Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,594 detections
Filters
Last updated
All Time
Detection languages
2,463
65
36
12
11
Contributors
991
707
594
140
61
Categories
2,159
1,453
1,273
576
444
Platforms
2,418
272
203
71
63
Products / Services
10,665
9,773
6,705
4,421
3,749
2,594
MITRE Techniques
808
512
383
246
210
CVEs
18
12
12
12
10
IDS Classtypes
1,144
447
282
188
105
IDS Protocols
1,378
413
318
209
34
Detects attempts to access sensitive files like environment variables (.env), cloud provider credentials (AWS/Azure), or Terraform state files via a web server interface, specifically targeting Vite development server deployments.
This rule detects inbound HTTP requests targeting a Vite development server that attempt to access the '.env' configuration file via the '//@fs/' path, which is a known technique for sensitive file exposure in misconfigured Vite environments.
This rule detects inbound HTTP requests targeting a Vite development server that attempt to access the '.env' configuration file via the '//@fs/' path, which is a known technique for sensitive file exposure in misconfigured Vite environments.
This rule detects inbound HTTP requests targeting a Vite development server that attempt to access the '.env' configuration file via the '//@fs/' path, which is a known technique for sensitive file exposure in misconfigured Vite environments.
Detects high-volume bursts of HTTP GET requests against specific paths associated with a Vite development server (/@vite/client, /@fs/, /src/) on port 5173. This pattern is indicative of automated reconnaissance or vulnerability scanning targeting an exposed development environment.
Detects outbound network traffic to the Telegram Bot API where the request body contains keywords associated with cryptocurrency wallet software (e.g., MetaMask, Phantom, Tron). This behavior is indicative of a malicious script, possibly embedded in a Google Docs sidebar or similar web-based application, exfiltrating host/browser information or wallet-related data to an attacker-controlled Telegram bot.
Detects outbound network traffic (TCP and TLS) from internal hosts to known command and control (C2) infrastructure associated with the FamousSparrow threat actor and their SparroWocky malware suite.
Detects outbound TLS and HTTP traffic directed towards 'testing.perplexity.com', an unlocked test subdomain reportedly associated with the BragJack campaign for AI agent hijacking. This indicates potential interaction with an adversary-controlled or compromised infrastructure used to intercept or manipulate AI agent sessions.
Detects network activity (DNS queries, TLS SNI, and HTTP requests) directed towards the 'web12api.com' domain, as well as specific HTTP response structures commonly associated with adversary registration or command-and-control communication protocols.
Detects network communication with known Command and Control (C2) IP addresses associated with Phantom Stealer malware. This rule monitors both outbound connections from the internal network and inbound traffic from the identified malicious infrastructure.
Detects network communication to known malicious infrastructure associated with the SparroWocky malware, often used by the FamousSparrow threat actor. The rule monitors for established TCP or TLS-encrypted connections on ports 443 and 8080 directed toward specific IP addresses identified as part of the C2 infrastructure.
This rule detects HTTP POST requests to the Telegram Bot API where the request body contains specific action keywords (e.g., VIEW or MOBILE). This pattern is often indicative of C2 communication using legitimate Telegram infrastructure to control compromised systems.
Detects outbound network connections (both TCP and TLS) from internal hosts to known command-and-control (C2) infrastructure associated with the SparroWocky malware family. This rule monitors for established connections to a curated list of malicious IP addresses over ports 443 and 8080.
Detects outbound TLS connections from internal hosts to known IP addresses associated with the SparroWocky command-and-control infrastructure, including the specific byte sequence used during the TLS handshake to signal a ready state.
Detects network traffic on TCP port 3308 consistent with VectraRAT beaconing, utilizing MessagePack-over-TCP. The rule monitors for established connections to external networks with specific stream size and content characteristics typical of this C2 communication channel.
Detects network traffic on TCP port 3308 consistent with VectraRAT beaconing, utilizing MessagePack-over-TCP. The rule monitors for established connections to external networks with specific stream size and content characteristics typical of this C2 communication channel.
Detects network traffic on TCP port 3308 consistent with VectraRAT beaconing, utilizing MessagePack-over-TCP. The rule monitors for established connections to external networks with specific stream size and content characteristics typical of this C2 communication channel.
Detects network traffic on TCP port 3308 consistent with VectraRAT beaconing, utilizing MessagePack-over-TCP. The rule monitors for established connections to external networks with specific stream size and content characteristics typical of this C2 communication channel.
Detects HTTP GET requests to '/api.php?t=' containing a 13-digit timestamp identifier, followed by a response body containing 'download_link'. This pattern is indicative of the SilverFox malware relaying instructions or stage-two payload delivery.
Detects a host making 3 or more outbound connections within 5 minutes to AWS-hosted IP addresses known to host NJRAT C2 infrastructure from the GTA6 lure campaign, consistent with periodic RAT beaconing rather than a one-off incidental connection.
Detects a host making 3 or more outbound connections within 5 minutes to AWS-hosted IP addresses known to host NJRAT C2 infrastructure from the GTA6 lure campaign, consistent with periodic RAT beaconing rather than a one-off incidental connection.
Page 76 of 124