Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
66 detections
Filters
Last updated
All Time
Detection languages
37
17
7
2
2
Contributors
16
14
10
7
3
Categories
19
15
14
13
10
Platforms
39,908
7,245
6,529
3,864
3,627
66
Products / Services
16
8
8
7
6
MITRE Techniques
17
14
9
9
7
IDS Classtypes
4
3
IDS Protocols
5
2
Detects network, DNS, email, and URL click events matching known IOC domains associated with AdFection, Candiru, and Discover-Tech threat intelligence reports.
Identifies devices that have been enrolled within the last 30 days, displaying details such as device name, model, enrollment profile name, and enrollment date.
IOC sweep for P7 DarkSword / Coruna: known file hashes, C2/exploit-host IPs, domains and URLs against Defender device file and network events. Tightened to public IPs, connection action types, exact hosts/subdomains and path-qualified URLs; the shared AWS IP is only matched with its C2 port.
Detects network, DNS, email, and URL click events matching known IOC domains associated with AdFection, Candiru, and Discover-Tech threat intelligence reports.
Detects network, DNS, email, and URL click events matching known IOC domains associated with AdFection, Candiru, and Discover-Tech threat intelligence reports.
Detects when a device connects to a wireless network SSID that has not been observed in the baseline over the previous 14 days.
Detects network, DNS, email, and URL click events matching known IOC domains associated with AdFection, Candiru, and Discover-Tech threat intelligence reports.
IOC sweep for P7 DarkSword / Coruna: known file hashes, C2/exploit-host IPs, domains and URLs against Defender device file and network events. Tightened to public IPs, connection action types, exact hosts/subdomains and path-qualified URLs; the shared AWS IP is only matched with its C2 port.
IOC sweep for P7 DarkSword / Coruna: known file hashes, C2/exploit-host IPs, domains and URLs against Defender device file and network events. Tightened to public IPs, connection action types, exact hosts/subdomains and path-qualified URLs; the shared AWS IP is only matched with its C2 port.
IOC sweep for P7 DarkSword / Coruna: known file hashes, C2/exploit-host IPs, domains and URLs against Defender device file and network events. Tightened to public IPs, connection action types, exact hosts/subdomains and path-qualified URLs; the shared AWS IP is only matched with its C2 port.
Detects network, DNS, email, and URL click events matching known IOC domains associated with AdFection, Candiru, and Discover-Tech threat intelligence reports.
IOC sweep for P7 DarkSword / Coruna: known file hashes, C2/exploit-host IPs, domains and URLs against Defender device file and network events. Tightened to public IPs, connection action types, exact hosts/subdomains and path-qualified URLs; the shared AWS IP is only matched with its C2 port.
Detects a multi-stage exploit chain targeting iOS Safari clients, characterized by the sequential fetching of specific JavaScript modules (platform_module.js, utility_module.js, Stage1, Stage3, and bootstrap.dylib) and subsequent callback communication to a remote server. This pattern is consistent with a browser-based exploit framework targeting iOS devices.
Detects a multi-stage exploit chain targeting iOS Safari clients, characterized by the sequential fetching of specific JavaScript modules (platform_module.js, utility_module.js, Stage1, Stage3, and bootstrap.dylib) and subsequent callback communication to a remote server. This pattern is consistent with a browser-based exploit framework targeting iOS devices.
Detects a multi-stage exploit chain targeting iOS Safari clients, characterized by the sequential fetching of specific JavaScript modules (platform_module.js, utility_module.js, Stage1, Stage3, and bootstrap.dylib) and subsequent callback communication to a remote server. This pattern is consistent with a browser-based exploit framework targeting iOS devices.
Detects a multi-stage exploit chain targeting iOS Safari clients, characterized by the sequential fetching of specific JavaScript modules (platform_module.js, utility_module.js, Stage1, Stage3, and bootstrap.dylib) and subsequent callback communication to a remote server. This pattern is consistent with a browser-based exploit framework targeting iOS devices.
Detects phishing emails themed around Atlantic Council invitations that contain links attempting to lure users into installing iOS configuration profiles, often associated with malicious backdoors like DarkSword, attributed to the Star Blizzard (G1033) threat group.
Detects potential Adversary-in-the-Middle (AiTM) MFA bypass attacks (quishing). The rule correlates receipt of an email containing an image attachment (potential QR code) but no URL, followed by a risky mobile sign-in event from a device that is unmanaged or lacks trust within a two-hour window.
Detects suspicious mobile-device HTTP traffic patterns indicative of 'quishing' (QR code phishing). The rule identifies mobile HTTP GET requests (iPhone, Android, Mobile Safari, iPad) that lack a Referer header, followed by HTTP POST requests to common credential entry URI patterns (e.g., /login, /signin) over the same protocol, which is a behavioral indicator of a user being redirected from a scanned QR code to a malicious phishing landing page.
Detects network traffic from mobile devices to the Google Gemini API (generativelanguage.googleapis.com) specifically targeting the 'generateContent' endpoint. This behavior is indicative of mobile malware (e.g., RatHat/PromptSpy) that may be utilizing AI-assisted UI-automation, potentially to exfiltrate screen content or automate malicious interactions by processing visual layout data through a generative model.
Detects network traffic from mobile devices to the Google Gemini API (generativelanguage.googleapis.com) specifically targeting the 'generateContent' endpoint. This behavior is indicative of mobile malware (e.g., RatHat/PromptSpy) that may be utilizing AI-assisted UI-automation, potentially to exfiltrate screen content or automate malicious interactions by processing visual layout data through a generative model.
Page 1 of 4