Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,594 detections
Filters
Last updated
All Time
Detection languages
2,463
65
36
12
11
Contributors
991
707
594
140
61
Categories
2,159
1,453
1,273
576
444
Platforms
2,418
272
203
71
63
Products / Services
10,665
9,773
6,705
4,421
3,749
2,594
MITRE Techniques
808
512
383
246
210
CVEs
18
12
12
12
10
IDS Classtypes
1,144
447
282
188
105
IDS Protocols
1,378
413
318
209
34
Detects high-frequency, repeated exploitation attempts or IDS alerts referencing Siemens S7 CVEs directed at a single destination IP, potentially indicating iterative exploit development or automated vulnerability testing against Industrial Control System (ICS) hardware.
Detects outbound HTTP POST requests characterized by an 'application/octet-stream' content type, a specific URI structure consisting of three components (20-40 characters, alpha-numeric, 20-40 characters), and an encrypted payload. This behavioral pattern is associated with SynkLoader malware command-and-control (C2) communications.
Detects HTTP traffic directed to known abused web hosting platforms and SaaS site builders frequently used by the BengalSEO campaign to host search engine optimization (SEO) poisoning lures. These lures typically mimic service activation or support pages to trick users into downloading malicious content.
Detects outbound network traffic to the Telegram Bot API (api.telegram.org) via TLS SNI or HTTP requests, which is a common communication channel for Command and Control (C2) or management for Phishing-as-a-Service (PhaaS) platforms.
Detects unauthorized S7comm 'GET' or 'Read' operations directed at Siemens S7 Series PLCs over TCP port 102. These commands are often used in reconnaissance phases of ICS/OT attacks to map memory blocks, read ladder logic, or identify system state before executing more disruptive operations.
Detects repeated attempts to establish S7comm connections to a Programmable Logic Controller (PLC) on port 102. This behavior is indicative of network reconnaissance or scanning targeting Industrial Control Systems (ICS).
Detects network activity (DNS, TLS SNI, and HTTP Host) associated with the SynkLoader malware's command-and-control infrastructure using the domain 'dondermicapp.net'.
Detects network traffic associated with the BengalSEO campaign, specifically the retrieval of a rogue Matomo analytics script from 'stats.us3.org' and the presence of a specific Google Tag Manager ID (G-5Y9CZZF6WJ) in file traffic. This behavior is indicative of a supply chain or SEO poisoning attack aiming to track or redirect users.
Detects network traffic consistent with the ClickFix macOS loader, specifically identifying POST requests containing 'event=pasted' and a 'BuildID' header, which are indicative of a beaconing or telemetry heartbeat.
Detects persistent outbound TCP connections to external infrastructure, which is indicative of a potential backconnect proxy or C2 communication tunnel. The rule uses a threshold to filter out transient connections.
This rule detects QUIC network traffic where the TLS certificate subject and issuer match specific patterns associated with 'RAT System' and 'RAT CA'. This signature indicates potential command-and-control (C2) communication utilizing self-signed certificates for authentication pinning in an attempt to masquerade or secure malicious traffic.
Detects network activity associated with the NovaCookies phishing campaign, specifically identifying HTTP redirects, TLS SNI connections, or HTTP host headers pointing to infrastructure utilizing .vu top-level domains.
This rule detects patterns characteristic of the ClearFake/EtherHiding campaign, specifically identifying the injection of malicious JavaScript within HTTP responses. The rule monitors for the creation of a script element and the use of base64-encoded javascript content, which is a known technique used in these attacks to facilitate drive-by compromises.
Detects outbound network connections from internal hosts to known IP addresses associated with Dark Caracal's GoCaracal malware command and control infrastructure.
Detects DNS queries for domains identified as part of the GoCaracal campaign, associated with the threat actor Dark Caracal. These domains are known to be used for the delivery and staging of SVG-based phishing attacks.
Detects Microsoft-branded phishing pages served from non-Microsoft domains, the subsequent credential submission, and the establishment of a WebSocket relay connection characteristic of the Mirage2FA Adversary-in-the-Middle (AiTM) toolkit. This rule correlates multiple stages of the phishing flow to identify active proxy-based credential and MFA bypass attempts.
Detects outbound HTTP POST requests to known SynkLoader C2 domains or URI patterns, characterized by 'application/octet-stream' Content-Type headers. The rule targets specific hardcoded domains used by the malware and a suspicious nested URI path pattern commonly associated with its beaconing behavior.
Detects HTTP traffic communicating with known domains (grove-12.com and trekmesh15.com) associated with the Codex ClickFix/AMOS campaign, specifically looking for indicators of payload staging or beaconing activity through specific URI patterns.
Detects DNS queries to Cloudflare Workers subdomains that mimic the QUICAgent beaconing pattern. Adversaries utilize these workers as dead-drop resolvers to retrieve updated C2 instructions or redirection information, effectively blending in with legitimate traffic to the workers.dev domain.
Detects network traffic consistent with SynkLoader malware communicating with its C2 infrastructure. The rule identifies suspicious TLS SNI requests to known hardcoded domains and HTTP POST requests using the application/octet-stream content type, which are characteristic of SynkLoader C2 beaconing.
Detects outbound HTTP POST requests with a specific URI pattern associated with C2Looper malware communication, indicating potential C2 activity or data exfiltration.
Page 91 of 124