Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,230 detections
Filters
Last updated
All Time
Detection languages
2,175
1,018
354
260
212
Contributors
1,013
818
688
574
212
Categories
20,456
11,839
5,876
5,155
4,865
4,230
Platforms
2,933
889
585
248
198
Products / Services
2,239
1,453
841
416
344
MITRE Techniques
1,164
1,087
870
798
439
CVEs
22
20
20
18
17
IDS Classtypes
927
408
222
146
104
IDS Protocols
1,914
105
70
47
6
Detects HTTP POST requests directed at PHP script endpoints with randomized 16-32 character hexadecimal filenames, which is a known C2 communication pattern used by the StealC infostealer.
Detection rule monitoring for indicators of compromise related to SolarWinds Serv-U, including anomalous Content-Encoding headers, unexpected child process execution, large file staging indicative of data exfiltration (Cl0p-style), outbound exfiltration, SQL injection artifacts, and unauthorized LDAP/Active Directory object enumeration by the Serv-U process.
This rule detects network activity associated with the StealC information stealer, specifically focusing on HTTP POST requests made to known command-and-control (C2) domains. It identifies characteristic URL patterns, such as randomly generated 16-character PHP files or specific index.php structures, which are used for bot registration and communication. The detection includes patterns indicative of RC4-encrypted payloads and behavior mimicking Amadey bot status checks.
This rule detects potential re-compromise attempts by monitoring for access, file creation, or process execution associated with a set of known malicious web shell files. It correlates IIS web server logs (HTTP POST requests to shell files), EDR file modification events, and EDR process spawning events from common web server binaries (w3wp.exe, coldfusion.exe, jrun.exe) to identify persistence remaining after remediation.
Identifies AI agents (python.exe or node.exe) making outbound GET requests where sensitive local data is extracted and appended as URL parameters for exfiltration. This rule specifically looks for URL parameters like 'q', 'data', 'context', or 'query' containing at least 50 alphanumeric characters, underscores, or hyphens, while excluding legitimate API calls to OpenAI and Anthropic.
Detects anomalous network traffic patterns communicating with the Telegram Bot API (api.telegram.org) from non-official Telegram processes. The rule identifies potential command and control (C2) activity by analyzing request frequency, specific API method usage (e.g., getUpdates, sendMessage), and beaconing-like behavior.
Detects anomalous network traffic patterns indicative of two distinct techniques: P2P injection into Microsoft 365 Copilot search queries and Server-Side Request Forgery (SSRF) leveraging Bing's image search functionality for data exfiltration.
Detects network requests to Google image search containing an 'imgurl' parameter, which can be used by an attacker to exfiltrate data by forcing an external service to crawl a controlled URL containing sensitive information.
This rule monitors network traffic for suspicious patterns indicating exploitation of LocalStack environments. It detects three primary malicious activities: Velocity Template Language (VTL) injection targeting reflection methods (e.g., ProcessBuilder) for RCE; unauthorized manipulation of API Gateway resources (e.g., creating or modifying deployments) accompanied by IAM scope bypass techniques; and direct execution of RCE-style API triggers against known LocalStack port 4566.
Detects outbound network connections to a known Djinn Stealer C2 IP address (96.126.130.126) on port 58942, utilizing the specific User-Agent 'telemetry-client/1.0' and 'application/octet-stream' content type. This behavior is indicative of data exfiltration of encrypted/compressed archives.
Detects network activity associated with Djinn Stealer malware, identifying either direct connections to a known command-and-control (C2) server or HTTP exfiltration attempts using a characteristic User-Agent string and binary content type.
Detects phishing lures delivered through social media messaging services
Detects web access logs matching the specific 'wp_debug_session' parameter used by the ErrTraffic webshell to communicate with compromised servers. This rule identifies HTTP requests containing both 'wp_debug_session=' and 'mode=php' in the URI query string, which are indicators of ErrTraffic webshell activity.
Detects Node.js process querying Ethereum blockchain for C2 address.
Detects network traffic associated with the EvilTokens phishing kit's 'killed' gate check mechanism. The kit GETs /api/device/gate/<PAGE_ID> with the ngrok-skip-browser-warning header. When the backend returns a killed flag, the phishing page wipes the DOM and renders a fake 'Page Not Found - Microsoft' error to evade analysis or block specific victims.
Detects users clicking links from emails containing Canadian payroll lures leading to fake Workday/ADP domains. The rule specifically looks for navigation to URLs matching a regex pattern for Workday, ADP, or payroll-related terms combined with login/auth/secure keywords, and correlates this with browser process events (Chrome or Edge).
Detects potential Browser-in-the-Middle (BitM) phishing activity by identifying a client browser that fetches the 'rrweb' session-recording library followed by a WebSocket connection to a different origin within 5 minutes. This sequence is indicative of an attacker-controlled browser streaming the victim's DOM and interaction events to a phishing infrastructure.
Detects browser-based WebRTC STUN traffic initiated from phishing landing pages used by the Bluekit PhaaS platform. The rule identifies suspicious STUN requests originating from browsers that exhibit a WebRTC IP mismatch when compared to the active HTTPS session IP, a technique used by attackers to de-anonymize security researchers and bypass automated analysis sandboxes.
Detects network activity associated with the Turla group's STOCKSTAY malware infrastructure. This includes downloading MSI installers or server scripts from GitHub, as well as WebSocket C2 communications with the onrender.com platform.
Detects anomalous WebSocket connections on web pages that utilize the 'rrweb' session replay library, often used by phishing infrastructure such as the Bluekit Browser-in-the-Middle (AiTM) kit to capture and relay real-time victim input (keystrokes and mouse movements) to attacker-controlled consoles.
This rule detects network activity associated with the Bluekit PhaaS (Phishing-as-a-Service) BitM (Browser-in-the-Browser) C2 infrastructure. It monitors for connections to known malicious domains, the use of WebSocket upgrades over TLS, and the presence of 'rrweb' (a DOM recording library) in request URIs, which are indicative of browser-in-the-browser phishing C2 traffic.
Page 124 of 202