Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,594 detections
Filters
Last updated
All Time
Detection languages
2,463
65
36
12
11
Contributors
991
707
594
140
61
Categories
2,159
1,453
1,273
576
444
Platforms
2,418
272
203
71
63
Products / Services
10,665
9,773
6,705
4,421
3,749
2,594
MITRE Techniques
808
512
383
246
210
CVEs
18
12
12
12
10
IDS Classtypes
1,144
447
282
188
105
IDS Protocols
1,378
413
318
209
34
Detects repeated attempts to perform IIS 8.3 tilde short-filename enumeration. This reconnaissance technique exploits the legacy DOS 8.3 file naming convention to identify the existence and naming of files or directories on a Microsoft IIS web server.
Detects outbound HTTP requests to 'letsdiskuss.com' with a URI pattern of '/user/', which is characteristic of the 'STAC4924' loader utilizing a dead-drop resolver for command-and-control communication.
Detects the handshake process for Blackwood/Chisel reverse SOCKS5 or TCP-over-HTTP tunneling to a known malicious Iranian-hosted C2 IP address. The detection matches specific HTTP headers used by the Chisel tool during its initialization phase.
Detects the handshake process for Blackwood/Chisel reverse SOCKS5 or TCP-over-HTTP tunneling to a known malicious Iranian-hosted C2 IP address. The detection matches specific HTTP headers used by the Chisel tool during its initialization phase.
Detects a network connection handshake indicating the use of Chisel, a fast TCP/UDP tunnel over HTTP, specifically identifying potential command-and-control beaconing activity.
Detects network activity related to the 'Blinder Tunnel' C2 infrastructure. The rules identify a Chisel tunnel client initiating a WebSocket handshake (identifiable by the 'chisel-v3-channel' header) to external infrastructure and a DNS lookup for a specific domain (soroshpasargad.com) identified as a relay nameserver used by the threat actor CL-STA-1178.
Detects network activity related to the 'Blinder Tunnel' C2 infrastructure. The rules identify a Chisel tunnel client initiating a WebSocket handshake (identifiable by the 'chisel-v3-channel' header) to external infrastructure and a DNS lookup for a specific domain (soroshpasargad.com) identified as a relay nameserver used by the threat actor CL-STA-1178.
Detects network activity related to the 'Blinder Tunnel' C2 infrastructure. The rules identify a Chisel tunnel client initiating a WebSocket handshake (identifiable by the 'chisel-v3-channel' header) to external infrastructure and a DNS lookup for a specific domain (soroshpasargad.com) identified as a relay nameserver used by the threat actor CL-STA-1178.
Detects network activity (DNS queries, HTTP Host headers, and TLS SNI) directed towards the known Blinder Tunnel staging domain 'asdfafadafg.online'. This behavior is indicative of command-and-control (C2) communication or initial staging of malicious payloads.
Detects network activity (DNS queries, HTTP Host headers, and TLS SNI) directed towards the known Blinder Tunnel staging domain 'asdfafadafg.online'. This behavior is indicative of command-and-control (C2) communication or initial staging of malicious payloads.
Detects network activity (DNS queries, HTTP Host headers, and TLS SNI) directed towards the known Blinder Tunnel staging domain 'asdfafadafg.online'. This behavior is indicative of command-and-control (C2) communication or initial staging of malicious payloads.
This rule detects outbound network connections directed at a known IP address associated with Akira ransomware infrastructure. The rule specifically monitors for communication with 64.227.4.134, which has been identified as a C2 node utilizing GOST tunnels. This behavior is indicative of established C2 connectivity by Akira ransomware actors.
Detects SQL injection exploitation attempts against MOVEit Transfer targeting the CVE-2023-34362 vulnerability, followed by the deployment and subsequent interaction with the 'human2.aspx' webshell associated with Cl0p ransomware mass-exploitation campaigns.
Detects HTTP GET requests for AgtaBackupAgent.msi or AgtaBackupAgent.version, which are indicative of the download phase of the AgtaBackup Remote Access Trojan (RAT).
Detects the 'HCENC1:' marker in HTTP request and response bodies, which is associated with RUSTYSHADE malware used by the APT36 (Transparent Tribe) threat group for Command and Control communications.
Detects outbound HTTP GET requests to the known malicious domain 'docsportal.in' attempting to retrieve second-stage payloads such as '161.php' or 'com.hta'. This pattern is associated with the SideCopy threat actor's malware delivery infrastructure.
Detects network communication associated with SideCopy's ReverseRAT malware by monitoring for DNS lookups to a known malicious domain (dns.educationportals.biz) and outbound connections to a hardcoded C2 IP address (45.61.157.22).
Detects DNS queries for the domain 'docsportal.in', which is associated with the SideCopy threat group's HTA-staging activity for delivering the ReverseRAT malware.
Detects HTTP GET requests to Backblaze B2 storage hosting specific archive files identified as payloads for the RustyShade/RustyMove malware family, often used by the APT36 threat group.
Detects HTTP traffic containing the 'User-token' header, which is indicative of command-and-control (C2) communication patterns associated with the curlRAT backdoor, often attributed to North Korean threat actors such as APT37, Lazarus, or Kimsuky.
This rule detects potential exploitation attempts targeting the CAPWAP (Control and Provisioning of Wireless Access Points) protocol in FortiOS or FortiSwitchManager. The rule identifies suspicious UDP traffic on port 5246 containing an oversized payload (greater than 1400 bytes), which is characteristic of the exploitation pattern for CVE-2025-25249.
Page 8 of 124