Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
6,535 detections
Filters
Last updated
All Time
Detection languages
3,970
998
596
428
233
Contributors
1,363
1,250
1,066
954
384
Categories
2,931
2,196
2,017
1,857
1,411
Platforms
39,921
7,246
6,535
3,864
3,627
Products / Services
4,107
2,418
1,585
270
254
MITRE Techniques
1,450
1,310
1,022
934
696
CVEs
46
46
33
18
12
IDS Classtypes
1,753
458
404
325
220
IDS Protocols
2,202
773
381
300
93
Detects network connections to the URI path '/employment/documents-and-resources', which is used by FrostyNeighbor's PicassoLoader to exfiltrate host fingerprinting data and assess compromised hosts for further payload delivery.
Monitors Cisco Catalyst SD-WAN Controller logs for successful administrative logins. This may indicate exploitation of an authentication bypass vulnerability granting unauthorized admin access.
Detects Cisco SD-WAN control connection state changes indicating a new 'vmanage' peer connection from an unauthorized IP address. This rule is designed to identify potential exploitation of vulnerabilities like CVE-2026-20182, where attackers establish unauthorized infrastructure ties by creating new vManage peer connections. The rule filters for syslog messages from the Viptela-vSmart-VDAEMON indicating a 'control-connection-state-change' with 'new-state:up' and 'peer-type:vmanage', and then excludes connections from a list of authorized vManage IP ranges.
This rule detects DNS queries to known malicious domains associated with the Tycoon2FA phishing campaign. These domains are used for anti-bot verification during the attack chain, which typically involves hijacking Microsoft 365 accounts via device code phishing.
Detects network connections or DNS queries to known lookalike domains utilized by UNC6671 (BlackFile) for adversary-in-the-middle (AiTM) credential harvesting and real-time MFA bypass during vishing operations.
This rule detects DNS requests to hyphen mirrored domains. This tactic has been seen from Silver Fox to deliver the Atlas RAT via Weaponized VPN Installers. Known bad according to the Hexastrike article
trezor-trezor[.]com
signal-signal[.]com
quickq-quickq[.]com
eyy-eyy[.]com
trezor-trezor[.]com
signal-signal[.]com
quickq-quickq[.]com
eyy-eyy[.]com
Tycoon2FA Domain Network Traffic
Cortex XDR
Detects DNS queries or network connections resolving to known Tycoon2FA credential harvesting, kill switch, and link management domains post-takedown. This rule specifically targets precise indicators of compromise (IoCs) associated with the rebuilt Tycoon2FA infrastructure.
Tycoon2FA Kit URL Parameters
Cortex XDR
Identifies network traffic containing the distinct 'bltpg' and 'sid' parameters used by the Tycoon2FA credential harvesting platform. This rule specifically looks for HTTP network data containing both 'bltpg=' and 'sid=' within the action_network_http field, which are indicative of the Tycoon2FA phishing kit's communication patterns. The rule then deduplicates alerts based on agent hostname and remote IP to reduce alert volume.
FDMTP C2 Registration Request
Cortex XDR
Detects network HTTP requests to the '/GetCluster' endpoint containing the 'DotNet-TcpDmtp' protocol parameter, a specific C2 registration pattern used by the updated FDMTP backdoor.
Tycoon2FA Infrastructure IP Connections
Cortex XDR
Detects network traffic to IP addresses confirmed to host Tycoon2FA post-takedown components, including link management, credential harvesting, and kill switch infrastructure.
Detects network connections, DNS queries, or web requests to domains associated with the Mini Shai-Hulud supply-chain attack.
This attack compromised multiple npm and PyPI packages (such as TanStack, Mistral AI, and UiPath) with a payload that exfiltrates harvested credentials to the Session messaging protocol's file server and downloads additional stages from attacker-controlled domains.
This attack compromised multiple npm and PyPI packages (such as TanStack, Mistral AI, and UiPath) with a payload that exfiltrates harvested credentials to the Session messaging protocol's file server and downloads additional stages from attacker-controlled domains.
POW Proxy-over-Web Custom HTTP Headers
Cortex XDR
Detects HTTP traffic containing the custom POST headers used by the SHADOW-AETHER-064 'POW' (Proxy over Web) tool to encapsulate SOCKS5 traffic inside HTTP requests forwarded through JSP webshells. The full header set per Trend Micro's analysis is X-Act, X-Sid, X-Host, X-Port, and X-Status. The X-Act header carries one of five specific command values (CONNECT, SEND, RECV, DISCONNECT, PING) which provides an additional fidelity boost. The combination of two or more of these headers in a single HTTP transaction is exclusive to the POW tool.
Detects network connections to known REF6598 staging and command-and-control infrastructure, including a hardcoded staging IP and PHANTOMPULSE panel domains. This provides a high-fidelity signal of active PHANTOMPULSE infections and potential data exfiltration attempts.
This rule detects exploitation attempts targeting CVE-2026-0300 in Palo Alto Networks PAN-OS. It identifies suspicious network connections to User-ID Authentication Portal ports (6081, 6082) from external IP addresses, excluding RFC1918 and loopback ranges. Additionally, it looks for a specific anomalous User-Agent string associated with the CL-STA-1132 threat actor, which has been observed during exploitation of this vulnerability.
Detects DNS requests or network connections to the typosquatted domain and hardcoded IP associated with the DAEMON Tools supply chain attack, as well as additional network relations tied to the installer.
Detects the malformed User-Agent string used by CL-STA-1132 during exploitation
of CVE-2026-0300 (PAN-OS Captive Portal buffer overflow). The UA is structurally
invalid (Safari token precedes Mozilla token, Mozilla/5.5 is non-standard) and
has no known legitimate origin.
of CVE-2026-0300 (PAN-OS Captive Portal buffer overflow). The UA is structurally
invalid (Safari token precedes Mozilla token, Mozilla/5.5 is non-standard) and
has no known legitimate origin.
Detects truncated 'whostmgrsession' cookies missing the comma delimiter, which is a necessary step for attackers to inject cleartext CRLF payloads into cPanel session files and bypass authentication. This rule specifically looks for the 'whostmgrsession' cookie in web or proxy logs where the cookie value matches a regex pattern indicating the absence of the expected comma delimiter, a characteristic of the CVE-2026-41940 exploitation.
Detects the generation of pre-authentication session cookies via intentionally failed login attempts to the `login_only` endpoint. This detects the initial staging phase of the CVE-2026-41940 exploit chain.
CL-STA-1132 Specific User-Agent
Cortex XDR
Detects network traffic utilizing the highly specific and anomalous User-Agent string used by CL-STA-1132 during the exploitation and post-exploitation of CVE-2026-0300.
Detects DNS lookups and outbound network connections to known PhantomRaven command and control (C2) infrastructure, including specific domains and IP addresses. The rule also specifically identifies potential data exfiltration attempts to the '/mozbra.php' endpoint.
Detects inbound network connections from external, non-private IP addresses to local ports 6081 and 6082. These ports are used by the PAN-OS User-ID Authentication Portal, which is actively targeted by CVE-2026-0300.
Page 253 of 312