Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,594 detections
Filters
Last updated
All Time
Detection languages
2,463
65
36
12
11
Contributors
991
707
594
140
61
Categories
2,159
1,453
1,273
576
444
Platforms
2,418
272
203
71
63
Products / Services
10,665
9,758
6,693
4,421
3,749
2,594
MITRE Techniques
808
512
383
246
210
CVEs
18
12
12
12
10
IDS Classtypes
1,144
447
282
188
105
IDS Protocols
1,378
413
318
209
34
This rule detects potential exfiltration of sensitive files, specifically 'cert.pem' and 'private.key', via HTTP POST requests to the '/api/adbk/upload' endpoint. This pattern is characteristic of the RatHat malware attempting to exfiltrate device credentials to a Command and Control (C2) server.
This rule detects HTTP GET requests to a specific GitHub repository path (raw.githubusercontent.com/omskiwdcvoiuyfd0998/) identified as staging infrastructure associated with Konni/VelvetCake malware operations. This activity is indicative of a compromised host attempting to download malicious payloads or stage tools from actor-controlled infrastructure.
This rule detects HTTP GET requests to a specific GitHub repository path (raw.githubusercontent.com/omskiwdcvoiuyfd0998/) identified as staging infrastructure associated with Konni/VelvetCake malware operations. This activity is indicative of a compromised host attempting to download malicious payloads or stage tools from actor-controlled infrastructure.
This rule detects HTTP GET requests to a specific GitHub repository path (raw.githubusercontent.com/omskiwdcvoiuyfd0998/) identified as staging infrastructure associated with Konni/VelvetCake malware operations. This activity is indicative of a compromised host attempting to download malicious payloads or stage tools from actor-controlled infrastructure.
Detects specific command-and-control (C2) communication patterns associated with the VelvetCake malware. The rules identify initial authentication with a hardcoded password string, module enumeration requests, and session termination signals transmitted over TCP.
Detects specific command-and-control (C2) communication patterns associated with the VelvetCake malware. The rules identify initial authentication with a hardcoded password string, module enumeration requests, and session termination signals transmitted over TCP.
Detects specific command-and-control (C2) communication patterns associated with the VelvetCake malware. The rules identify initial authentication with a hardcoded password string, module enumeration requests, and session termination signals transmitted over TCP.
Detection of network traffic associated with VelvetCake (Konni) malware, identifying communication with known hardcoded C2 infrastructure, domain lookups, and exfiltration attempts via HTTP/TLS and raw TCP protocols.
Detection of network traffic associated with VelvetCake (Konni) malware, identifying communication with known hardcoded C2 infrastructure, domain lookups, and exfiltration attempts via HTTP/TLS and raw TCP protocols.
This rule detects network traffic directed at known command and control (C2) domains associated with the Koktevrat malware, specifically targeting the domain 'fb-market-play.cc'. This pattern is indicative of compromised hosts attempting to communicate with attacker infrastructure, often following an initial infection phase initiated via malicious links.
Detects attempts to exploit the GitLab commits API via path traversal or direct file path manipulation to access sensitive configuration files or system secrets, such as gitlab-secrets.json, database.yml, or system files like /etc/passwd.
Detects the specific TCP handshake pattern characteristic of the Fast Reverse Proxy (FRP) client (frpc) initiating a connection to a command-and-control server. The rule inspects established traffic for specific metadata strings ('privilege_key', 'run_id', 'pool_count') within the initial handshake payload.
Detects anomalous sequential SMB scanning patterns across a /24 subnet and subsequent SMB share enumeration attempts (NetShareEnum) from a single host, consistent with reconnaissance activities associated with the DragonForce threat actor group.
Detects outbound network traffic (TLS and DNS queries) directed towards AWS S3 endpoints, which may indicate the use of s5cmd or similar tools for unauthorized data exfiltration to cloud storage.
Detects network traffic containing a specific 4-byte sequence ('13 12 11 09') identified as the initial handshake packet for the SparroWocky malware's reverse port-mapping server component.
Detects HTTP requests containing malicious JDBC strings targeting PaperCut NG/MF print management software, which are indicative of attempts to exploit authentication bypass and remote code execution vulnerabilities (CVE-2026-81578, CVE-2026-82078).
Detects HTTP connections between internal hosts and suspected C2 infrastructure associated with the Operation SilkParasite campaign. The rule specifically monitors for connections to known malicious IPs and identifies the retrieval of a cloned RTX Corporation homepage content, which acts as a decoy for the SpiceRAT malware.
Detects network traffic to the domain 'trace-flow.ru', which is associated with the 'Max Messenger' malware's concealed telemetry and C2 channel. The rules monitor for TLS connections to this domain, including instances where the certificate subject contains 'VK LLC' and 'Moscow'.
Detects network communication to identified SpiceRAT Command and Control (C2) infrastructure over TCP port 443. This includes monitoring for standard TCP connections and TLS sessions to known malicious IP addresses.
This rule monitors for DNS queries and TLS certificate attributes associated with the SilkParasite threat actor. The rule specifically targets domains that impersonate Central Asian government entities and monitors for suspicious TLS certificate issuers and subjects, indicating potential C2 infrastructure or phishing activity.
Detects network communication associated with the SilkParasite campaign. This includes detection of TLS traffic using self-signed LokiDev certificates (CN=localhost, O=LokiDev), direct connections to known malicious C2 IP addresses, and DNS queries for the domain normativ.dushanbeidc.org, which is linked to the LokiDev infrastructure.
Page 48 of 124