Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
404 detections
Filters
Last updated
All Time
Detection languages
193
104
95
4
3
Contributors
90
77
62
50
22
Categories
231
151
101
83
77
Platforms
270
109
39
18
9
Products / Services
10,665
9,758
6,692
4,421
3,749
404
MITRE Techniques
138
119
74
64
47
CVEs
4
2
2
2
1
IDS Classtypes
1
IDS Protocols
1
Detects a web request bypassing SafeSquid filtering policy. The extractor exposes
BYPASSED as a distinct action, which is unusual and valuable — most gateways record
only allow or block, so a bypass is normally indistinguishable from an allow.
A bypass means policy was deliberately not applied to that request, and the question
is who arranged that.
Onboarding: SAFESQUID-SWG is ingested via Syslog (Bloo extractor 812).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=webfilter where sourcename='SAFESQUID-SWG' and action='BYPASSED'
| groupby srcip, user, domain, url, category
BYPASSED as a distinct action, which is unusual and valuable — most gateways record
only allow or block, so a bypass is normally indistinguishable from an allow.
A bypass means policy was deliberately not applied to that request, and the question
is who arranged that.
Onboarding: SAFESQUID-SWG is ingested via Syslog (Bloo extractor 812).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=webfilter where sourcename='SAFESQUID-SWG' and action='BYPASSED'
| groupby srcip, user, domain, url, category
Detects potential data exfiltration to popular public paste-sites and code-sharing services (such as Pastebin, Paste.ee, Hastebin, Ghostbin, ControlC, Dpaste, Rentry.co, Privatebin) using HTTP POST or PUT requests based on upload frequency and volume thresholds.
Detects potential exploitation of the libcurl CURLOPT_REQUEST_TARGET CRLF injection vulnerability via web/proxy request logs where curl user-agents are observed with carriage return/line feed characters or injected request lines within the URI path.
Detects HTTP proxy traffic containing specific header or cookie patterns associated with the Evilginx2 or BigBear adversary-in-the-middle (AiTM) phishing frameworks. These frameworks use these artifacts to proxy connections and facilitate the theft of session tokens for MFA bypass.
Detects network traffic indicators associated with Cobalt Strike beaconing activity, specifically focusing on common default or near-default Malleable C2 HTTP profile patterns. This includes hardcoded URI paths often used in default configurations (e.g., jQuery library names, pixel gifs) and specific combinations of HTTP headers and user-agent strings commonly observed in adversary C2 frameworks.
Detects network traffic to the Telegram Bot API where the request URI contains indicators of sensitive data exfiltration such as 'cookie', 'session', 'password', or 'credential'. This pattern is often associated with adversary-in-the-middle (AiTM) phishing kits (e.g., Evilginx2) exfiltrating stolen session tokens or credentials to an attacker-controlled Telegram bot.
Detects large outbound HTTP POST requests to known public AI-inference APIs and paste services. This pattern is potentially indicative of data exfiltration or sensitive information exposure where attackers leverage third-party services to bypass traditional outbound egress filtering.
Detects outbound HTTP requests traversing a proxy where the User-Agent string contains structurally consistent but algorithmically randomized components. This pattern is characteristic of AI-generated C2 client code attempting to create plausible yet non-standard browser signatures for each beacon. Detection relies on identifying User-Agent strings that follow a standard browser template (e.g., Chrome/Safari) but include anomalous hex/alphanumeric tokens in the version fields.
Detects suspicious outbound HTTPS POST traffic to major generative AI API endpoints (OpenAI, Anthropic, Google) originating from scripting hosts like powershell.exe or python.exe. The detection is triggered by either unusually large outbound payload sizes or the use of unauthorized scripting tools, which is indicative of data exfiltration using AI infrastructure as a relay.
This rule detects HTTP POST requests originating from legacy and outdated User-Agent strings (specifically older versions of Internet Explorer). Such User-Agent strings are frequently utilized by automated tools, scripts, or malware beaconing to command-and-control (C2) servers, as they are often used to evade security filters or simulate legacy traffic. The rule filters out common content types like text/html or image files to focus on potentially malicious API interactions.
Detects external reconnaissance activity targeting AI backend services. Adversaries scan for known AI infrastructure ports (such as TensorFlow Serving, Triton, or Ray) and common API paths (e.g., /v1/models, /predict) to identify potential targets. The detection utilizes proxy logs to correlate these suspicious network attributes, high request rates, or known scanning user agents.
This rule detects potentially malicious traffic patterns associated with 'ClickFix' phishing campaigns, specifically those leveraging a combination of Google Ads redirects through ChatGPT Custom GPT URLs and malicious landing pages hosted on Google Sites that contain 'antibot' identifiers.
Detects high volumes of HTTP redirect responses (3xx status codes) associated with a single client IP address, which is indicative of a redirect chain often used in malicious activity such as drive-by compromise or social engineering campaigns involving fake browser updates or 'ClickFix' lures.
Detects HTTP(S) requests to known SideCopy/ReverseRAT payload-delivery URLs identified in Operation SideCopy spear-phishing campaigns targeting Indian academia.
Detects HTTP(S) requests to known SideCopy/ReverseRAT payload-delivery URLs identified in Operation SideCopy spear-phishing campaigns targeting Indian academia.
Detects HTTP proxy requests for ZIP archives where the Referer header indicates a navigation originated from a GitHub Pages (github.io) site, but the destination is not a GitHub domain. This behavior is indicative of a multi-hop redirect chain used in campaigns to deliver malicious payloads, such as infostealers, by abusing GitHub Pages to redirect users to external hosting for ZIP archive downloads.
Detects outbound HTTP POST requests from an AI agent runtime environment to known external paste-sites, webhook providers, or staging services. This behavior is indicative of a compromise where the AI agent is being manipulated to exfiltrate sensitive API keys, tokens, or configuration secrets to an attacker-controlled endpoint.
Detects suspicious mobile-device HTTP traffic patterns indicative of 'quishing' (QR code phishing). The rule identifies mobile HTTP GET requests (iPhone, Android, Mobile Safari, iPad) that lack a Referer header, followed by HTTP POST requests to common credential entry URI patterns (e.g., /login, /signin) over the same protocol, which is a behavioral indicator of a user being redirected from a scanned QR code to a malicious phishing landing page.
Detects high-volume data transfers (exceeding 100MB) from internal sources to known external cloud storage and file-sharing platforms. This behavior is consistent with data staging and exfiltration patterns, often used by threat actors to move collected data to attacker-controlled storage infrastructure.
Detects HTTP(S) requests to known SideCopy/ReverseRAT payload-delivery URLs identified in Operation SideCopy spear-phishing campaigns targeting Indian academia.
Detects web-proxy or webserver log activity associated with domains registered within the last 30 days that mimic branding or structure of major identity providers (Microsoft, Okta, Google, Duo). This behavior is characteristic of adversary-in-the-middle (AiTM) phishing infrastructure staging.
Page 1 of 20