Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,594 detections
Filters
Last updated
All Time
Detection languages
2,463
65
36
12
11
Contributors
991
707
594
140
61
Categories
2,159
1,453
1,273
576
444
Platforms
2,418
272
203
71
63
Products / Services
10,665
9,758
6,693
4,421
3,749
2,594
MITRE Techniques
808
512
383
246
210
CVEs
18
12
12
12
10
IDS Classtypes
1,144
447
282
188
105
IDS Protocols
1,378
413
318
209
34
Detects network traffic to the domain 'trace-flow.ru', which is associated with the 'Max Messenger' malware's concealed telemetry and C2 channel. The rules monitor for TLS connections to this domain, including instances where the certificate subject contains 'VK LLC' and 'Moscow'.
Detects network traffic to the domain 'trace-flow.ru', which is associated with the 'Max Messenger' malware's concealed telemetry and C2 channel. The rules monitor for TLS connections to this domain, including instances where the certificate subject contains 'VK LLC' and 'Moscow'.
Detects high-frequency outbound TLS connections to 'api-gost.oneme.ru', which is indicative of potential bulk contact list uploading, possibly related to unauthorized data collection by the Max Messenger application.
Detects high-frequency outbound TLS connections to 'api-gost.oneme.ru', which is indicative of potential bulk contact list uploading, possibly related to unauthorized data collection by the Max Messenger application.
Detects high-frequency outbound TLS connections to 'api-gost.oneme.ru', which is indicative of potential bulk contact list uploading, possibly related to unauthorized data collection by the Max Messenger application.
Detects high-frequency outbound TLS connections to 'api-gost.oneme.ru', which is indicative of potential bulk contact list uploading, possibly related to unauthorized data collection by the Max Messenger application.
Detects large and sustained outbound TCP data transfers to external networks, which may indicate mass data exfiltration. The rule monitors established sessions and uses a threshold to identify unusual outbound traffic volume over an extended period.
Detects network activity associated with a VBScript-based dropper attempting to retrieve payloads from known malicious infrastructure (cdn.imageurlgenerator.com) or abusing legitimate file hosting services (filemail.com) to bypass traditional security filters.
Detects an attempt to exploit a quote-injection vulnerability within the SharePoint ToolPane.aspx page, specifically targeting the Register directive to bypass SafeControls restrictions. This pattern is commonly used for remote code execution or unauthorized application behavior modifications by manipulating server-side parsing.
Detects network activity associated with the ORAX control-plane panel and management service. The rule identifies HTTP traffic containing OraxManage or OraxRDP service strings, SignalR negotiate handshakes directed to common ORAX management ports, and connections to identified ORAX C2 infrastructure domains and IP addresses.
This rule detects interaction between an internal host and the Vapi.ai API, typically used for automating AI-based voice phishing (vishing) calls. It identifies the initiation of a call via POST requests to the Vapi.ai API and subsequent callbacks from Vapi.ai to an attacker-controlled webhook endpoint used for tracking call status.
This rule detects a specific HTTP request pattern associated with the JWR-family Phishing-as-a-Service (PhaaS) platform. The detection looks for a WebSocket handshake initiation (GET request with specific URI segments 'webSocket/QT/' and a known hardcoded string) and an 'Upgrade' header, which are indicative of a command-and-control (C2) channel establishment.
Detects network activity associated with the GhostCode phishing kit, including HTTP requests to specific access-prefixed subdomains and DNS lookups for those domains. Additionally, it detects HTTP responses containing specific spoofed browser tab titles often used in these phishing campaigns.
Detects potential reconnaissance activities targeting Redis services on port 6379, specifically looking for unauthenticated 'PING' commands and subsequent responses indicating either authentication requirements or an open, unauthenticated instance.
Detects HTTP requests targeting the /terminal/ws endpoint of a Marimo notebook application, which indicates an attempt to exploit CVE-2026-39987, a pre-authentication Remote Code Execution vulnerability involving WebSocket connections.
Detects network activity associated with the SilkParasite botnet. The rule identifies inbound/outbound HTTP heartbeat check-ins using a specific URI pattern (/ping?h=) and direct TCP connections to a known malicious C2 IP address.
Detects network activity associated with the Psychedelic Stealer malware command-and-control (C2) communication patterns. The rule identifies specific API endpoints used for task polling, heartbeat pings, check-ins, and task acknowledgement, as well as connections to a known malicious C2 infrastructure, all characterized by the presence of a specific 'X-API-Key' header.
Detects network activity associated with RatHat FRP (Fast Reverse Proxy), including configuration fetching, deployment notifications, and command-and-control handshakes. These rules monitor for specific HTTP API endpoints and TCP patterns used by the tool to establish unauthorized reverse tunnels.
Detects network traffic associated with the RatHat malware family, which leverages the Gemini API to perform automated UI navigation on Android devices. The rule identifies both the outgoing prompt containing UI analysis instructions and the corresponding incoming API response containing coordinate-based navigation instructions.
Detects OAuth 2.0 authorization requests sent to login.microsoftonline.com using the 'prompt=none' parameter, where the redirect_uri domain is not a trusted Microsoft property. This is a common indicator of consent phishing or malicious OAuth application abuse where an attacker attempts to redirect authorization tokens to an adversary-controlled endpoint.
Detects HTTP beaconing activity characteristic of the OnyxC2 stealer malware, specifically identifying the synchronization command ('action=sync') containing hardcoded parameters for host identification and bot versioning.
Page 35 of 124