Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,309 detections
Filters
Last updated
All Time
Detection languages
2,251
27
22
7
2
Contributors
910
584
506
125
48
Categories
20,456
11,839
5,876
5,155
4,865
2,309
Platforms
2,196
209
169
62
61
Products / Services
2,253
2,159
165
32
31
MITRE Techniques
713
422
390
187
184
CVEs
17
12
12
12
10
IDS Classtypes
995
426
281
190
98
IDS Protocols
1,291
401
281
117
45
Detects network activity associated with the RatHat Android malware, specifically identifying C2 data exfiltration API calls over FRP (FRP/Go Agent) tunnels and WebSocket handshake traffic for command-and-control communication.
Detects HTTP traffic from the Psychedelic Stealer malware as it exfiltrates stolen browser passwords and session tokens to a specific command-and-control endpoint, and identifies the staging of Chromium Web Data files ('wd_tmp.db') within HTTP POST requests.
Detects outbound network traffic to known public BNB Smart Chain (BSC) data seed nodes using JSON-RPC 'eth_call' methods or TLS connections. This pattern is indicative of malware using blockchain infrastructure as a dead drop resolver for C2 command retrieval or configuration updates.
Detects outbound network traffic attempting to connect to known infrastructure associated with the VPN-for-X extension, which has been observed acting as a fallback proxy. The rule alerts on specific TLS SNI strings (de8.staticvaultcdn.org, de4.servefaststatic.work, de34.rapidstaticserve.cc) commonly leveraged by this infrastructure.
This rule detects malicious HTTP POST requests attempting a path traversal attack against Grav CMS, specifically targeting the __unique_form_id__ parameter. The rule looks for directory traversal sequences ('..') following the parameter, which is characteristic of attempts to read sensitive files outside the intended web directory.
Detects established, bidirectional TCP connections between internal hosts and known infrastructure associated with the SIDEEYE backdoor on specific control and data ports (3333 and 3334).
Detects network communication associated with VelvetCake C2 infrastructure, including plaintext authentication, specific inventory request commands, and session termination commands over port 12345.
This rule detects potentially malicious Command and Control (C2) traffic utilizing DNS over HTTPS (DoH) to interact with public resolvers like Cloudflare, Google, and Quad9. It identifies both high-frequency, repeated direct-to-resolver TLS sessions and specific HTTP requests to these resolvers that resolve domains associated with known C2 infrastructure, such as the ClickFix campaign.
This rule detects potentially malicious Command and Control (C2) traffic utilizing DNS over HTTPS (DoH) to interact with public resolvers like Cloudflare, Google, and Quad9. It identifies both high-frequency, repeated direct-to-resolver TLS sessions and specific HTTP requests to these resolvers that resolve domains associated with known C2 infrastructure, such as the ClickFix campaign.
Detects two-stage network activity associated with Adversary-in-the-Middle (AiTM) phishing kits. The first part detects the submission of stolen credentials or session data to a local WebDAV panel (xwps.php), and the second part detects the subsequent exfiltration of that captured data to the Telegram Bot API.
Detects the initiation of a SOCKS5 proxy handshake from an internal host to an external destination. The rule monitors for the characteristic SOCKS5 greeting (0x05) while specifically excluding HTTP traffic to identify potential unauthorized proxy tunneling used for command and control or data exfiltration.
Detects NeedyMantis' initial C2 beacon: an HTTP GET to /library/zip/ on port 443, anchored to the URI root, carrying a client-originated 'Set-Cookie:' header (clients normally send 'Cookie:', never 'Set-Cookie:' -- this direction reversal is the core anomaly and is near-impossible for legitimate traffic) alongside an explicit 'Upgrade: websocket' header. Matching the literal header text (not just header-name presence) and anchoring the URI removes generic WebSocket apps and any unrelated path containing '/library/zip/' as a substring.
Detects NeedyMantis' initial C2 beacon: an HTTP GET to /library/zip/ on port 443, anchored to the URI root, carrying a client-originated 'Set-Cookie:' header (clients normally send 'Cookie:', never 'Set-Cookie:' -- this direction reversal is the core anomaly and is near-impossible for legitimate traffic) alongside an explicit 'Upgrade: websocket' header. Matching the literal header text (not just header-name presence) and anchoring the URI removes generic WebSocket apps and any unrelated path containing '/library/zip/' as a substring.
Detects NeedyMantis' initial C2 beacon: an HTTP GET to /library/zip/ on port 443, anchored to the URI root, carrying a client-originated 'Set-Cookie:' header (clients normally send 'Cookie:', never 'Set-Cookie:' -- this direction reversal is the core anomaly and is near-impossible for legitimate traffic) alongside an explicit 'Upgrade: websocket' header. Matching the literal header text (not just header-name presence) and anchoring the URI removes generic WebSocket apps and any unrelated path containing '/library/zip/' as a substring.
Detects the NeedyMantis main-component handshake: an HTTP GET to port 443 with a User-Agent that is EXACTLY the hard-coded literal 'firefox/21.0' (anchored start+end) and an explicit 'Upgrade: websocket' header, marking the HTTPS-to-WebSocket protocol switch used before the RC4 key exchange. Restricting to port 443 and requiring an exact (not substring) UA match removes generic WebSocket apps and any traffic where 'firefox/21.0' merely appears inside a real, longer browser UA string.
Detects the NeedyMantis main-component handshake: an HTTP GET to port 443 with a User-Agent that is EXACTLY the hard-coded literal 'firefox/21.0' (anchored start+end) and an explicit 'Upgrade: websocket' header, marking the HTTPS-to-WebSocket protocol switch used before the RC4 key exchange. Restricting to port 443 and requiring an exact (not substring) UA match removes generic WebSocket apps and any traffic where 'firefox/21.0' merely appears inside a real, longer browser UA string.
Detects the NeedyMantis main-component handshake: an HTTP GET to port 443 with a User-Agent that is EXACTLY the hard-coded literal 'firefox/21.0' (anchored start+end) and an explicit 'Upgrade: websocket' header, marking the HTTPS-to-WebSocket protocol switch used before the RC4 key exchange. Restricting to port 443 and requiring an exact (not substring) UA match removes generic WebSocket apps and any traffic where 'firefox/21.0' merely appears inside a real, longer browser UA string.
Detects egress to the NeedyMantis C2 domain corp.tripswithengine[.]com across three vantage points: TLS SNI (port 443), DNS resolution, and HTTP Host header. Each content match is anchored to the start of its buffer ('startswith') so a different domain that merely contains 'corp.tripswithengine.com' as a suffix of a longer label (e.g. 'notcorp.tripswithengine.com') cannot match — only this exact domain or a genuine subdomain of it triggers.
Detects egress to the NeedyMantis C2 domain corp.tripswithengine[.]com across three vantage points: TLS SNI (port 443), DNS resolution, and HTTP Host header. Each content match is anchored to the start of its buffer ('startswith') so a different domain that merely contains 'corp.tripswithengine.com' as a suffix of a longer label (e.g. 'notcorp.tripswithengine.com') cannot match — only this exact domain or a genuine subdomain of it triggers.
Detects egress to the NeedyMantis C2 domain corp.tripswithengine[.]com across three vantage points: TLS SNI (port 443), DNS resolution, and HTTP Host header. Each content match is anchored to the start of its buffer ('startswith') so a different domain that merely contains 'corp.tripswithengine.com' as a suffix of a longer label (e.g. 'notcorp.tripswithengine.com') cannot match — only this exact domain or a genuine subdomain of it triggers.
Detects egress to the NeedyMantis C2 domain corp.tripswithengine[.]com across three vantage points: TLS SNI (port 443), DNS resolution, and HTTP Host header. Each content match is anchored to the start of its buffer ('startswith') so a different domain that merely contains 'corp.tripswithengine.com' as a suffix of a longer label (e.g. 'notcorp.tripswithengine.com') cannot match — only this exact domain or a genuine subdomain of it triggers.
Page 20 of 110