Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
6,537 detections
Filters
Last updated
All Time
Detection languages
3,970
998
598
428
233
Contributors
1,363
1,250
1,066
954
384
Categories
2,933
2,196
2,017
1,857
1,411
Platforms
39,936
7,266
6,537
3,866
3,647
Products / Services
4,107
2,418
1,587
270
254
MITRE Techniques
1,450
1,310
1,022
934
696
CVEs
46
46
33
18
12
IDS Classtypes
1,753
458
404
325
220
IDS Protocols
2,202
773
381
300
93
MicroStealer Network IOCs
Cortex XDR
Detects network communication to known MicroStealer C2 domains or Discord webhook activity with a 'MicroStealer/1.0' user agent. This rule identifies potential MicroStealer malware activity within the network.
Detects network traffic matching the specific URI structure used by LeakNet for command-and-control beaconing. This behavior has been consistently observed across multiple LeakNet incidents following initial access.
This rule detects network connections or email URLs that contain domains associated with the 'ShinyHunters' threat group's infrastructure. The rule specifically looks for a predefined list of domains known to be used by ShinyHunters for phishing or other malicious activities. It correlates email URL information with device network events to identify potential compromise attempts.
Detects network traffic to known VOID#GEIST C2 domains hosted on TryCloudflare, or the specific command-line execution of `curl.exe` used to send a 'status=success' beacon. This activity confirms a successful compromise by the malware.
This detection identifies network requests matching a URL pattern used by the Coruna iOS exploit kit to deliver encrypted binary payloads. The framework generates resource URLs using a 40-character hash and serves them as files ending in ".min.js".
This rule detects DNS queries for domains matching the pattern used by the PLASMAGRID implant's Domain Generation Algorithm (DGA). The implant, associated with the Coruna exploit kit, generates 15-character domains with a .xyz TLD as a C2 fallback mechanism.
Detects network connections to domains identified as being part of the DarkSword iOS exploit kit delivery or command-and-control infrastructure. The DarkSword exploit kit is actively being used by multiple threat actors (UNC6353, UNC6748, PARS Defense) to target iOS users.
Detects HTTP/HTTPS traffic where the User-Agent string is explicitly set to 'MicroStealer/1.0', which is used by the malware when communicating with Discord webhooks or its C2.
Detects command and control (C2) communication to a specific Telegram Bot API endpoint hardcoded in the LampoRAT malware. This activity is associated with the Boggy Serpens (MuddyWater) threat actor.
Detects C2 communication from Boggy Serpens (MuddyWater) backdoors like Nuso and BlackBeard, which use non-standard HTTP status codes (201, 202, 418) to receive commands from known C2 servers.
Detects DNS resolution requests to the Operation GhostMail exfiltration subdomains (*.i.zimbrasoft.com.ua) and main domain. DNS exfiltration is the primary channel used by this APT to steal credentials and 2FA codes even when HTTPS is blocked.
Detects potential data exfiltration by the BlackBeard backdoor, associated with Boggy Serpens (MuddyWater). The malware abuses the HTTP 'Expires' header in client requests to exfiltrate encrypted system data to its command and control server. The 'Expires' header is a standard response header, so its presence in a request is highly anomalous.
Detects web requests for specific JavaScript file names that are part of the DarkSword iOS exploit chain. The presence of these requests strongly suggests a device is being targeted with the exploit kit.
Detects potential DNS tunneling, a technique used by the Mori backdoor (associated with MuddyWater), by identifying an unusually high volume of long DNS queries from a single source. This could indicate C2 communication or data exfiltration.
This rule detects network traffic containing specific User-Agent strings used by the BurrowShell implant and the Rust-based keylogger to masquerade as legitimate Windows Update or browser traffic. These User-Agent strings are 'Windows-Update-Agent/10.0.10011.Client-Protocol/2.50' and 'Mozilla/5.0 (compatible; SecureNet/1.2)'.
This rule detects network connections to or from known suspicious IP addresses and requests to known suspicious domains. These indicators are often associated with command and control (C2) activity, malware distribution, or other malicious infrastructure.
Detects a FortiGate configuration file download followed by the creation of a new computer account in Active Directory by the 'fortidcagent' service account within a short time window. This pattern may indicate an attacker has compromised a FortiGate appliance, extracted credentials from the configuration, and is now using them to join a rogue device to the domain for lateral movement.
Detects a FortiGate configuration file download occurring within 10 minutes of a successful administrative login from the same user and source IP address. This rapid sequence of events can indicate an attacker who has gained administrative access and is proceeding to exfiltrate sensitive configuration data, which may contain credentials for other systems.
Detects DNS queries for domains associated with an active adversary-in-the-middle (AiTM) phishing campaign targeting AWS credentials.
Detects attempts to bypass authentication in SolarWinds Web Help Desk by exploiting the page restoration mechanism (CVE-2025-40552, CVE-2025-40554). An attacker can specify a sensitive page via the 'wopage' parameter to gain access to post-authentication functionality without valid credentials.
Detects HTTP POST requests to "/api/get_challenge" or "/api/get_credentials" on port 5000. This is the initial communication pattern of the TunnesshClient backdoor, a component of the BoryptGrab campaign, to retrieve SSH credentials from its C2 server before establishing a reverse SSH tunnel.
Page 258 of 312