Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
61,044 detections
Filters
Last updated
All Time
Detection languages
23,953
16,903
4,364
4,342
3,270
Contributors
11,679
8,654
7,555
6,800
4,504
Categories
20,589
11,933
5,910
5,193
4,872
Platforms
40,153
7,368
6,547
3,915
3,691
Products / Services
10,809
9,795
6,757
4,421
3,770
MITRE Techniques
18,176
15,735
12,661
8,477
6,293
CVEs
71
71
64
58
49
IDS Classtypes
1,937
503
461
381
237
IDS Protocols
2,431
869
408
324
97
Detects the use of the net.exe or net1.exe utility to add a local user account with the specific password string 'Numlock!123'. This pattern is frequently used by attackers or malicious scripts to establish persistence or secondary access on a system.
Detects the initialization of known-malicious Terraform providers (dockerd) followed within one hour by the execution of a 'go run' process from the .terraform directory. This pattern is indicative of a supply chain compromise where an adversary leverages a typosquatted or malicious Terraform provider to facilitate the execution of a secondary payload.
Detects the initialization of known-malicious Terraform providers (dockerd) followed within one hour by the execution of a 'go run' process from the .terraform directory. This pattern is indicative of a supply chain compromise where an adversary leverages a typosquatted or malicious Terraform provider to facilitate the execution of a secondary payload.
Detects network traffic associated with the AdaptixC2 framework agent check-in process. The rule looks for specific HTTP GET request patterns, including URI paths commonly used by the agent, session-related cookies, and Content-Type headers set to application/octet-stream.
Detects network traffic associated with NGate Android malware communicating with its Command and Control (C2) server. The rule monitors for specific HTTP POST patterns, including an 'okhttp' user-agent and binary body content characteristic of NFC relay relay attempts used for fraudulent payment activities.
Detects outbound HTTP POST requests directed towards Internet Computer Protocol (ICP) canister gateways (e.g., icp0.io, ic0.app) containing specific API path patterns (/api/v2/canister/) used for executing queries or calls. The rule specifically flags traffic lacking common browser-like User-Agent strings, which is a common indicator of automated command-and-control beacons using these services as proxy infrastructure.
This rule detects outbound TLS traffic to the Solana mainnet beta RPC API endpoint (api.mainnet-beta.solana.com). Attackers may abuse legitimate public blockchain infrastructure as a command-and-control channel to bypass traditional network defenses or obfuscate communication.
Detects network beaconing activity associated with the TuxBot v3 IoT botnet. The rule identifies specific User-Agent strings (TuxBot/3, BusyBox wget, Wget/1.x), requests for .elf files, and connections to suspicious top-level domains frequently used for botnet command-and-control (C2) infrastructure.
This rule detects attempts to exploit a vulnerability in Cisco IOS XE devices (specifically related to CVE-2025-20188) by identifying suspicious Authorization headers containing JWT tokens ('Bearer eyJ...') targeted at the '/webui/' endpoint. This behavior is associated with Akira ransomware exploitation efforts against networking infrastructure.
Detects high-frequency connection attempts to SMB (445) or RDP (3389) ports originating from a single source, which is characteristic of the SoftPerfect Network Scanner (NetScan) tool performing reconnaissance or network discovery sweeps.
This rule detects network communication associated with the AMOS (Atomic macOS) Stealer malware. Specifically, it identifies inbound HTTP GET requests directed at the '/api/shell/agent' URI, which is used by the stealer to retrieve instructions or trigger remote shell operations from its command and control (C2) server.
Detects HTTP POST requests targeting the '/api/credentials' path on non-standard port 8133, which is indicative of AMOS (Atomic macOS Stealer) malware exfiltrating stolen credentials to a remote command and control server.
Detects specific hash matches of the Atomic macOS Stealer (AMOS) Mach-O binary payloads (arm64/x86_64), which are associated with the Macfinger 'ClickFix' distribution chain.
Detects specific hash matches of the Atomic macOS Stealer (AMOS) Mach-O binary payloads (arm64/x86_64), which are associated with the Macfinger 'ClickFix' distribution chain.
Detects the presence of injected bot-protection tracker scripts characteristic of the Macfinger (ClickFix) attack campaign within served HTML content. The rule identifies specific patterns including DNS prefetching directives, site tracking parameters, and a specific GAnalytics tracker JavaScript reference, indicating an attempt to facilitate social engineering or malicious user interaction.
Detects the presence of injected bot-protection tracker scripts characteristic of the Macfinger (ClickFix) attack campaign within served HTML content. The rule identifies specific patterns including DNS prefetching directives, site tracking parameters, and a specific GAnalytics tracker JavaScript reference, indicating an attempt to facilitate social engineering or malicious user interaction.
Detects network traffic associated with AMOS (Atomic macOS) Stealer malware, identifying C2 beaconing and tasking requests. The rules specifically monitor POST requests to '/api/t' with JSON payloads and GET requests to '/api/shell/agent' over non-standard ports (excluding 80 and 443).
Detects HTTP GET requests to external URIs matching a specific pattern (a 10-20 character hexadecimal path followed by ?force=1), which is characteristic of the delivery or staging mechanism used by MacStealer (Macfinger) and Atomic macOS Stealer (AMOS) malware families.
Detects network traffic associated with the 'ClickFix' technique, where malicious websites masquerade as legitimate CAPTCHA or bot-protection services to exfiltrate visitor telemetry via POST requests or fetch malicious script overlays.
Detects outbound network traffic matching TLS SNI patterns associated with the Sauron Loader malware, indicating command-and-control (C2) communication. The rule monitors for frequent connections to specific domains (namsb-show, quinlantours, virtual-magic, lahaina-shores) following a defined threshold.
This rule detects the two-stage network behavior of AMOS (Atomic macOS Stealer). First, it identifies the initial C2 registration beaconing to an '/api/t' endpoint. Subsequently, it monitors for an immediate follow-up TLS connection to 'ipinfo.io', which is commonly used by the malware for geolocation and victim system reconnaissance.
Page 473 of 2907