Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
6,537 detections
Filters
Last updated
All Time
Detection languages
3,970
998
598
428
233
Contributors
1,363
1,250
1,066
954
384
Categories
2,933
2,196
2,017
1,857
1,411
Platforms
39,936
7,266
6,537
3,866
3,647
Products / Services
4,107
2,418
1,587
270
254
MITRE Techniques
1,450
1,310
1,022
934
696
CVEs
46
46
33
18
12
IDS Classtypes
1,753
458
404
325
220
IDS Protocols
2,202
773
381
300
93
Detects HTTP POST requests destined for specific PHP endpoints (/res.php, /tele.php) frequently used by the BlobPhish campaign to exfiltrate stolen credentials from memory-resident phishing pages.
Detects network requests to known malicious domains associated with the fake RedAlert Android malware campaign used by pro-Iranian actors, acting as a payload host or C2 endpoint.
Detects HTTP POST requests to specific URI paths (res.php, tele.php) commonly associated with BlobPhish credential exfiltration. This rule identifies attempts to send stolen credentials or other sensitive data to attacker-controlled endpoints.
Detects HTTP POST requests to /panel.php. This endpoint is frequently used by the BlobPhish campaign for backend C2 interaction or validation checks, often accompanied by an empty request body and a specific JSON error response.
Detects the presence of specific JavaScript functions used to generate and handle Blob objects in memory. This technique is utilized by the BlobPhish campaign to keep the phishing payload in memory, thereby evading file and network scanning.
This rule detects potential network reconnaissance activity by looking for keywords such as 'scan', 'sweep', 'probe', 'recon', 'nmap', and 'nessus' within the 'Message' field of CommonSecurityLog entries. This could indicate an adversary actively gathering information about the network infrastructure.
This rule identifies potential network scanning or high-volume communication by detecting a large number of connections (50 or more) between a single source IP and a single destination IP within a 5-minute time window. It aggregates connection details such as total connections, sent bytes, and received bytes from the CommonSecurityLog.
This rule detects potential internal network scanning activity by identifying a single source IP address that communicates with 15 or more distinct internal destination IP addresses within a 5-minute time window. This behavior is often indicative of reconnaissance efforts by an attacker attempting to map out the internal network.
This rule detects potential network port scanning activity by identifying a single source IP address attempting to connect to 10 or more distinct destination ports on a single destination IP address within a 5-minute window. This behavior is indicative of an attacker attempting to discover open services on a target host.
This rule alerts when Cato's inline Anti Malware engine identifies a file in transit as malicious. It fires on both blocked and allowed malware to catch cases where the engine detects but fails to block, indicating a potential compromise or a misconfiguration requiring immediate investigation.
Cisco Dot1x Disabled
Sigma
Detects the manual disablement of IEEE 802.1X (dot1x) on a Cisco network device interface.
Disabling dot1x bypasses Network Access Control (NAC) mechanisms, potentially allowing unauthorized devices to gain access to the internal network.
This activity is a common technique used by attackers or malicious insiders to establish persistence or perform lateral movement via rogue devices.
Disabling dot1x bypasses Network Access Control (NAC) mechanisms, potentially allowing unauthorized devices to gain access to the internal network.
This activity is a common technique used by attackers or malicious insiders to establish persistence or perform lateral movement via rogue devices.
Monitors for the specific URL pattern used by the PhantomPull loader to fetch the final PhantomPulse payload via WinHTTP. This behavior is associated with the REF6598 campaign.
Detects network connections to Masjesu's hardcoded fallback command and control IP addresses over port 443. This rule is critical for detecting mature infections where Masjesu actively falls back to a set of hardcoded IP addresses if domain resolution fails.
Detects DNS resolution requests for known Masjesu botnet command and control (C2) domains. Masjesu relies on multiple failover domains to fetch its secondary payload and receive DDoS commands.
Detects DNS requests directed to the cloudapi[.]stream domain, which is associated with a widespread malicious Chrome extension campaign involving over 100 extensions. Monitoring for this specific domain allows defenders to identify compromised hosts regardless of the specific extension ID.
Detects network connections to the primary staging server IP address (195.3.222.251) used to host the intermediate PowerShell script and the PhantomPull loader associated with the REF6598 campaign and the PhantomPulse RAT.
Detects HTTP requests containing the VS/PL/AN parameter combination used by JanelaRAT for C2 beaconing. The beacon reports malware version (VS), profile level (PL), and presence of banking security software (AN). JanelaRAT targets Latin American financial institutions (Brazil, Mexico). Note: C2 uses port 443 WITHOUT TLS encryption.
Detects network connections over FTP (port 21) to specific compromised IP addresses abused by the LucidRook malware. The threat actor utilizes these Taiwanese FTP servers to stage payloads and receive exfiltrated data.
Turn off logging locally or remote
KQL Query- List of known malicious IPs associated with Iranian-affiliated APT exploiting PLCs
Cisco Clear Logs
Sigma
Clear command history in network OS which is used for defense evasion
Page 255 of 312