Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
404 detections
Filters
Last updated
All Time
Detection languages
193
104
95
4
3
Contributors
90
77
62
50
22
Categories
231
151
101
83
77
Platforms
270
109
39
18
9
Products / Services
10,665
9,758
6,692
4,421
3,749
404
MITRE Techniques
138
119
74
64
47
CVEs
4
2
2
2
1
IDS Classtypes
1
IDS Protocols
1
This rule identifies potential Apple iCloud phishing attempts by monitoring web proxy logs for requests containing specific indicators of a spoofed 'Find My' page. It specifically looks for URLs that include '/help?' combined with keywords like 'Find Devices', 'Geräte finden', 'icloud', or 'findmy', which are common markers for malicious phishing landing pages attempting to harvest user credentials.
Detects HTTP requests directed to the Vapi.ai API from potential phishing panels or malicious infrastructure. This behavior is indicative of an attacker leveraging Vapi.ai's conversational AI services to conduct automated voice phishing (vishing) campaigns by initiating calls or managing AI assistants.
This rule detects anomalous network traffic patterns characteristic of the JWR phishing framework. It identifies live, operator-driven exfiltration where an attacker issues specific instruction sequences (e.g., to_card, to_sms, to_2fa) via HTTP polling or WebSockets to facilitate the character-by-character capture of sensitive information like payment card details and OTPs from a victim.
Detects proxy requests to typosquatted domains masquerading as major job platforms (LinkedIn, Indeed) that are serving suspicious file extensions (.hta, .ps1) often associated with the 'ClickFix' social engineering technique. This rule monitors for URLs mimicking these brands while attempting to deliver potentially malicious scripts to the user.
This rule monitors for two distinct stages of potential account recovery abuse. First, it detects the execution of suspected Python scripts on an endpoint that contain command-line arguments related to password recovery or authentication codes. Second, it monitors network proxy/web logs for a high volume of API requests to the 'easy4ipcloud.com' domain associated with password reset or device probe endpoints, which may indicate automated credential stuffing or unauthorized device account recovery attempts.
Detects outbound proxy traffic indicating potential Adversary-in-the-Middle (AiTM) phishing activity. The rule identifies requests directed at domains mimicking major Identity Providers (Microsoft, Okta, Duo, Google) that either utilize punycode homograph encoding or arrive via known URL shortener/redirector services, while filtering out known legitimate brand domains.
Detects network requests targeting specific public Polygon RPC endpoints that query a known smart contract associated with EtherHiding-style C2 activity. This rule monitors for RPC methods (eth_call, eth_getStorageAt) commonly used to retrieve embedded C2 instructions stored within blockchain state data, a technique known as leveraging smart contracts for command-and-control communication.
Detects outbound web requests where the referer header indicates the traffic originated from 'accounts.google.com' and the target URI contains 'gusercontent.com', excluding the legitimate 'googleusercontent.com' domain. This behavior is indicative of potential typosquatting or malicious redirection to a lookalike domain, often used in credential theft or phishing campaigns.
Detects outbound network requests to popular Large Language Model (LLM) API endpoints originating from processes that do not appear to be standard web browsers or identified legitimate development tools. This behavior may indicate an unauthorized script, malware, or compromised process attempting to use LLM APIs for C2, data exfiltration, or automated reconnaissance.
Detects attempts to perform prompt injection against internal Large Language Model (LLM) inference APIs. The rule monitors HTTP proxy logs for specific query parameters designed to trick the model into disclosing its underlying system instructions or hidden prompts.
Detects potential AI-targeted cloaking, a technique where a web server serves different content to AI crawlers versus human users, identified by comparing HTTP response sizes or hashes across session logs. The rule uses Microsoft Sentinel's ASIM Web Session schema to correlate web requests, identifying discrepancies that suggest malicious or evasive intent. Covers T1036 & T1027
Detects potential AI-targeted cloaking, a technique where a web server serves different content to AI crawlers versus human users, identified by comparing HTTP response sizes or hashes across session logs. The rule uses Microsoft Sentinel's ASIM Web Session schema to correlate web requests, identifying discrepancies that suggest malicious or evasive intent. Covers T1036 & T1027
Detects potential AI-targeted cloaking, a technique where a web server serves different content to AI crawlers versus human users, identified by comparing HTTP response sizes or hashes across session logs. The rule uses Microsoft Sentinel's ASIM Web Session schema to correlate web requests, identifying discrepancies that suggest malicious or evasive intent. Covers T1036 & T1027
Detects anomalous, high-frequency, and highly regular HTTP requests directed at Dahua camera infrastructure for the purpose of harvesting snapshots. The rule uses statistical analysis to identify automated collection patterns, such as a high volume of requests across multiple devices with low variance in request intervals.
This rule detects email or web proxy traffic containing a lure themed around 'Confluence', combined with a redirect or link to Telegram, and specifically containing Cyrillic character sets. This combination is often indicative of targeted phishing campaigns using social engineering lures to redirect users to external messaging platforms for further interaction or credential harvesting.
Detects signs of the TrustSink technique where an Entra sign-in process, while at the MFA stage, is intercepted by redirecting the user to a rogue External Authentication Method (EAM) provider. This unauthorized provider typically uses look-alike domains or tunneling services to host phishing pages that harvest plaintext credentials and return forged MFA tokens to Entra.
This rule detects potential Adversary-in-the-Middle (AiTM) phishing attacks targeting Microsoft 365 authentication flows. It identifies suspicious proxy traffic that contains authentication-related URIs or session-related cookies (such as ESTSAUTHPERSISTENT or refresh tokens) originating from hosts other than recognized Microsoft domains. This behavior is indicative of an attacker using a reverse proxy, such as Evilginx2, to intercept user credentials and session cookies in real-time.
Detects download or installation attempts of specific trojanized versions (2.35 and 2.36) of the Admin Menu Editor Pro plugin, which were distributed via a compromised update channel on adminmenueditor.com.
Detects outbound network traffic to the GitHub API, a known communication channel for the RUSTYSHADE malware and APT36 (Transparent Tribe) threat group, occurring outside of a previously observed operational cadence (weekdays 04:00-11:00 UTC). Deviations from this baseline pattern on weekends or off-hours suggest unauthorized C2 activity or changes in actor infrastructure.
Detects potential installation of compromised Admin Menu Editor Pro plugin updates by identifying sequential download events for specific plugin versions from the 'adminmenueditor.com' domain within a 24-hour window. This behavior is indicative of a supply chain attack where a legitimate update mechanism is leveraged to deliver malicious payloads without integrity verification.
Detects repeated polling activity against a suspected device code endpoint, common in OAuth 2.0 device authorization grant phishing attacks where an adversary attempts to maintain session persistence or status checks for a stolen device code.
Page 3 of 20