Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
61,046 detections
Filters
Last updated
All Time
Detection languages
23,955
16,903
4,364
4,342
3,270
Contributors
11,679
8,654
7,555
6,800
4,504
Categories
20,590
11,933
5,910
5,194
4,872
Platforms
40,154
7,369
6,547
3,915
3,692
Products / Services
10,809
9,795
6,757
4,421
3,771
MITRE Techniques
18,176
15,735
12,661
8,477
6,293
CVEs
71
71
64
58
49
IDS Classtypes
1,937
503
461
381
237
IDS Protocols
2,431
869
408
324
97
This rule detects outgoing HTTP POST requests to the 'velvet-otter-glagceis.life' domain path '/collect'. The request body contains indicators of victim fingerprinting, specifically looking for 'visitorId' and 'events' fields, characteristic of the Macfinger/ClickFix campaign used for gathering visitor telemetry for malicious purposes.
Detects network activity associated with the AMOS (Atomic macOS Stealer) malware, specifically identifying C2 registration/heartbeat beacons and tasking retrieval requests to known C2 URI paths over port 8133.
Detects network activity associated with the Sauron Loader, including TLS connections to specific C2 domains and repeated HTTPS POST requests to api.* subdomains indicating beaconing or polling behavior.
Detects outbound TLS traffic where the Server Name Indication (SNI) matches known command-and-control (C2) domains associated with the Sauron Loader malware. This indicates a compromised host attempting to communicate with malicious infrastructure.
Detects the execution of staged payloads from the Windows %TEMP% directory. This rule monitors for suspicious activity often associated with loader-style C2 execution, including direct execution of randomly named files, proxy execution via rundll32 or regsvr32, silent MSI installations, and the execution of payloads extracted from archives in temporary locations.
Detects the execution of staged payloads from the Windows %TEMP% directory. This rule monitors for suspicious activity often associated with loader-style C2 execution, including direct execution of randomly named files, proxy execution via rundll32 or regsvr32, silent MSI installations, and the execution of payloads extracted from archives in temporary locations.
Detects unpacked Sauron Loader DLL samples by identifying a specific embedded configuration header (magic 0xbaadf00d) followed by RSA key material length fields. This indicates the presence of malicious configuration structures associated with the Sauron Loader malware.
Detects activity associated with the Sauron Loader malware, specifically monitoring for the execution of rnpkeys.exe or loading of tdwp.dll, followed by a high volume of HTTPS POST requests to the same destination host, which is characteristic of chunked screenshot exfiltration.
Detects execution of rnpkeys.exe from the C:\ProgramData\keyroll\ directory, which is indicative of Sauron Loader side-loading activity, followed by an outbound network connection on port 443 within a 5-minute window. This behavior is consistent with the initial bot registration beaconing phase of the malware.
Detects network traffic consistent with AMOS Stealer command-and-control (C2) activity, specifically HTTP POST requests to the path '/api/t' on non-standard TCP port 8133. The rule includes a threshold to mitigate noise from single connections.
Detects HTTP POST requests to '/api/credentials' which is indicative of the AMOS (Atomic macOS) Stealer malware exfiltrating stolen credentials. The rule uses a threshold to identify multiple exfiltration attempts from the same source within a short time window.
Detects HTTP POST requests to '/api/credentials' which is indicative of the AMOS (Atomic macOS) Stealer malware exfiltrating stolen credentials. The rule uses a threshold to identify multiple exfiltration attempts from the same source within a short time window.
Detects the presence of Sauron Loader by matching known SHA-256 hashes of the MSI installer and associated side-loaded DLLs, or by identifying malicious PE files containing the 'Sauron' string.
Detects specific file hashes associated with Atomic macOS Stealer (AMOS) Mach-O payloads, which are often delivered via staging scripts on macOS systems.
Detects a Bash stager script associated with the AMOS (Atomic macOS Stealer) 'ClickFix' campaign. The script performs system architecture verification to download a specific Mach-O payload, makes the downloaded file executable using chmod, and subsequently executes the payload.
Detects DNS queries and TLS SNI traffic directed towards known domain names associated with the Sauron Loader command-and-control infrastructure. This rule identifies outbound communication attempts using hardcoded beaconing domains.
Detects instances where the Steam service (steamservice.exe) is executing suspicious child processes such as command interpreters or binaries located in unusual paths like Temp, Downloads, or AppData, often indicating an attempt to hide malicious activity under a trusted process.
This rule detects network connections to domains and IP addresses associated with known malicious TLS CA infrastructure (TLC DV TLS CA) identified by JA4X fingerprints. It monitors endpoint network telemetry for communication with identified command-and-control (C2) servers.
Detects potential JWT algorithm-confusion or authentication-bypass attempts
targeting WSO2 API Manager components through JWTs specifying unsupported,
downgraded, or unexpected signing algorithms such as "none" or HS256 where
asymmetric signing is expected. Matching events should be investigated to
determine whether the request represents exploitation of CVE-2026-5430.
targeting WSO2 API Manager components through JWTs specifying unsupported,
downgraded, or unexpected signing algorithms such as "none" or HS256 where
asymmetric signing is expected. Matching events should be investigated to
determine whether the request represents exploitation of CVE-2026-5430.
This rule detects network and email activity associated with a list of known suspicious or 'ghost' domains. It monitors email sender and recipient addresses, email URL links, and DNS query logs for matches against the predefined domain list, identifying potential spearphishing or command-and-control communication.
Detects browser extension manifest.json files requesting declarativeNetRequest and content_scripts/host_permissions covering AI assistant vendor domains (BragJack attack class)
Page 476 of 2907