Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
404 detections
Filters
Last updated
All Time
Detection languages
193
104
95
4
3
Contributors
90
77
62
50
22
Categories
231
151
101
83
77
Platforms
270
109
39
18
9
Products / Services
10,665
9,758
6,692
4,421
3,749
404
MITRE Techniques
138
119
74
64
47
CVEs
4
2
2
2
1
IDS Classtypes
1
IDS Protocols
1
This rule monitors for two types of anomalous network behavior: first, it identifies connections to known domains from IP addresses not previously associated with those domains over a seven-day lookback period. Second, it identifies HTTP proxy responses (from Zscaler or Squid) where the content-length significantly deviates from the historical baseline for specific URLs. These patterns are potential indicators of C2 channel shifts or data exfiltration via web protocols.
This rule detects processes other than standard web browsers performing network connections that coincide with OAuth token acquisition activities (POST requests containing 'access_token' in the response body). This behavior is indicative of potential token theft or unauthorized programmatic access to OAuth-protected resources.
Detects instances where a non-standard browser process accesses sensitive browser credential files (e.g., Login Data, Cookies, key4.db) and simultaneously establishes a network connection to Discord or transmits data to a Discord webhook. This pattern is consistent with infostealer malware attempting to exfiltrate cached credentials via external services.
This rule monitors web and proxy traffic for patterns indicative of Server-Side Request Forgery (SSRF) attempts. It searches for specific URL parameters designed to manipulate requests toward internal cloud metadata services (e.g., 169.254.169.254), exploit protocol schemes like 'gcs://', or leverage URL parsing discrepancies such as unauthorized authority or fragment-at-sign confusion to bypass security filters.
Detects Server-Side Request Forgery (SSRF) attempts directed at the Google Cloud Platform (GCP) instance metadata service endpoints. The rule monitors HTTP request logs from proxies or web servers, identifying requests that contain suspicious metadata hostnames or IP addresses combined with sensitive API paths typically used for exfiltrating cloud instance identity tokens.
Detects outbound proxy traffic originating from identified AI and automation agent user-agents (e.g., ChatGPT, Perplexity, Claude, etc.) attempting to access sensitive URI paths, such as credential files, SSH keys, configuration files, or cloud-hosted secrets. This may indicate an attempt to exfiltrate sensitive data to or through AI platforms.
Detects HTTP responses containing JavaScript files larger than 1 MB, which is a signature behavior of the Bluekit PhaaS platform. This technique involves serving periodically rotated, obfuscated JavaScript bundles to evade static hash-based detection mechanisms.
Detects network traffic associated with TrymeLocker malware, specifically targeting Telegram API communications containing hardcoded identifiers and geolocation lookups via ipinfo.io.
Detects one web session posting username, password, and MFA or one-time-code form fields through the same intermediary host. This behavior is indicative of an Adversary-in-the-Middle (AiTM) attack, where an attacker intercepts and relays authentication requests, including multi-factor authentication (MFA) codes, to gain unauthorized access.
Detects HTTP POST requests directed at PHP script endpoints with randomized 16-32 character hexadecimal filenames, which is a known C2 communication pattern used by the StealC infostealer.
Detects FTP protocol traffic (on port 21) initiated by a process named 'squid.exe' or containing 'squid' in its filename. This rule is designed to identify potential exploitation attempts related to the Squidbleed vulnerability, where a compromised Squid proxy might be used for unauthorized FTP communications.
This rule detects potential cleartext leakage of usernames and passwords over FTP (port 21) by identifying HTTP requests containing common credential-related keywords in the URL, while explicitly excluding HTTPS traffic. This could indicate sensitive information being transmitted insecurely.
Detects unusually large FTP responses containing 'LIST' or 'NLST' commands, potentially indicating an attempt to exploit the Squidbleed vulnerability or similar data exfiltration over FTP. The rule specifically looks for network events on port 21 (FTP) where the action type is 'NetworkSignatureInspected' and the RemoteUrl contains either 'LIST' or 'NLST' with a string length greater than 4000 characters.
Detects attempts to exploit the Squidbleed vulnerability by monitoring 'squid.exe' process command lines for keywords related to FTP default configuration exploitation, specifically 'Safe_ports', 'CONNECT', 'PORT', 'PASV', '21', and 'tcp_outgoing_address'. This indicates an adversary trying to bypass security controls or exfiltrate data via FTP.
This rule detects network events where an FTP LIST response contains malformed directory entries, potentially indicating an attempt to exploit the Squidbleed vulnerability. It specifically looks for network signature inspections on port 21 (FTP) with common FTP commands (LIST, NLST, MLSD, MLST, RETR) in the RemoteUrl, while excluding common log and text file extensions.
Detects anomalous WebSocket connections on web pages that utilize the 'rrweb' session replay library, often used by phishing infrastructure such as the Bluekit Browser-in-the-Middle (AiTM) kit to capture and relay real-time victim input (keystrokes and mouse movements) to attacker-controlled consoles.
This rule detects network activity associated with the Bluekit PhaaS (Phishing-as-a-Service) BitM (Browser-in-the-Browser) C2 infrastructure. It monitors for connections to known malicious domains, the use of WebSocket upgrades over TLS, and the presence of 'rrweb' (a DOM recording library) in request URIs, which are indicative of browser-in-the-browser phishing C2 traffic.
This rule detects potential browser fingerprinting activity or unauthorized WebRTC STUN requests, often associated with malicious landing pages, phishing, or automated detection evasion. It identifies the presence of specific browser API calls (RTCPeerConnection, navigator.deviceMemory, navigator.hardwareConcurrency) or suspicious use of STUN server ports (3478, 19302) on non-authorized domains.
Detects a single host serving materially different status codes, body sizes, or redirects to automated user agents (bots, crawlers, scanners, curl, wget, headless browsers, python, go-http) compared to normal browsers. This behavior can indicate an Adversary-in-the-Middle (AiTM) attack where the adversary is attempting to serve different content to different user agents to evade detection or deliver malicious payloads.
This rule detects potential cleartext leakage of usernames and passwords over FTP (port 21) by identifying HTTP requests containing common credential-related keywords in the URL, while explicitly excluding HTTPS traffic. This could indicate sensitive information being transmitted insecurely.
Detects attempts to exploit the Squidbleed vulnerability (C11 strchr() Null Terminator Behavior Exploitation) by monitoring 'squid.exe' process command lines for the presence of null terminator characters or their string representations. This indicates an attempt to manipulate string handling functions.
Page 6 of 20