Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
168 detections
Filters
Last updated
All Time
Detection languages
87
52
26
1
1
Contributors
44
38
21
15
10
Categories
88
69
30
24
19
Platforms
106
35
24
4
4
Products / Services
10,660
9,755
6,689
4,418
3,748
MITRE Techniques
59
49
36
35
24
CVEs
3
2
2
2
1
Detects HTTP POST requests to /panel.php. This endpoint is frequently used by the BlobPhish campaign for backend C2 interaction or validation checks, often accompanied by an empty request body and a specific JSON error response.
Detects access to the claude.com open redirect endpoint pointing to external domains. Attackers can abuse this trusted domain to bypass ad validation and email filters to deliver malicious payloads, such as prompt injections.
Detects the presence of HTML tags within the URL query parameters of Claude chat application pre-fill URLs. Attackers can use this to embed invisible instructions (prompt injection) that the AI processes but the user does not see in the chat interface.
Detects network traffic matching the specific URI structure used by LeakNet for command-and-control beaconing. This behavior has been consistently observed across multiple LeakNet incidents following initial access.
Detects HTTP/HTTPS traffic where the User-Agent string is explicitly set to 'MicroStealer/1.0', which is used by the malware when communicating with Discord webhooks or its C2.
Detects the beaconing activity of the HeaconLoad Golang downloader, a component of the BoryptGrab campaign. This malware sends HTTP POST requests containing system information to the "/healthcheck" endpoint on port 8088.
Detects HTTP requests to download the BoryptGrab stealer, which uses a specific URL pattern containing a hardcoded build name. This activity is characteristic of the initial launchers used in the BoryptGrab campaign to fetch the main stealer component from a C2 server.
This rule is based on a phishing method that abuses normal sign-in links instead of relying on an obviously fake website at the start. The trick works by sending a person to a real sign-in service with settings that force an error and then pass the browser along to the attacker’s page. The rule stays narrow by looking for both the hidden sign-in setting and the clearly bad scope value together. That matters because silent sign-in by itself can appear in normal environments, but the bad scope value changes the story and makes the pattern much more suspicious. In plain language, this rule is trying to spot a link that pretends to be a normal sign-in step but is really being used as a doorway to a phishing or malware page after the trusted service does the redirect. Keeping both parts together helps the rule stay tied to the abusive redirect trick instead of ordinary sign-in traffic.
Detects access to file sharing and exfiltration services reported in the Unit 42 Muddled Libra operational playbook, including S3 Browser and multiple upload services.
This rule detects various indicators associated with the Booking.com phishing campaign targeting hotels and customers. It identifies suspicious web requests to non-Booking.com domains containing 'op_token' and 'complaint' or 'reservation' keywords, especially when combined with punycode, 'booklng' typos, or management-related subdomains. It also looks for partner kit patterns involving 'sign-in/?tpo_token=' and 'booklng' in URLs. Additionally, it identifies suspicious emails from newly generated Gmail accounts with specific subjects ('Automatic reply', 'Availability', 'Reservation') containing 'op_token' in the subject or body.
Detects outgoing network connections using the User-Agent 'ArkanixStealer/1.0', which is hardcoded in the C++ variant of the Arkanix Stealer.
Detects HTTP requests where the User-Agent string contains a full URL pointing to 'temp.sh'. This technique was observed in the Notepad++ supply chain attack where attackers passed the URL of exfiltrated data back to their C2 server within the User-Agent header.
Detects HTTP POST requests containing a JSON-RPC payload with the 'eth_call' method. This is often used by web-based crypto wallets or dApps to interact with the Ethereum blockchain, but can also be used by malicious JavaScript for activities like cryptojacking or wallet draining.
Detects C2 network traffic associated with PylangGhost and GolangGhost, RATs used by the PurpleBravo group. The malware sends an RC4-encrypted payload via an HTTP POST request to known C2 servers.
Detects C2 network traffic associated with the InvisibleFerret RAT, used by the PurpleBravo group. This malware uses a plaintext HTTP channel for beaconing, data exfiltration, and payload delivery to specific URI endpoints.
Detects the injection of a malicious iframe with attributes that impersonate the legitimate Stripe payment interface. This technique is used by Magecart actors to steal credit card data by replacing the real payment form with a clone.
Detects outbound network traffic with a User-Agent header indicating the use of the Rust 'reqwest' HTTP client library. This User-Agent is used by the RustyWater implant, associated with the MuddyWater APT group, for command and control (C2) communications.
Detects HTTP/HTTPS POST requests to known Lumma Stealer C2 domain
Detects exploitation attempts targeting a code injection vulnerability in XWiki's SolrSearch macro (CVE-2025-24893). Attackers can inject malicious Groovy code through specially crafted requests to the SolrSearch endpoint, leading to unauthenticated remote code execution.
Detects the use of rclone, a command-line program to manage files on cloud storage, via its default user-agent string
Detects network connections to the InterPlanetary File System (IPFS) where the URI contains a pattern indicative of an email address. This behavior is associated with recent phishing campaigns that leverage IPFS to host credential harvesting webpages, attempting to collect user credentials.
Page 4 of 8