Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,594 detections
Filters
Last updated
All Time
Detection languages
2,463
65
36
12
11
Contributors
991
707
594
140
61
Categories
2,159
1,453
1,273
576
444
Platforms
2,418
272
203
71
63
Products / Services
10,665
9,758
6,693
4,421
3,749
2,594
MITRE Techniques
808
512
383
246
210
CVEs
18
12
12
12
10
IDS Classtypes
1,144
447
282
188
105
IDS Protocols
1,378
413
318
209
34
Detects malicious activities associated with the SilkParasite campaign targeting Redis servers. The rules identify the initiation of a 'SLAVEOF' command to a rogue replication host, subsequent handshake (PSYNC/REPLCONF) with an external attacker-controlled node, and the modification of server configuration ('CONFIG SET dbfilename') to potentially facilitate unauthorized file persistence or data exfiltration through the Redis replication mechanism.
Detects network activity associated with the HEAVYGRAM PowerShell implant, specifically identifying outbound traffic to the Telegram Bot API (api.telegram.org). The rule looks for established connections and HTTP requests containing Telegram bot-specific URI patterns ('/bot', '/getUpdates') coupled with a 'WindowsPowerShell' user agent, indicating an automated beaconing mechanism used for command and control.
This rule detects network traffic patterns associated with the RatHat malware, specifically the use of 'frpc' (Fast Reverse Proxy Client) to establish a persistent reverse proxy tunnel. The rule monitors for established outbound connections containing the specific byte sequence characteristic of this tool, which is often used by adversaries to facilitate Command and Control (C2) communication.
Detects HTTP POST requests to the specific '/api/node/register' URI, which is associated with the RatHat RAT command and control (C2) node registration behavior.
Detects network communication to Telegram API (api.telegram.org) indicative of HEAVYGRAM malware command and control (C2) beaconing. The rule specifically looks for HTTP POST requests to the /sendMessage endpoint containing a chat ID and the hardcoded 'is online' message string, which is characteristic of this implant's check-in behavior.
Detects network activity (DNS lookups, TLS SNI, and HTTP Host headers) associated with proxy infrastructure (iproyal.com and lightningproxies.net) known to be used by the HEAVYGRAM/CHOSEN BRICK threat actors to mask Telegram-based command and control traffic.
Detects outbound HTTP GET requests to a specific C2 domain 'luizestrelhashapr.online' masquerading as CSS file fetches. The request pattern uses a specific path '/google_api/' followed by predefined alphanumeric filenames, consistent with the KREMLIN malware browser extension's C2 polling mechanism.
This rule detects attempts to exploit a path traversal vulnerability (CVE-2024-21762) in FortiOS SSL-VPN by monitoring for malformed GET requests targeting the /remote/fgt_lang endpoint. The rule also tracks successful exploitation by identifying HTTP 200 responses containing Linux password file patterns (root:x:0:0:), indicating potential remote file disclosure.
Detects the specific TCP handshake pattern characteristic of the Fast Reverse Proxy (FRP) client (frpc) initiating a connection to a command-and-control server. The rule inspects established traffic for specific metadata strings ('privilege_key', 'run_id', 'pool_count') within the initial handshake payload.
Detects the specific TCP handshake pattern characteristic of the Fast Reverse Proxy (FRP) client (frpc) initiating a connection to a command-and-control server. The rule inspects established traffic for specific metadata strings ('privilege_key', 'run_id', 'pool_count') within the initial handshake payload.
This rule detects HTTP GET requests resulting in the download of an Android Package (.apk) file where the host is not a known official Google Play or reputable third-party application distribution source. It further validates the detection by inspecting the HTTP response headers for the specific Android application package MIME type and the response body for indicators commonly associated with fake branded application portals.
Detects high-frequency connection attempts to TCP port 445 within the internal network or across RFC1918 subnets, indicating potential reconnaissance activity such as SMB share scanning commonly associated with lateral movement or network mapping.
Detects the usage of s5cmd, a command-line tool for S3, to communicate with AWS S3 endpoints. This behavior is indicative of potential data exfiltration by an adversary using authorized cloud storage tools to move data out of the environment.
Detects HTTP POST requests directed at 'relay.php' containing a specific 'CrpxBoundary' in the request body and an 'Authorization' header with the value 'Bearer crpx0_c2_2026'. This pattern is indicative of the CRPx0 malware exfiltrating data in chunks over an established C2 channel.
Detects HTTP beaconing activity associated with the Kimsuky threat group (Stella_Gary), specifically identifying requests to the /unicorn/ path. This pattern is characteristic of their C2 communication mechanism, which masquerades as legitimate browsing.
Detects HTTP GET requests characteristic of SilverFox malware final-stage payload delivery. The rule monitors for requests to known C2 domains or domains using a specific naming pattern (www.[5-10 chars].com) with specific URI paths (down, load, or insdw followed by 2-4 digits), indicating the retrieval of a malicious payload.
Detects network activity associated with the SilverFox relay dispatcher, including specific cache-busting URI patterns, C2 infrastructure hosted on Cloudflare Workers, and the delivery of decoy WeChat installer links.
Detects network activity associated with the SilverFox malware, specifically targeting the discovery of relay endpoints via specific URI patterns containing cache-busting timestamps, DNS lookups for identified relay domains (noah-ssh.com.cn) and Cloudflare Workers subdomains, and suspicious HTTP response characteristics such as specific cache headers paired with wildcard CORS headers.
Detects network activity associated with the 'SilverFox' malware family's command-and-control relay dispatcher. The rules identify specific HTTP requests to 'api.php', responses containing 'download_link', and the serving of legitimate WeChat installer payloads as a fallback mechanism for evasion, including the use of cache-busting parameters.
This rule detects HTTP requests to the Microsoft device login endpoint (/devicelogin) that originate from a non-Microsoft referrer domain. This behavior is highly indicative of Adversary-in-the-Middle (AiTM) phishing attacks targeting OAuth device code flows, where a malicious proxy site redirects users to the legitimate Microsoft login page while attempting to capture session tokens.
Detects anomalous POST requests containing SharePoint 'MSOTlPn_' ToolPane markup directed at pages other than the expected 'ToolPane.aspx'. This pattern is characteristic of attempts to exploit the SPUtility.EnsureAuthentication bypass vulnerability, allowing attackers to access or execute operations on SharePoint pages without proper authentication.
Page 57 of 124