Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,594 detections
Filters
Last updated
All Time
Detection languages
2,463
65
36
12
11
Contributors
991
707
594
140
61
Categories
2,159
1,453
1,273
576
444
Platforms
2,418
272
203
71
63
Products / Services
10,665
9,758
6,693
4,421
3,749
2,594
MITRE Techniques
808
512
383
246
210
CVEs
18
12
12
12
10
IDS Classtypes
1,144
447
282
188
105
IDS Protocols
1,378
413
318
209
34
This rule detects attempts to exploit a vulnerability in Cisco IOS XE devices (specifically related to CVE-2025-20188) by identifying suspicious Authorization headers containing JWT tokens ('Bearer eyJ...') targeted at the '/webui/' endpoint. This behavior is associated with Akira ransomware exploitation efforts against networking infrastructure.
Detects high-frequency connection attempts to SMB (445) or RDP (3389) ports originating from a single source, which is characteristic of the SoftPerfect Network Scanner (NetScan) tool performing reconnaissance or network discovery sweeps.
This rule detects network communication associated with the AMOS (Atomic macOS) Stealer malware. Specifically, it identifies inbound HTTP GET requests directed at the '/api/shell/agent' URI, which is used by the stealer to retrieve instructions or trigger remote shell operations from its command and control (C2) server.
Detects the presence of injected bot-protection tracker scripts characteristic of the Macfinger (ClickFix) attack campaign within served HTML content. The rule identifies specific patterns including DNS prefetching directives, site tracking parameters, and a specific GAnalytics tracker JavaScript reference, indicating an attempt to facilitate social engineering or malicious user interaction.
Detects the presence of injected bot-protection tracker scripts characteristic of the Macfinger (ClickFix) attack campaign within served HTML content. The rule identifies specific patterns including DNS prefetching directives, site tracking parameters, and a specific GAnalytics tracker JavaScript reference, indicating an attempt to facilitate social engineering or malicious user interaction.
Detects network traffic associated with AMOS (Atomic macOS) Stealer malware, identifying C2 beaconing and tasking requests. The rules specifically monitor POST requests to '/api/t' with JSON payloads and GET requests to '/api/shell/agent' over non-standard ports (excluding 80 and 443).
Detects HTTP GET requests to external URIs matching a specific pattern (a 10-20 character hexadecimal path followed by ?force=1), which is characteristic of the delivery or staging mechanism used by MacStealer (Macfinger) and Atomic macOS Stealer (AMOS) malware families.
Detects network traffic associated with the 'ClickFix' technique, where malicious websites masquerade as legitimate CAPTCHA or bot-protection services to exfiltrate visitor telemetry via POST requests or fetch malicious script overlays.
Detects outbound network traffic matching TLS SNI patterns associated with the Sauron Loader malware, indicating command-and-control (C2) communication. The rule monitors for frequent connections to specific domains (namsb-show, quinlantours, virtual-magic, lahaina-shores) following a defined threshold.
This rule detects the two-stage network behavior of AMOS (Atomic macOS Stealer). First, it identifies the initial C2 registration beaconing to an '/api/t' endpoint. Subsequently, it monitors for an immediate follow-up TLS connection to 'ipinfo.io', which is commonly used by the malware for geolocation and victim system reconnaissance.
Detects the presence of injected 'ganalytics-tracker-js' script on compromised webpages and the subsequent browser-initiated requests for the malicious 't.js' script. This is associated with ClickFix attack campaigns where users are socially engineered into executing malicious code.
Detects HTTP POST requests to a /collect endpoint containing visitorId and stage parameters, which is characteristic of ClickFix-style fake bot-protection overlays used to trick users into executing malicious scripts under the guise of security verification.
This rule detects two-stage suspicious network activity: first, a POST request to a known Sauron Loader C2 endpoint ('/api/t'), and second, a subsequent TLS connection to 'ipinfo.io' used for geolocation. The correlation is achieved using flowbits to track the infection lifecycle.
Detects DNS lookup queries and HTTP POST beaconing attempts directed at known Sauron Loader C2 fallback infrastructure. The rule tracks specific domains associated with the malware's encrypted registration and command-and-control behavior.
Detects DNS lookup queries and HTTP POST beaconing attempts directed at known Sauron Loader C2 fallback infrastructure. The rule tracks specific domains associated with the malware's encrypted registration and command-and-control behavior.
Detects network beaconing activity associated with the Sauron Loader malware. The rule monitors HTTPS traffic for specific domain patterns and suspicious TLV (Type-Length-Value) protocol structures, as well as recurring beaconing cadence to identified C2 infrastructure.
Detects network beaconing activity associated with AMOS Stealer command-and-control communication. The rule identifies HTTP POST requests to the '/api/t' path with a JSON content type over port 8133, using a threshold to identify sustained communication patterns.
Detects outbound HTTP requests to a known domain associated with 'ClickFix' campaign activity. The rule identifies attempts to fetch a specific JavaScript tracker file, which is often used in social engineering campaigns to trick users into executing malicious commands in their shell or console.
Detects HTTP POST requests to '/api/credentials' over a non-standard port (8133) typical of AMOS (Atomic macOS Stealer) command and control traffic. The rule specifically looks for established network connections originating from the local network and targeting external hosts, flagging multiple occurrences within a 30-second window.
Detects HTTP POST requests to '/api/credentials' over a non-standard port (8133) typical of AMOS (Atomic macOS Stealer) command and control traffic. The rule specifically looks for established network connections originating from the local network and targeting external hosts, flagging multiple occurrences within a 30-second window.
This rule detects outgoing HTTP POST requests to the 'velvet-otter-glagceis.life' domain path '/collect'. The request body contains indicators of victim fingerprinting, specifically looking for 'visitorId' and 'events' fields, characteristic of the Macfinger/ClickFix campaign used for gathering visitor telemetry for malicious purposes.
Page 40 of 124