Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,594 detections
Filters
Last updated
All Time
Detection languages
2,463
65
36
12
11
Contributors
991
707
594
140
61
Categories
2,159
1,453
1,273
576
444
Platforms
2,418
272
203
71
63
Products / Services
10,665
9,758
6,693
4,421
3,749
2,594
MITRE Techniques
808
512
383
246
210
CVEs
18
12
12
12
10
IDS Classtypes
1,144
447
282
188
105
IDS Protocols
1,378
413
318
209
34
Detects SMB traffic targeting the IPC$ share within the internal network, which is a common behavior of PIVOTPIPE lateral movement techniques using SMB named pipes for peer-to-peer (P2P) beacon communication.
This rule detects network communication to known malicious IP addresses or sessions utilizing TLS certificates that impersonate the Uzbekistan railway authority (azure.uzrailwaystax). This behavior is characteristic of the SpiceRAT/NodeEdgeRAT malware families, which use these specific certificates to establish Command and Control (C2) channels.
Detects exfiltration of sensitive information, including Dahua camera credentials and internal identifiers, to the Telegram Bot API over HTTPS. These rules monitor for specific API endpoints (/sendPhoto) and common credential patterns (Login:, Password:, Model:) or indicators (Shodan links, VKontakte references) within HTTP POST requests directed toward api.telegram.org.
Detects attempts to exploit CVE-2021-33045, an authentication bypass vulnerability in certain Dahua camera firmware. The attack involves sending a crafted login request containing 'global.login', 'clientType', and 'Loopback' parameters, which allows an attacker to bypass authentication mechanisms.
Detects HTTP POST requests directed to the URI path '/api/credentials' over the non-standard TCP port 8133, which is indicative of AMOS (Atomic macOS) Stealer exfiltrating stolen credentials to a C2 server.
Detects HTTP POST requests directed to the URI path '/api/credentials' over the non-standard TCP port 8133, which is indicative of AMOS (Atomic macOS) Stealer exfiltrating stolen credentials to a C2 server.
Detects network activity associated with the 'ClickFix' social engineering campaign, specifically targeting the 'Macfinger' variant. This involves detecting the fetching of obfuscated tracker JavaScripts (t.js), the delivery of deceptive 'Bot Protection' overlay HTML prompts used to trick users into executing malicious code, and network connections to known C2 infrastructure.
Detects network activity associated with the 'ClickFix' social engineering campaign, specifically targeting the 'Macfinger' variant. This involves detecting the fetching of obfuscated tracker JavaScripts (t.js), the delivery of deceptive 'Bot Protection' overlay HTML prompts used to trick users into executing malicious code, and network connections to known C2 infrastructure.
Detects Xray-core C2 tunnel traffic where the TLS SNI is spoofed to appear as 'dl.google.com'. The detection specifically looks for this behavior originating from non-browser processes such as 'wkspbroker.exe' or 'radcui.dll', which is indicative of malicious tunneling activity.
Detects HTTP and TLS traffic patterns indicative of data exfiltration to Slack, specifically targeting hardcoded Slack API tokens, Slack channel IDs in HTTP request bodies, or traffic directed to hooks.slack.com, commonly associated with malicious npm packages.
Detects network activity indicating interaction with known Adversary-in-the-Middle (AiTM) phishing infrastructure. This includes direct outbound connections to specific suspicious IP addresses and the identification of proxied Microsoft 365 OAuth authorization flows redirected to non-Microsoft hosts.
This rule monitors outbound TLS traffic to detect communication with public Slack or Telegram webhook APIs, which are commonly abused by malware or malicious Node.js/npm packages for data exfiltration or command-and-control (C2) operations.
This rule detects potentially malicious Command and Control (C2) traffic utilizing DNS over HTTPS (DoH) to interact with public resolvers like Cloudflare, Google, and Quad9. It identifies both high-frequency, repeated direct-to-resolver TLS sessions and specific HTTP requests to these resolvers that resolve domains associated with known C2 infrastructure, such as the ClickFix campaign.
Detects the NeedyMantis main-component handshake: an HTTP GET to port 443 with a User-Agent that is EXACTLY the hard-coded literal 'firefox/21.0' (anchored start+end) and an explicit 'Upgrade: websocket' header, marking the HTTPS-to-WebSocket protocol switch used before the RC4 key exchange. Restricting to port 443 and requiring an exact (not substring) UA match removes generic WebSocket apps and any traffic where 'firefox/21.0' merely appears inside a real, longer browser UA string.
Detects HTTP responses containing a file named 'ClaudeDesktop.exe' served from paths containing '/artifacts/' on the 'claude.ai' host where the request referrer is not 'claude.ai' or 'anthropic.com', suggesting a malvertising or supply chain delivery attempt of a malicious installer.
Detects DNS queries, TLS SNI headers, and HTTP host headers associated with the known exfiltration domain 't.m-kosche.com' linked to the Mini Shai-Hulud malware.
Detects network traffic directed towards Telegram shortened URLs (t.me) which is a common command-and-control (C2) communication channel used by Vidar and other malware families to exfiltrate data or retrieve instructions.
Detects network activity associated with the ErrTraffic malware, specifically targeting JSON-RPC 'eth_call' requests to Polygon blockchain smart contracts used for C2 resolution and subsequent DNS queries to known malicious domains used for C2 infrastructure.
Detects outbound network traffic from internal hosts to known IP addresses associated with Exvicy Malware-as-a-Service (MaaS) Command and Control (C2) or hosting infrastructure. This rule acts as an indicator of compromise (IOC) match to identify potential infected hosts communicating with malicious external servers.
Detects HTTP POST requests to SharePoint ToolPane or WebPartPage endpoints containing serialized gadget chains (e.g., ysoserial ExpandedWrapper/ObjectDataProvider or XamlServices) indicative of deserialization exploitation attempts, specifically targeting CVE-2026-65660.
This rule detects HTTP POST requests indicative of the RevStealer malware interacting with a Polygon blockchain smart contract via a public RPC endpoint. The rule specifically looks for 'eth_call' JSON-RPC methods targeting a known malicious contract address and a specific function selector ('0xd8b0d6ad') often used in RevStealer's command-and-control failover operations.
Page 31 of 124