Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
565 detections
Filters
Last updated
All Time
Detection languages
464
49
14
12
11
Contributors
217
119
88
54
41
Categories
20,443
11,831
5,875
5,151
4,864
565
Platforms
495
55
21
17
14
Products / Services
468
195
64
23
14
MITRE Techniques
180
93
66
63
60
CVEs
4
4
4
4
3
IDS Classtypes
303
37
23
23
21
IDS Protocols
449
3
Detects web traffic containing indicators of 'ClickFix' social engineering attacks. These attacks present a fake 'CAPTCHA' or verification prompt to the user and instruct them to copy and paste a malicious script (involving PowerShell or mshta) into their system terminal.
Detects HTTP responses containing SocGholish (FakeUpdates) malware delivery signatures. The rule monitors for a 200 HTTP status code, a content type of 'javascript', and the presence of the specific string 'NDSW' in the response body, which is a known indicator of the SocGholish JavaScript-based loader.
Detects HTTP traffic patterns associated with the SocGholish Traffic Distribution System (TDS). The rule identifies an HTTP 302 redirect response where the 'Location' header points to a URL containing 'update' and a .js extension, a characteristic behavioral signature used by SocGholish for its drive-by-download campaigns.
This rule detects network traffic patterns associated with ARToken-style OAuth device code phishing attacks, specifically monitoring for initial backend requests to Cloudflare Workers infrastructure, response payloads containing known phishing template indicators, and subsequent polling activity against device code endpoints that indicate an active phishing session.
Detects HTTP requests and responses involving the download of an executable file named 'ClaudeDesktop.exe' from the 'claude.ai' host, which is indicative of a malicious campaign distributing SectopRAT.
Detects network traffic associated with Adversary-in-the-Middle (AiTM) phishing kits that impersonate Microsoft and Google login pages. The rules identify the presence of specific HTML elements (like Cloudflare Turnstile anti-bot gates) and authentication session cookie headers served from non-authorized/non-official domains, indicating a reverse-proxy phishing attack.
Detects anomalous access patterns to machine learning model inference endpoints, including unauthorized access attempts such as credential failures, scope violations, and quota exhaustion, indicating potential misuse or compromise of private model APIs.
Detects automated API exploitation attempts, specifically Broken Object Level Authorization (BOLA) scanning. The rule triggers when a single source IP or API token exhibits high-frequency request patterns (5+ requests per second) against resource endpoints with sequentially incrementing IDs. It specifically correlates a spike in 401/403 authorization failures followed by a small count of 200 successes, indicating a potential successful bypass of authorization controls.
Detects network activity associated with ORAX Phishing-as-a-Service (PhaaS), specifically identifying fake Cloudflare security-verification pages and emoji-based CAPTCHA gates used as anti-analysis techniques to frustrate automated sandboxing.
This rule detects network traffic patterns associated with the ARToken phishing campaign, specifically identifying access to lure pages hosted on 'workers.dev' domains with 'docviewer' in the hostname and 'turnstile' challenge responses in the HTTP body, which is used for anti-analysis/evasion.
Detects HTTP traffic where a common automated scanner or sandbox user agent triggers an immediate redirect to 'about:blank', a common technique used by phishing kits to hide content from automated security analysis tools.
Detects network indicators associated with the ORAX Phishing-as-a-Service (PhaaS) platform. This includes patterns for emoji-matching CAPTCHAs, spoofed Cloudflare security pages, specific wildcard subdomain DNS queries, and the use of anti-analysis gate sequences to prevent sandbox inspection.
Detects network indicators and session patterns associated with the JWR Phishing Framework, specifically targeting its WebSocket-based command and control (C2) communication, client engine (main.js/ws-worker.js) retrieval, and unique session token (JWRCVV) usage.
Detection of network traffic patterns associated with the NovaCookies Adversary-in-the-Middle (AiTM) phishing kit. The rules monitor for DNS queries for .vu domains, HTTP requests to lookalike Microsoft 365 login pages hosted on .vu domains, POST requests containing credential data, and the receipt of specific session cookies (ESTSAUTH) indicative of successful AiTM session interception.
Detects the delivery of a fake 'slide-to-verify' CAPTCHA page commonly used by Mirage2FA phishing kits. These pages are designed to trick users or automated analysis tools into interacting with the site before the final AiTM (Adversary-in-the-Middle) phishing proxy is served.
Detects attempts to access or execute a file named 'cmd.jar' within the Cisco Firepower Management Center (FMC) or Cisco Security Manager (CSM) environment. This filename is associated with web shell activities used for unauthorized command execution on vulnerable Cisco appliances.
Detects network traffic associated with the Havoc C2 framework Demon agent. The rules identify specific HTTP request headers, response headers, and URI patterns (such as /funny_cat.gif, /test.txt, and /helloworld.js) used by the agent for beaconing and command-and-control communication.
Detects network activity associated with the FlowerStorm/Storm-1167 phishing campaign. The rule monitors for credential exfiltration to a specific malicious URI (e.g., /google.php) containing login parameters, as well as the delivery of spoofed Microsoft sign-in pages from the associated phishing infrastructure.
Detects HTTP GET requests to '/api.php?t=' containing a 13-digit timestamp identifier, followed by a response body containing 'download_link'. This pattern is indicative of the SilverFox malware relaying instructions or stage-two payload delivery.
Detects a multi-stage attack pattern against publicly exposed AI service endpoints. The detection correlates: (1) Enumeration of sensitive AI/MCP-related API endpoints (minimum 3 distinct hits) in a 10-minute window; (2) Subsequent POST requests to AI service endpoints within 15 minutes of the enumeration; and (3) A spike of 5 or more server errors (HTTP 5xx) within 10 minutes following the POST activity. This pattern suggests automated reconnaissance followed by attempted exploitation of exposed AI model interfaces or orchestration services. Covers T1595.002, T1190
Detects the presence of an injected script tag containing 'ganalytics-tracker-js' in HTTP server responses, a pattern commonly associated with 'ClickFix' social engineering attacks where users are tricked into copying and executing malicious commands.
Page 3 of 27