phase involving removal of files from /tmp/ is also correlated.
Page 240 of 340