Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
404 detections
Filters
Last updated
All Time
Detection languages
193
104
95
4
3
Contributors
90
77
62
50
22
Categories
231
151
101
83
77
Platforms
270
109
39
18
9
Products / Services
10,665
9,758
6,692
4,421
3,749
404
MITRE Techniques
138
119
74
64
47
CVEs
4
2
2
2
1
IDS Classtypes
1
IDS Protocols
1
Detects outbound HTTP GET/POST requests containing 'event=pasted' in the query string or URL, often directed at paths like '/api/metrics/run'. This pattern is associated with 'ClickFix' or 'AMOS' second-stage beaconing, where an adversary confirms a victim has successfully executed a social-engineered command (e.g., via copy-paste into a terminal) before proceeding with further payload delivery.
Detects command-and-control network traffic associated with the DEV#POPPER (Void Dokkaebi/Contagious Interview) RAT. The rule monitors for characteristic WebSocket heartbeat and notification calls to '/verify-human/' endpoints, data exfiltration requests to '/u/f', and outbound connections to known malicious C2 IP addresses.
Detects C2Looper v1 malware communication patterns, specifically plaintext HTTP beaconing to /api/beacon or /api/result endpoints with characteristic JSON body fields (id, user, host, pid, cmd, arg, seq), as well as direct network connections to known C2Looper command-and-control infrastructure on TCP port 8888.
Detects outbound HTTP/proxy connections to gouvvbo.top, the JadeProx AdaptixC2 C2 domain also hosting a credential-harvesting phishing portal that impersonates the Piar Municipality (Venezuela) tax administration system.
Detects outbound HTTP/proxy connections to gouvvbo.top, the JadeProx AdaptixC2 C2 domain also hosting a credential-harvesting phishing portal that impersonates the Piar Municipality (Venezuela) tax administration system.
This rule detects proxy requests directed to the legitimate Microsoft OAuth 2.0 device authorization endpoint (/common/oauth2/deviceauth). This activity is indicative of OAuth device code phishing, where a user is tricked into entering a malicious or attacker-provided device code into the legitimate Microsoft device login page to complete an authentication flow and grant unauthorized access to an attacker-controlled application.
This rule detects proxy requests directed to the legitimate Microsoft OAuth 2.0 device authorization endpoint (/common/oauth2/deviceauth). This activity is indicative of OAuth device code phishing, where a user is tricked into entering a malicious or attacker-provided device code into the legitimate Microsoft device login page to complete an authentication flow and grant unauthorized access to an attacker-controlled application.
Detects GET requests to the Microsoft Graph API 'organization' endpoint, often used by malicious tools to validate a tenant environment or gather metadata before initiating C2 communication or secondary stages of an attack.
Detects silent browser-side cryptocurrency wallet fingerprinting via EIP-6963 discovery, window.ethereum probing, and wallet-extension enumeration (e.g. MetaMask, Solana) occurring together, excluding known legitimate dApp/wallet-connect domains, consistent with BlueNoroff's pre-payload wallet profiling.
Detects outbound HTTP/proxy connections to gouvvbo.top, the JadeProx AdaptixC2 C2 domain also hosting a credential-harvesting phishing portal that impersonates the Piar Municipality (Venezuela) tax administration system.
Detects GET requests to the Microsoft Graph API 'organization' endpoint, often used by malicious tools to validate a tenant environment or gather metadata before initiating C2 communication or secondary stages of an attack.
Detects GET requests to the Microsoft Graph API 'organization' endpoint, often used by malicious tools to validate a tenant environment or gather metadata before initiating C2 communication or secondary stages of an attack.
Detects outbound web requests to OpenAI, Anthropic, or Google Gemini API endpoints that contain suspected API keys (OpenAI 'sk-proj-', Anthropic 'sk-ant-', or Google 'AIza' prefixes) in the request stream, potentially indicating hardcoded credentials, malicious script activity, or data exfiltration.
This rule detects potential brute-force or credential stuffing attempts against web application authentication endpoints by monitoring patterns of success and failure. It aggregates requests over 5-minute intervals, calculating a risk score based on high volumes of authentication failures relative to successful requests from individual source IPs targeting sensitive API paths (e.g., auth, session, login, token).
Detects network proxy requests from Go-based HTTP clients targeting Dropbox and gofile.io, which are common indicators of VILE ransomware communication or data exfiltration activities.
Detects HTTP POST requests sent to Large Language Model (LLM) chat completion API endpoints where the URI query parameters contain keywords strongly associated with the creation of phishing kits, credential harvesting forms, or malware scaffolding. This rule aims to identify the use of AI tools to accelerate malicious development workflows.
Detects potential data exfiltration activity to the file sharing service 'easyupload.io' by monitoring DNS queries, HTTP POST requests, and general network connections to the domain.
This rule detects attempts to perform Large Language Model (LLM) prompt injection via HTTP requests. It monitors proxy traffic for common jailbreaking or adversarial instruction patterns such as 'ignore previous instructions', 'bypass restrictions', or 'fictional environment' within URI parameters or request bodies. Such patterns are indicative of an attacker attempting to manipulate the behavior of an AI/LLM application.
Detects the presence of the 'x-ms-RefreshTokenCredential' cookie in requests directed to 'login.microsoftonline.com' originating from a client that does not identify as Windows. This behavioral pattern is associated with session hijacking techniques where an attacker uses a tool (e.g., Device Code Lab) to inject a session cookie into a browser, allowing for unauthorized access to Microsoft 365 services.
Detects anomalous outbound proxy requests to TON blockchain API endpoints (tonapi.io or toncenter.com) attempting to call the 'get_domain' method. This behavior is associated with the TONResolver RAT, which uses a specific, hardcoded smart contract address to dynamically resolve its C2 server hostname, effectively bypassing static domain-based security filters.
This rule detects potential brute-force or credential stuffing attempts against web application authentication endpoints by monitoring patterns of success and failure. It aggregates requests over 5-minute intervals, calculating a risk score based on high volumes of authentication failures relative to successful requests from individual source IPs targeting sensitive API paths (e.g., auth, session, login, token).
Page 4 of 20