Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,594 detections
Filters
Last updated
All Time
Detection languages
2,463
65
36
12
11
Contributors
991
707
594
140
61
Categories
2,159
1,453
1,273
576
444
Platforms
2,418
272
203
71
63
Products / Services
10,665
9,758
6,693
4,421
3,749
2,594
MITRE Techniques
808
512
383
246
210
CVEs
18
12
12
12
10
IDS Classtypes
1,144
447
282
188
105
IDS Protocols
1,378
413
318
209
34
Detects HTTP GET requests associated with the Kimsuky threat actor, specifically targeting the retrieval of payloads like uni.txt or files matching the test.bef_fri pattern from the /unicorn/ directory.
Detects established network connections to a known Kimsuky-associated infrastructure (107.172.249.140) on port 443. The rule filters out standard TLS handshakes by inspecting initial packet content, targeting non-standard or custom-protocol traffic, and limits alerts to once per hour per source host to reduce noise.
Detects outbound HTTP requests to known Kimsuky command and control (C2) infrastructure associated with the Stella_Gary campaign. The rule monitors for specific URI patterns ('/unicorn/mort.php' or '/unicorn/uni.txt') commonly used by this threat actor for beaconing.
Detects high-volume POST requests containing HEIF, HEIC, or AVIF image content types, indicative of automated fuzzing or exploitation attempts against an image-processing endpoint targeting CVE-2026-32882.
Detects high-volume POST requests containing HEIF, HEIC, or AVIF image content types, indicative of automated fuzzing or exploitation attempts against an image-processing endpoint targeting CVE-2026-32882.
Detects high-volume POST requests containing HEIF, HEIC, or AVIF image content types, indicative of automated fuzzing or exploitation attempts against an image-processing endpoint targeting CVE-2026-32882.
Detects network activity associated with the SilverFox multi-tier relay infrastructure, specifically identifying HTTP requests to known relay domains and dispatcher endpoints used for command-and-control (C2) communication.
Detects DNS queries, HTTP host headers, and TLS SNI traffic associated with the SilverFox relay and dispatch infrastructure. These indicators are commonly used by the SilverFox malware for command and control (C2) communications.
This rule detects suspicious outbound HTTP GET requests to a known domain (noah-ssh.com.cn) targeted by the SilverFox malware relay dispatcher. It specifically monitors for requests to '/api.php' containing a 13-digit numeric timestamp parameter, which is a characteristic pattern of its C2 communication.
Detects outbound network communication attempts by the SilverFox malware to known Cloudflare Workers relay infrastructure, specifically targeting hostnames associated with 'noah-relay' instances. The rule monitors DNS lookups, TLS SNI headers, and HTTP Host headers to identify potential Command and Control (C2) traffic.
Detects DNS queries and TLS SNI traffic directed towards known phishing domains associated with credential harvesting campaigns (specifically those attributed to Storm-3121/Storm-3032). These domains are used to lure users into providing credentials under the guise of SSO or passkey setup.
Detects communication between a host and a suspected malicious domain (noah-ssh.com.cn) characterized by a specific API request containing a millisecond timestamp and a subsequent HTTP response containing a 'download_link' field. This pattern is indicative of the SilverFox malware relay mechanism, likely used for staging and downloading additional malicious payloads.
Detects high-frequency outbound TCP connection attempts from a WSO2 API Gateway or Traffic Manager host to multiple sensitive internal management and administrative ports (22, 445, 3389, 5985, 5986). This behavior is indicative of a compromised gateway being used for lateral movement across the network.
This rule detects outgoing HTTP POST requests to the public BSC testnet RPC endpoint ('bsc-testnet-rpc.publicnode.com') containing an 'eth_call' request, which is a technique used by the 'EtherHiding' campaign to fetch malicious JavaScript payloads directly from blockchain smart contracts, bypassing traditional web-based C2 infrastructure.
Detects network traffic attempting to download malicious PowerShell payloads via WebDAV from the domain leaguejazire.com, which is associated with the ClearFake malware campaign.
Detects network traffic indicative of an adversary using the Ethereum blockchain as a dead-drop C2 channel. The rules identify specific JSON-RPC methods (eth_getTransactionByHash, eth_call) typically associated with querying blockchain data for C2 instructions, as well as non-browser processes initiating these requests to external endpoints.
Detects unauthenticated HTTP POST requests targeting the FortiGate administrative API (/api/v2/), which may indicate exploitation attempts related to CVE-2025-25249. The rule specifically looks for requests lacking authentication headers (Cookie or Authorization).
This rule detects network traffic originating from the local network to external destinations that exhibit characteristics associated with the Xray-core tool, specifically the use of a spoofed TLS Server Name Indication (SNI) of 'dl.google.com' paired with a server certificate that does not contain 'Google' in the subject. This technique is used to bypass network filters by masquerading command and control traffic as legitimate Google traffic.
This rule detects DNS queries for suspicious domains that mimic MFA or passkey registration portals. Such domains are often used in phishing campaigns to lure users into registering their credentials or security tokens on adversary-controlled infrastructure.
Detects outbound HTTP requests to the Telegram Bot API containing hardcoded bot tokens and chat IDs associated with the malicious 'indexed-btree' npm package campaign. This indicates active data exfiltration or command-and-control communication.
This rule monitors and alerts on network traffic (TCP/TLS/HTTP) directed toward a known malicious IP address associated with an Adversary-in-the-Middle (AiTM) phishing infrastructure, categorized under the PREY-0058 designation.
Page 52 of 124