Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,594 detections
Filters
Last updated
All Time
Detection languages
2,463
65
36
12
11
Contributors
991
707
594
140
61
Categories
2,159
1,453
1,273
576
444
Platforms
2,418
272
203
71
63
Products / Services
10,665
9,773
6,705
4,421
3,749
2,594
MITRE Techniques
808
512
383
246
210
CVEs
18
12
12
12
10
IDS Classtypes
1,144
447
282
188
105
IDS Protocols
1,378
413
318
209
34
This rule detects network traffic indicative of the PEEP Browser RAT, specifically HTTP beacons targeting the URI path '/api/commands'. It monitors for unique HTTP headers ('X-PEEP-Agent-Id', 'X-PEEP-Agent-Key') and connections to known malicious infrastructure.
Detects outbound HTTP requests to known Kimsuky command and control (C2) infrastructure associated with the Stella_Gary campaign. The rule monitors for specific URI patterns ('/unicorn/mort.php' or '/unicorn/uni.txt') commonly used by this threat actor for beaconing.
Detects outbound HTTP requests to known Kimsuky command and control (C2) infrastructure associated with the Stella_Gary campaign. The rule monitors for specific URI patterns ('/unicorn/mort.php' or '/unicorn/uni.txt') commonly used by this threat actor for beaconing.
Detects HTTP beaconing activity associated with the Kimsuky threat group (Stella_Gary), specifically identifying requests to the /unicorn/ path. This pattern is characteristic of their C2 communication mechanism, which masquerades as legitimate browsing.
Detects HTTP beaconing activity associated with the Kimsuky threat group (Stella_Gary), specifically identifying requests to the /unicorn/ path. This pattern is characteristic of their C2 communication mechanism, which masquerades as legitimate browsing.
Detects HTTP beaconing activity associated with the Kimsuky threat group (Stella_Gary), specifically identifying requests to the /unicorn/ path. This pattern is characteristic of their C2 communication mechanism, which masquerades as legitimate browsing.
Detects established network connections to a known Kimsuky-associated infrastructure (107.172.249.140) on port 443. The rule filters out standard TLS handshakes by inspecting initial packet content, targeting non-standard or custom-protocol traffic, and limits alerts to once per hour per source host to reduce noise.
Detects established network connections to a known Kimsuky-associated infrastructure (107.172.249.140) on port 443. The rule filters out standard TLS handshakes by inspecting initial packet content, targeting non-standard or custom-protocol traffic, and limits alerts to once per hour per source host to reduce noise.
Detects established network connections to a known Kimsuky-associated infrastructure (107.172.249.140) on port 443. The rule filters out standard TLS handshakes by inspecting initial packet content, targeting non-standard or custom-protocol traffic, and limits alerts to once per hour per source host to reduce noise.
Detects HTTP GET requests associated with the Kimsuky threat actor, specifically targeting the retrieval of payloads like uni.txt or files matching the test.bef_fri pattern from the /unicorn/ directory.
Detects HTTP GET requests associated with the Kimsuky threat actor, specifically targeting the retrieval of payloads like uni.txt or files matching the test.bef_fri pattern from the /unicorn/ directory.
Detects HTTP GET requests associated with the Kimsuky threat actor, specifically targeting the retrieval of payloads like uni.txt or files matching the test.bef_fri pattern from the /unicorn/ directory.
Detects outbound WebSocket upgrade requests from internal network assets to known IronToll C2 IP addresses, restricted to requests whose Host header ends in one of the disposable TLDs observed across the campaign's 73+ rotating lookalike domains (.cfd, .sbs, .shop, .icu, .buzz, etc). This narrows the alert to the campaign's actual phishing-domain pattern rather than any WebSocket traffic that happens to reach the same shared Tencent/Alibaba cloud IPs, and a per-source threshold caps repeat alerts from the same host to one per hour.
Detects DNS queries for lookalike domains combining a government/brand-impersonation keyword (as its own label, not a substring) with a disposable TLD used across the IronToll campaign. Dropped the standalone 'digital' keyword, which was generic enough to match ordinary e-commerce domains on the same TLDs.
Detects DNS queries, TLS SNI, and HTTP Host header traffic associated with the IronToll phishing campaign. The rule specifically monitors for government-impersonating domains and lookalike domains utilizing various non-standard top-level domains (TLDs).
Detects DNS queries, TLS SNI, and HTTP Host header traffic associated with the IronToll phishing campaign. The rule specifically monitors for government-impersonating domains and lookalike domains utilizing various non-standard top-level domains (TLDs).
Detects country-coded lure path requests (/eg, /ma) followed by a cloaking differential response (desktop UA blocked with 404, mobile UA served content). Fixed a regex bug where the original pattern matched any path merely starting with 'eg' or 'ma' (e.g. /egg.jpg, /mail, /manifest.json) instead of the exact path segment.
Detects the Iron Man System phishing kit via its HTTP fingerprint: a request-header rule (ETag/Server/Via combo) checked on the external server's response, and three request-side rules checking for the kit's hashed asset paths and favicon when an internal host requests them from an external site. Fixed a direction bug on the three request-side rules that had source/destination reversed (they previously required an external host to request the path from an internal server, which would rarely if ever fire).
Detects the Iron Man System kit's known template artifact path, and separately its randomized per-deployment admin-panel path shape combined with a Host header on a disposable TLD. Splitting these and requiring the disposable-TLD host on the generic admin-path rule avoids matching legitimate multi-tenant apps or hardened CMS installs that use similar random-path-plus-/admin/ obfuscation on ordinary domains.
Detects the Iron Man System kit's known template artifact path, and separately its randomized per-deployment admin-panel path shape combined with a Host header on a disposable TLD. Splitting these and requiring the disposable-TLD host on the generic admin-path rule avoids matching legitimate multi-tenant apps or hardened CMS installs that use similar random-path-plus-/admin/ obfuscation on ordinary domains.
This rule detects DNS queries for the hardcoded domain 'gsx.uk.com', which is associated with the command-and-control (C2) infrastructure of BabylonRAT malware.
Page 74 of 124