Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
338 detections
Filters
Last updated
All Time
Detection languages
120
98
40
28
21
Contributors
66
66
65
53
13
Categories
148
107
105
82
53
Platforms
254
113
56
29
5
Products / Services
10,670
9,758
6,693
4,421
3,749
338
MITRE Techniques
158
96
45
41
35
CVEs
3
3
2
2
2
IDS Classtypes
17
3
3
2
2
IDS Protocols
18
4
3
2
2
ClickFix style social engineering cluster delivering Mistic and ModeloRAT
Lumma NetworkIOC
YARA
Infostealer-as-a-service targeting browser credentials and crypto wallets
Fraud framework powering scam domains for crypto and gambling schemes
Fraud framework powering scam domains for crypto and gambling schemes
Form-grabbing and credential stealing malware-as-a-service
Ransomware group exploiting edge devices and managed file transfer software
Loader malware delivering follow-on ransomware payloads
Commodity .NET keylogger and remote access trojan
Clipboard hijacking malware for cryptocurrency address substitution
Commodity .NET keylogger and remote access trojan
Open-source derived remote access trojan with plugin architecture
Commodity .NET keylogger and remote access trojan
Clipboard hijacking malware for cryptocurrency address substitution
Commodity .NET keylogger and remote access trojan
This rule identifies network connections (DNS queries, HTTPS/WebSocket traffic) directed toward known suspicious domains associated with potentially malicious C2 infrastructure.
This rule monitors network traffic for HTTP POST requests directed toward specific destination ports (443 or 8770) that return HTTP status codes in the 4xx range (client errors), excluding known legitimate URI paths. This pattern may indicate scanning activity, exploitation attempts, or unauthorized access attempts against internal services or misconfigured applications.
Detects HTTP responses containing JavaScript files with a Content-Length exceeding 1MB. This behavior is associated with the Bluekit PhaaS (Phishing-as-a-Service) platform, which uses large, obfuscated JavaScript bundles for browser fingerprinting and to evade static security signatures.
Detects Python interpreter activity associated with the LegionLoader malware, specifically monitoring for Python execution from within the 'AppData\Roaming\Traiolx' directory, or outbound network connections from Python processes to known malicious infrastructure such as 'birdeemusic.com' or other suspicious outbound HTTP/HTTPS communication.
This rule detects suspicious activity involving interaction with the 'perplexity-ai.online' domain and the creation of specific browser extension files, which may indicate browser-based data exfiltration or credential theft. The rule correlates file creation events, DNS queries, and network connections, assigning a higher risk score when multiple indicators are present, particularly when evidence suggests exfiltration of keystroke or search data via web requests.
This rule monitors DNS queries for potential exfiltration or C2 communication channels. It flags DNS queries that exceed 100 characters in length or contain labels with at least 30 alphanumeric characters, excluding activity from common web browsers.
This rule detects DNS queries to known malicious domains associated with various APT groups and ransomware families. The domains are hardcoded indicators of compromise (IOCs) and their resolution suggests potential compromise or communication with adversary infrastructure.
Page 8 of 17