Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
41 detections
Filters
Last updated
All Time
Detection languages
26
8
6
1
Contributors
41
Categories
20
10
6
4
4
Platforms
40,154
7,369
6,547
3,915
3,692
41
Products / Services
9
7
7
4
4
MITRE Techniques
13
8
7
5
5
CVEs
9
IDS Classtypes
3
2
1
IDS Protocols
3
1
Detects a privileged/elevated AI-agent tool invocation whose arguments are sourced from sandbox runtime output within 30 seconds of a PBKDF2/AES decrypt event, with no provenance tag distinguishing that output from trusted state — the generic post-decryption privileged-action sequence behind Cryptographic Context Injection attacks.
Detects an AI agent sandbox exfiltrating harvested PII/session context by embedding it as an x-auth-token query parameter in an outbound HTTP request to an external host — the network-observable exfiltration stage of Cryptographic Context Injection.
Detects an AI agent disclosing system-prompt or safety-policy content, or returning sandbox re-encrypted ciphertext-only output, immediately following a cryptographic-injection-style probe request in the same session — the safety-policy-bypass stage of Cryptographic Context Injection.
Detects an AI agent's code-execution sandbox decrypting attacker-supplied AES/PBKDF2 ciphertext immediately after fetching untrusted external content — the core trust-laundering mechanism behind Cryptographic Context Injection attacks.
Detects crates.io publish events combining an impersonation indicator (attacker account names/forged author email) with one of the known malicious package names, indicating a compromised or impersonated maintainer account was used to publish the Rust supply-chain payload.
Detects HTTP requests to the attacker's WebApp-Form-Host operator panel managing compromised WordPress sites at scale (wp-uploading.php/wp-verifyup.php with activator parameters).
Detects HTTP requests to the malicious 'verify' WordPress plugin serving the fake CAPTCHA ClickFix overlay.
Detects DNS resolution, network connections, or email-embedded URLs matching known JWR phishing framework hosting domains and IP addresses, including banking/government/logistics brand-impersonation lookalikes and smishing-delivered typosquats.
Detects HTTP requests to StopAndProtect's WordPress webshells and malicious MU-plugin backdoor endpoints.
Detects HTTP traffic to StopAndProtect's compromised-WordPress C2 operational endpoints, heartbeat beaconing, encrypted-archive exfiltration, and victim data directory access.
Detects a single source device or IP maintaining genuinely time-overlapping sign-in sessions under two or more distinct user identities, excluding known shared/kiosk devices and shared VPN egress points, consistent with a single PurpleDelta operator working multiple jobs simultaneously.
Detects HTTP requests using JWR's e-commerce integration masquerade, where a base64-encoded 's' parameter carries harvested card data or a 'cart_data' parameter resolves to a non-Shopify checkout domain used to spoof the WebSocket C2 origin.
Detects sign-ins with impossible browser/OS combinations and Outlook-labeled sign-ins presenting non-native user agents, consistent with Storm-2755 AiTM session token replay and impersonation.
Correlates DNS/network requests to newly observed domains matching JWR's brand-plus-suffix generation pattern across .top/.cfd/.info/.cc TLDs, requiring multiple distinct hostnames sharing the same brand token within a short window to flag likely batch-registered phishing infrastructure.
Detects an account making repeated Microsoft Graph API user search requests for payroll/HR display names via an axios HTTP client against a specific ApplicationId, consistent with Storm-2755 payroll-personnel reconnaissance.
Detects bursts of 10+ MailItemsAccessed events within 60 seconds via a REST client with a specific ClientAppId/APIId pairing, consistent with automated mailbox collection using a replayed AiTM-stolen session token.
Detects OfficeHome sign-ins with error 90014 (nonce omission) followed by anomalous successful sign-ins from a different IP, or repeated 90014 failures, consistent with AiTM token replay activity.
Detects inbound email lures impersonating a Microsoft Call Center voicemail notification, consistent with the Storm-2755 (Payroll Pirates) AiTM phishing campaign.
Detects Antino's abuse of trusted cloud services — Microsoft Graph API and Google Docs — as C2 channels, gated on non-standard TLS ports, missing browser User-Agent, and non-HTML response bodies to reduce false positives from the very high volume of legitimate traffic to these domains.
Detects a single user account signing into OfficeHome from 3+ distinct proxy/anyIP-flagged IP addresses within a 15-minute window, consistent with AiTM session replay from rotating residential proxy infrastructure.
Detects creation of malicious Exchange inbox rules (move to Deleted Items / mark as read) correlated via SessionId to an interactive sign-in from the Datawagon hosting ASN (27176) and a subsequent MailItemsAccessed event, consistent with Storm-2755 AiTM session-replay and mailbox-hiding persistence.
Page 1 of 2