Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,594 detections
Filters
Last updated
All Time
Detection languages
2,463
65
36
12
11
Contributors
991
707
594
140
61
Categories
2,159
1,453
1,273
576
444
Platforms
2,418
272
203
71
63
Products / Services
10,665
9,758
6,693
4,421
3,749
2,594
MITRE Techniques
808
512
383
246
210
CVEs
18
12
12
12
10
IDS Classtypes
1,144
447
282
188
105
IDS Protocols
1,378
413
318
209
34
Detects DNS queries, TLS SNI headers, and HTTP host headers associated with the known exfiltration domain 't.m-kosche.com' linked to the Mini Shai-Hulud malware.
Detects DNS queries, TLS SNI headers, and HTTP host headers associated with the known exfiltration domain 't.m-kosche.com' linked to the Mini Shai-Hulud malware.
Detects outbound network traffic from internal hosts to public Telegram Bot API or Slack webhooks, indicative of potential data exfiltration by the npm indexed-btree malware or similar malicious actors utilizing these services for command and control or exfiltration.
Detects potential Command and Control (C2) beaconing activity associated with Xray-core, where the TLS Server Name Indication (SNI) field is spoofed to 'dl.google.com' to masquerade malicious traffic as legitimate Google-related traffic.
Detects sustained outbound TCP communication patterns indicative of Xray-core proxy or tunneling activity. The rule monitors for high-frequency established TCP sessions originating from the internal network, which is a common behavior for tools used to maintain persistent network tunnels or proxy command-and-control traffic.
Detects network activity initiated by Node.js processes towards specific Infura and Alchemy RPC endpoints for the Sepolia testnet, including specific JSON-RPC queries containing potential malicious contract addresses. This pattern is indicative of C2 communication using legitimate Web3 infrastructure.
This rule detects network traffic originating from internal hosts to Slack's domain that contains hardcoded Slack bot tokens and specific Slack channel IDs associated with a malicious npm supply chain campaign (indexed-btree). This indicates successful exfiltration of sensitive configuration credentials or data to an attacker-controlled Slack environment.
Detects network traffic associated with the malicious npm package 'indexed-btree', which uses the Telegram Bot API to exfiltrate data. The rules monitor for connections to api.telegram.org via HTTPS and identify specific hardcoded bot tokens and chat IDs associated with the malicious campaign.
Detects network activity associated with the 'ClickFix' campaign, specifically targeting the cdnsuicaches[.]com domain. The rules identify the initial DNS query, the subsequent TLS SNI connection, and the retrieval of malicious JavaScript containing the 'cookie-captcha-complete' overlay signature. This behavior is indicative of a browser-based social engineering attack.
Detects outbound HTTP requests to the Telegram Bot API associated with the malicious 'indexed-btree' npm package. The rule specifically monitors for hardcoded Telegram bot tokens and chat IDs used for data exfiltration.
Detects outbound HTTP requests to the Telegram Bot API associated with the malicious 'indexed-btree' npm package. The rule specifically monitors for hardcoded Telegram bot tokens and chat IDs used for data exfiltration.
Detects outbound HTTP requests to the Telegram Bot API associated with the malicious 'indexed-btree' npm package. The rule specifically monitors for hardcoded Telegram bot tokens and chat IDs used for data exfiltration.
Detects outbound network traffic attempting to exfiltrate data to Slack or Telegram APIs using hardcoded bot tokens or channel identifiers associated with the 'indexed-btree' malware campaign.
Detects outbound HTTP POST requests to known public Ethereum RPC gateways (Alchemy and Infura) containing embedded, hardcoded API keys or references to specific contract addresses associated with the 'indexed-btree' malware campaign. This pattern indicates a compromised host leveraging legitimate Web3 infrastructure for Command and Control (C2) communication.
Detects Sauron Loader C2 registration/polling: an HTTPS POST whose URI path matches the malware's exact <prefix>/v<1-9>/<action><Resource> structure (action = set|get; resource = one of the 10 known config/task resource names) combined with the malware's hardcoded Windows-10 Edge/Chrome 143 user agent. Narrowing the URI regex from a generic '/api/v1/anything' wildcard to the exact action+resource vocabulary eliminates matches against ordinary versioned REST API traffic, which was the dominant false-positive source.
Detects Sauron Loader C2 registration/polling: an HTTPS POST whose URI path matches the malware's exact <prefix>/v<1-9>/<action><Resource> structure (action = set|get; resource = one of the 10 known config/task resource names) combined with the malware's hardcoded Windows-10 Edge/Chrome 143 user agent. Narrowing the URI regex from a generic '/api/v1/anything' wildcard to the exact action+resource vocabulary eliminates matches against ordinary versioned REST API traffic, which was the dominant false-positive source.
Detects Sauron Loader C2 registration/polling: an HTTPS POST whose URI path matches the malware's exact <prefix>/v<1-9>/<action><Resource> structure (action = set|get; resource = one of the 10 known config/task resource names) combined with the malware's hardcoded Windows-10 Edge/Chrome 143 user agent. Narrowing the URI regex from a generic '/api/v1/anything' wildcard to the exact action+resource vocabulary eliminates matches against ordinary versioned REST API traffic, which was the dominant false-positive source.
Detects Sauron Loader C2 registration/polling: an HTTPS POST whose URI path matches the malware's exact <prefix>/v<1-9>/<action><Resource> structure (action = set|get; resource = one of the 10 known config/task resource names) combined with the malware's hardcoded Windows-10 Edge/Chrome 143 user agent. Narrowing the URI regex from a generic '/api/v1/anything' wildcard to the exact action+resource vocabulary eliminates matches against ordinary versioned REST API traffic, which was the dominant false-positive source.
Detects anomalous MS_T120 channel binding and MCS handshake patterns characteristic of the BlueKeep (CVE-2019-0708) remote code execution vulnerability in Microsoft RDP services.
This rule detects attempts to exploit CVE-2021-33044, a vulnerability in Dahua hardware that allows an attacker to bypass authentication by sending a specially crafted request to the global.login endpoint.
Detects network traffic associated with the SloppyRAT backdoor, which utilizes a reverse SOCKS proxy mechanism. The rule identifies specific HTTP GET/POST heartbeats and command responses to the '/api/poll' and '/api/proxy/ack' endpoints commonly used for C2 operations.
Page 45 of 124