Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,594 detections
Filters
Last updated
All Time
Detection languages
2,463
65
36
12
11
Contributors
991
707
594
140
61
Categories
2,159
1,453
1,273
576
444
Platforms
2,418
272
203
71
63
Products / Services
10,665
9,758
6,693
4,421
3,749
2,594
MITRE Techniques
808
512
383
246
210
CVEs
18
12
12
12
10
IDS Classtypes
1,144
447
282
188
105
IDS Protocols
1,378
413
318
209
34
This rule set detects web traffic associated with 'GhostCode' phishing campaigns. These campaigns utilize Cloudflare Turnstile verification gates on non-Cloudflare domains, specific phishing page titles, and session cookies ('turnstile_verified', 'cf_clearance') to facilitate device code phishing or credential harvesting activities.
Detects outbound HTTP requests from endpoints to a known C2 infrastructure associated with mobile device spyware. The rule identifies two specific stages: polling for new commands using a GET request and posting command execution results using a POST request, both targeting an MDM-mimicking API structure.
Detects cleartext HTTP POST requests to specific URI endpoints (/api/v1/devices/register or /api/v1/devices/heartbeat) known to be used by the Corp_MDM Android spyware for C2 communication, registration, or heartbeat signals.
Detects cleartext HTTP POST requests to specific URI endpoints (/api/v1/devices/register or /api/v1/devices/heartbeat) known to be used by the Corp_MDM Android spyware for C2 communication, registration, or heartbeat signals.
This rule monitors for outbound TCP and HTTP traffic to a known malicious infrastructure hosting a fake or compromised 'Corp MDM' (Mobile Device Management) admin panel, which serves as a Command and Control (C2) channel for spyware.
Detects network traffic patterns indicative of unauthorized or malicious APK sideloading attempts, specifically targeting fake Google Play delivery mechanisms, lure domains, and known command-and-control (C2) infrastructure.
Detects network traffic patterns indicative of unauthorized or malicious APK sideloading attempts, specifically targeting fake Google Play delivery mechanisms, lure domains, and known command-and-control (C2) infrastructure.
Detects network traffic patterns indicative of unauthorized or malicious APK sideloading attempts, specifically targeting fake Google Play delivery mechanisms, lure domains, and known command-and-control (C2) infrastructure.
Detects network traffic patterns indicative of unauthorized or malicious APK sideloading attempts, specifically targeting fake Google Play delivery mechanisms, lure domains, and known command-and-control (C2) infrastructure.
Detects outbound network traffic and HTTP requests originating from the internal network destined for a known malicious infrastructure associated with 'Corp MDM'. The traffic includes C2 communication patterns, specific API URI paths, and potential login interactions on non-standard ports, consistent with phishing, malware delivery, or unauthorized administrative access.
Detects outbound network traffic and HTTP requests originating from the internal network destined for a known malicious infrastructure associated with 'Corp MDM'. The traffic includes C2 communication patterns, specific API URI paths, and potential login interactions on non-standard ports, consistent with phishing, malware delivery, or unauthorized administrative access.
Detects HTTP requests to domains masquerading as Google Play ('playgoogle.') that are attempting to serve Android application packages (.apk). This is a common indicator of malicious sideloading campaigns using typosquatting to deceive users into downloading fake applications.
Detects HTTP requests to domains masquerading as Google Play ('playgoogle.') that are attempting to serve Android application packages (.apk). This is a common indicator of malicious sideloading campaigns using typosquatting to deceive users into downloading fake applications.
Detects HTTP requests to domains masquerading as Google Play ('playgoogle.') that are attempting to serve Android application packages (.apk). This is a common indicator of malicious sideloading campaigns using typosquatting to deceive users into downloading fake applications.
Detects HTTP requests to domains masquerading as Google Play ('playgoogle.') that are attempting to serve Android application packages (.apk). This is a common indicator of malicious sideloading campaigns using typosquatting to deceive users into downloading fake applications.
Detects outbound network traffic matching known SectopRAT C2 patterns. The rule monitors for established TCP connections to a specific malicious IP address with a payload size exceeding 300 bytes, consistent with the exfiltration of AES-encrypted JSON credential or wallet data. It includes threshold logic to limit alerts to once per source IP every 60 seconds.
Detects outbound network traffic matching known SectopRAT C2 patterns. The rule monitors for established TCP connections to a specific malicious IP address with a payload size exceeding 300 bytes, consistent with the exfiltration of AES-encrypted JSON credential or wallet data. It includes threshold logic to limit alerts to once per source IP every 60 seconds.
Detects outbound network traffic matching known SectopRAT C2 patterns. The rule monitors for established TCP connections to a specific malicious IP address with a payload size exceeding 300 bytes, consistent with the exfiltration of AES-encrypted JSON credential or wallet data. It includes threshold logic to limit alerts to once per source IP every 60 seconds.
Detects outbound network traffic matching known SectopRAT C2 patterns. The rule monitors for established TCP connections to a specific malicious IP address with a payload size exceeding 300 bytes, consistent with the exfiltration of AES-encrypted JSON credential or wallet data. It includes threshold logic to limit alerts to once per source IP every 60 seconds.
Detects network communication associated with the SectopRAT/ArechClient2 remote access trojan, specifically identifying its characteristic length-prefixed, AES-encrypted command-and-control handshake on non-standard ports. The rule matches traffic containing a specific length-prefixed packet structure starting with null bytes, typically seen during C2 check-in.
Detects network communication associated with the SectopRAT/ArechClient2 remote access trojan, specifically identifying its characteristic length-prefixed, AES-encrypted command-and-control handshake on non-standard ports. The rule matches traffic containing a specific length-prefixed packet structure starting with null bytes, typically seen during C2 check-in.
Page 46 of 124