Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,230 detections
Filters
Last updated
All Time
Detection languages
2,175
1,018
354
260
212
Contributors
1,013
818
688
574
212
Categories
20,456
11,839
5,876
5,155
4,865
4,230
Platforms
2,933
889
585
248
198
Products / Services
2,239
1,453
841
416
344
MITRE Techniques
1,164
1,087
870
798
439
CVEs
22
20
20
18
17
IDS Classtypes
927
408
222
146
104
IDS Protocols
1,914
105
70
47
6
Detects network connections to Bunny CDN infrastructure that contain common URL path indicators associated with phishing, a technique observed in activity attributed to UNC1151 (Ghostwriter).
Detects a browser session requesting a device code and repeatedly polling the token endpoint while the victim completes authentication elsewhere. This behavior is indicative of an adversary using a device code phishing technique, often associated with the Tycoon threat actor.
Detects network communication behavior consistent with the TinyRCT backdoor. The rule identifies instances where a process named 'PerfWatson2.exe' attempts to establish HTTP GET or POST connections to a known malicious IP address (45.32.113.172), signaling potential C2 beaconing activity using an encrypted channel.
Detects requests to the PeopleSoft listening connector containing loopback, link-local, or private network targets in the URL or captured request fields. This indicates a potential Server-Side Request Forgery (SSRF) attempt.
Detects Content Security Policy (CSP) violation reports or network traffic containing references to 'netdna-ssl.com' or 'netdna-cdn.com'. These hostnames are legacy CDN domains that have been re-registered, presenting a significant supply chain risk where malicious content could be injected into web applications loading resources from these domains.
Detects unauthenticated GET requests to the vulnerable ServiceNow REST API endpoint '/api/now/related_list_edit/create' which was exploited in early June 2026. The detection monitors for requests originating from anonymous or guest users, lacking authorization headers, and returning successful (200) responses.
This rule detects outgoing network connections from the IIS worker process (w3wp.exe) to public-facing URLs that match common Microsoft Office WOPI (Web Application Open Platform Interface) request patterns, but are directed to domains other than trusted Microsoft-affiliated infrastructure. This behavior can be indicative of a Server-Side Request Forgery (SSRF) attempt, where an attacker tries to coerce the server into making unauthorized requests to external resources.
This rule detects suspicious WebSocket upgrade attempts targeted at Microsoft authentication endpoints, typically used by 'Bluekit' or similar Phishing-as-a-Service (PhaaS) platforms to establish a persistent connection or tunnel for credential harvesting via adversary-in-the-middle attacks. It flags traffic from non-private IP addresses that exhibit specific patterns associated with proxy usage or automated tooling (e.g., Python/curl) combined with WebSocket upgrade headers.
Detects potential browser fingerprinting and network reconnaissance behavior associated with Bluekit BitM PhaaS campaigns. The rule correlates large suspicious JavaScript file downloads (excluding common CDNs) with STUN server connectivity within a 10-minute window, a pattern often used by adversary-in-the-middle (AiTM) frameworks to fingerprint victims and establish WebRTC channels.
This rule detects suspicious WebSocket upgrade attempts targeted at Microsoft authentication endpoints, typically used by 'Bluekit' or similar Phishing-as-a-Service (PhaaS) platforms to establish a persistent connection or tunnel for credential harvesting via adversary-in-the-middle attacks. It flags traffic from non-private IP addresses that exhibit specific patterns associated with proxy usage or automated tooling (e.g., Python/curl) combined with WebSocket upgrade headers.
This rule detects Content Security Policy (CSP) violations related to 'netdna-ssl.com' or 'wpengine.netdna-ssl.com' domains. Specifically, it looks for violations where the blocked URI contains 'netdna-ssl.com' or the violated directive is 'script-src', 'font-src', or 'connect-src'. This could indicate attempts to inject malicious content or bypass CSP protections.
This rule monitors the creation of new Azure Function Apps and identifies those that receive external, non-private network requests within 48 hours of their creation. This pattern may indicate the deployment of malicious or unauthorized serverless infrastructure for command-and-control, proxying, or automated tasks.
This rule monitors Cisco Unified Communications Manager (UCM) environments for multiple stages of an attack chain, including potential Server-Side Request Forgery (SSRF) attempts against administrative interfaces, suspicious file modifications by service accounts, indicators of privilege escalation, and anomalous outbound network connections from core Cisco processes.
This rule detects communication patterns indicative of the ErrTraffic webshell by searching for specific parameters ('wp_debug_session=' and 'mode=php') within web server URI/URL fields. The presence of these parameters suggests an active webshell connection, likely used for remote access and command execution on a compromised web server.
This rule detects a specific typosquatting pattern used by the EvilTokens phishing kit. It looks for HTTP traffic where the host contains 'workers.dev' and matches a regular expression for 'viewdoc[a-z0-9\-]+\.workers\.dev'. This indicates an attempt to mimic legitimate Cloudflare Workers domains for phishing purposes, specifically targeting the 'viewdoc' pattern often seen in document-sharing lures.
This rule detects network activity associated with the Hashtopolis agent. Specifically, it looks for the string "hashtopolis" within the HTTP User-Agent header of traffic flowing from a client to a server. This activity is linked to the 'FortiBleed campaign', which involves distributed offline cracking of SHA-256 FortiGate administrator credential hashes.
Detects a browser session that contacts an EvilTokens Device Code phishing endpoint (/api/device/status/) and then immediately navigates to onedrive.live.com, indicating the attacker backend returned status:completed and the kit executed window.location.replace to redirect the victim to OneDrive after token capture. This sequence suggests a successful device code phishing attack where the victim's credentials or tokens have been captured, and they are then redirected to a legitimate service to avoid suspicion.
Detects HTTP network connections to the specific URI path and parameters used by the OnyxC2 stealer for C2 beaconing and data exfiltration.
This rule detects JavaScript code within web traffic (proxy, web, or sandbox logs) that indicates attempts to block developer tools, prevent debugging, or detect automation drivers. Specifically, it looks for keywords and patterns associated with context-menu blocking, debugger statements, checks for browser window dimensions (often used to detect minimized or non-interactive browser windows), and the presence of automation-related strings like 'navigator.webdriver', 'selenium', or 'playwright'. This behavior is often observed in adversary-in-the-middle (AitM) phishing pages, such as those used by the Tycoon threat group, to hinder analysis and prevent automated detection.
Detects web traffic where a user initiates a request for content related to 'policy', 'conduct', 'compliance', or 'handbook', experiences at least three redirects across different hosts, and ultimately lands on a page containing keywords indicative of a login, sign-in, OAuth, or authorization prompt. This pattern is often used in multi-stage phishing campaigns to obscure the malicious infrastructure.
Detects a two-stage credential page that receives an email address and then requests tenant branding or a password form during the same browser session. This behavior is indicative of advanced phishing attacks that attempt to mimic legitimate login flows.
Page 134 of 202