Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
565 detections
Filters
Last updated
All Time
Detection languages
464
49
14
12
11
Contributors
217
119
88
54
41
Categories
20,443
11,831
5,875
5,151
4,864
565
Platforms
495
55
21
17
14
Products / Services
468
195
64
23
14
MITRE Techniques
180
93
66
63
60
CVEs
4
4
4
4
3
IDS Classtypes
303
37
23
23
21
IDS Protocols
449
3
Detects network activity associated with the NovaCookies phishing campaign, specifically identifying HTTP redirects, TLS SNI connections, or HTTP host headers pointing to infrastructure utilizing .vu top-level domains.
This rule detects patterns characteristic of the ClearFake/EtherHiding campaign, specifically identifying the injection of malicious JavaScript within HTTP responses. The rule monitors for the creation of a script element and the use of base64-encoded javascript content, which is a known technique used in these attacks to facilitate drive-by compromises.
This rule detects two components of a malicious campaign using Google Sites to host fake OpenAI Codex installer lures. The first rule detects when a response body from an external server contains an iframe pointing to the domain 'bright-links.com'. The second rule detects client-side requests to Google Sites paths containing 'codex', indicating a user is navigating to the lure page.
This rule detects network traffic patterns associated with the msaRAT remote access trojan (RAT) as it initializes WebRTC communication. It identifies the initial POST request to a token service and the subsequent response containing Twilio TURN and Google STUN relay server configurations, which are used by the malware to establish peer-to-peer tunnels for command-and-control communication.
Detects malicious heartbeat check-ins to a C2 server endpoint '/api/bot/heartbeat' by monitoring for unauthorized exfiltration of hardware identifiers (Host/Device/HW ID) or potential remote task execution via Base64-encoded instructions in the response body, characteristic of ClickFix-related infostealer campaigns targeting macOS users.
Detects an nginx HTTP Server response header containing a version number identified as vulnerable to CVE-2026-42533 (specifically 0.9.6 through 1.30.3, or 1.31.0 through 1.31.2). This rule identifies potentially exposed or unpatched infrastructure that may be susceptible to exploitation.
This rule detects HTTP response bodies containing indicators associated with SourTrade malvertising campaigns, specifically JSON configuration fields and a base64-encoded Windows PE executable header (MZ/TVqQAAMAAAAEAAAA).
Detects the wp2shell unauthenticated SQL injection chain (CVE-2026-63030 / CVE-2026-60137) abusing the REST API batch-route confusion via author_exclude/author__not_in parameters against wp-json/wp/v2/posts or wp-json/batch/v1, where the extraction result reflects the WordPress 6.9 $wp$2y$ bcrypt-over-HMAC-SHA384 hash marker in the request query or response body. Requires both the specific unauthenticated REST SQLi vector AND the hash-format marker to fire, excluding legitimate authenticated admin export/reporting tools that reference wp_users through normal means.
Detects the wp2shell unauthenticated SQL injection chain (CVE-2026-63030 / CVE-2026-60137) abusing the REST API batch-route confusion via author_exclude/author__not_in parameters against wp-json/wp/v2/posts or wp-json/batch/v1, where the extraction result reflects the WordPress 6.9 $wp$2y$ bcrypt-over-HMAC-SHA384 hash marker in the request query or response body. Requires both the specific unauthenticated REST SQLi vector AND the hash-format marker to fire, excluding legitimate authenticated admin export/reporting tools that reference wp_users through normal means.
Detects the presence of specific configuration strings ('design' and 'flow_type') within HTTP response bodies, which are indicative of the Kali365 phishing kit decrypting its configuration at runtime via the browser. This pattern is characteristic of credential harvesting pages.
Detects a multi-stage network activity pattern characteristic of 'SourTrade' cloaking. The rule tracks an initial HTTP request with a referral to a known lookalike crypto/trading domain, followed by the fetching of a client-side JavaScript fingerprinting script, and finally, a subsequent HTTP response that appears to be a near-empty decoy page (used to mask malicious content from crawlers).
Detects the presence of specific configuration strings ('design' and 'flow_type') within HTTP response bodies, which are indicative of the Kali365 phishing kit decrypting its configuration at runtime via the browser. This pattern is characteristic of credential harvesting pages.
Detects HTTP response bodies containing specific combinations of advertising tracking markers (Google gtag, Meta fbq, and Twitter twq) alongside known path indicators like '/config' or 'sw.js', which are characteristic of SourTrade malvertising landing pages.
Detects anomalous server responses for WordPress REST API requests targeting /wp/v2/categories/0 where the error message 'block_cannot_read' is returned instead of the expected 'rest_term_invalid'. This behavior is indicative of attempted exploitation using the wp2shell batch-handler desync vulnerability.
Detects the presence of specific configuration strings ('design' and 'flow_type') within HTTP response bodies, which are indicative of the Kali365 phishing kit decrypting its configuration at runtime via the browser. This pattern is characteristic of credential harvesting pages.
Detects the wp2shell unauthenticated SQL injection chain (CVE-2026-63030 / CVE-2026-60137) abusing the REST API batch-route confusion via author_exclude/author__not_in parameters against wp-json/wp/v2/posts or wp-json/batch/v1, where the extraction result reflects the WordPress 6.9 $wp$2y$ bcrypt-over-HMAC-SHA384 hash marker in the request query or response body. Requires both the specific unauthenticated REST SQLi vector AND the hash-format marker to fire, excluding legitimate authenticated admin export/reporting tools that reference wp_users through normal means.
Detects network activity associated with BlueNoroff ClickFix campaigns, specifically targeting the download of suspicious Windows PE files from typosquatted CDN/payload URIs. The rule uses session tracking to correlate the initial URI request with the subsequent retrieval of executable content.
Detects network traffic containing a characteristic 'Loading in progress...' string, which is associated with the 'Kratos' animated envelope loading screen used in fake Microsoft 365 credential harvesting pages.
This rule detects network activity associated with a phishing campaign impersonating the RENAPO CURP lookup service. It monitors for TLS SNI and HTTP Host headers containing the typosquatted domain 'gobf.mx', as well as HTTP responses containing specific keywords related to the Mexican CURP registration form originating from this domain.
This rule monitors network response bodies for the presence of a specific HTML title indicating an authentication page. This can be used to identify potential entry points for brute force or credential harvesting attacks against exposed authentication interfaces.
Detects the presence of multiple anti-debugging and anti-analysis JavaScript techniques within HTTP response content, commonly used in phishing landing pages to prevent security analysts from inspecting the site's behavior. The rule specifically looks for combinations of event listeners for the context menu, disabling F12 developer tools, debugger timing-loop checks, and automatic 'about:blank' redirects upon pause detection.
Page 11 of 27