Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,309 detections
Filters
Last updated
All Time
Detection languages
2,251
27
22
7
2
Contributors
910
584
506
125
48
Categories
20,456
11,839
5,876
5,155
4,865
2,309
Platforms
2,196
209
169
62
61
Products / Services
2,253
2,159
165
32
31
MITRE Techniques
713
422
390
187
184
CVEs
17
12
12
12
10
IDS Classtypes
995
426
281
190
98
IDS Protocols
1,291
401
281
117
45
Detects unauthorized access attempts to a Docker Registry API on port 5000. The rule identifies attempts to enumerate the image catalog and extract sensitive environment variable information from configuration blobs, which may contain hardcoded credentials or indicators of compromise.
Detects network communication associated with the CARBONATO Hermes Agent, including direct C2 beaconing to a hardcoded IP on port 8989 and TLS connections to Vercel-hosted proxy infrastructure identifying as 'carbonato-proxy'.
This rule detects network traffic originating from internal hosts directed to the Telegram API endpoint 'api.telegram.org' with a URI pattern associated with bot interaction, potentially indicating usage of a Telegram-based Command and Control (C2) mechanism by the CARBONATO/Hermes agent.
Detects network activity associated with the RatHat Android malware, specifically focusing on its use of WebSocket-based FRP (Fast Reverse Proxy) tunnels for command and control, session initialization, configuration retrieval, and local loopback proxy communication.
Detects network activity associated with the NeedyMantis malware, including TLS SNI traffic to its hard-coded C2 domain, initial beaconing over HTTPS to specific paths, and potential exfiltration or reconnaissance markers in the server's Set-Cookie header response.
Detects network activity associated with the NeedyMantis malware, including TLS SNI traffic to its hard-coded C2 domain, initial beaconing over HTTPS to specific paths, and potential exfiltration or reconnaissance markers in the server's Set-Cookie header response.
Detects outbound network traffic associated with the NeedyMantis actor, specifically identifying a hardcoded outdated Firefox/21.0 User-Agent in HTTP requests attempting to upgrade to a WebSocket connection, as well as direct TLS communication with the identified C2 domain corp.tripswithengine.com.
Detects HTTP traffic patterns associated with a custom 'RatHat' malware variant utilizing Google's Gemini API for command and control or remote automation. The rule identifies the initial POST request to the API with specific generation parameters (temperature 0.1, 256 tokens) and the corresponding JSON-formatted coordinate response from the server.
Detects HTTP traffic patterns associated with the VelvetCake malware used by North Korean threat actors Konni and Kimsuky. These signatures identify beaconing behavior to known free-hosting infrastructure, specifically monitoring for unique URL parameters ('OKey=', 'Who=', 'Areyou=cake') and common file naming conventions associated with the C2 communication.
Detects an attempt to bypass SharePoint authentication using a 'Register' directive in a POST request body directed at an .aspx page that is not a recognized ToolPane page. This pattern is indicative of an exploit attempt against a public-facing SharePoint server, specifically targeting vulnerability CVE-2026-65660.
Detects network communication to 'imageurlgenerator.com' where a VBScript downloader is attempting to retrieve a staged payload. The request pattern targets specific URI structures resembling GUID-based identifiers ending in '.txt', which is characteristic of the XHOPLESS malware delivery chain.
Detects outbound network traffic (TLS SNI and HTTP requests) directed to the Telegram Bot API endpoint. This behavior is often associated with malware using Telegram as a command-and-control (C2) channel or for the exfiltration of stolen data, credentials, or sensitive information.
Detects HTTP requests containing potential session, handoff, or access tokens within the URI pattern commonly associated with ORAX Adversary-in-the-Middle (AiTM) phishing infrastructure. The rule specifically targets requests routed to wildcard subdomains that mimic legitimate deployment or service endpoints, indicating an attempt to harvest authentication tokens from victims.
Detects network activity associated with a phishing campaign leveraging Cloudflare Workers, identified as 'ARToken'. The rules monitor for specific TLS SNI patterns, HTTP Host headers, and subsequent C2-like behavior involving device code authentication flows (api/device/start and api/device/poll) hosted on 'workers.dev'.
This rule detects interaction between an internal host and the Vapi.ai API, typically used for automating AI-based voice phishing (vishing) calls. It identifies the initiation of a call via POST requests to the Vapi.ai API and subsequent callbacks from Vapi.ai to an attacker-controlled webhook endpoint used for tracking call status.
This rule set detects network communication patterns associated with the AnonyMousKIT phishing kit, specifically targeting the exfiltration of captured user credentials to the Telegram Bot API and communication with known phishing panel infrastructure. It monitors for DNS lookups of 'anomkit.shop', established TCP connections to the associated backend relay, and HTTP requests containing specific credential-related keywords directed towards the Telegram API.
This rule detects network connections (TLS SNI and HTTP requests) to domains associated with the AnonyMousKIT PhaaS (Phishing-as-a-Service) platform. It flags connections to known phishing backend domains and monitors for access to suspicious management dashboard paths commonly utilized by this threat actor for managing phishing orders and communications.
Detects network activity associated with the JWR Phishing Framework, specifically focusing on the initiation of a WebSocket upgrade request following the delivery of a checkout-themed page load containing a 'cart_data' parameter, which is characteristic of the framework's C2 communication flow.
Detects network traffic consistent with the XMRig cryptocurrency mining tool communicating with a Monero mining pool via TLS. The rule identifies specific SNI domains and direct connection attempts to known proxy IP addresses associated with cryptomining activities.
Detects network beaconing and command-and-control (C2) communication patterns associated with the RatHat Android malware family. The rule identifies registration, shell command check-ins, heartbeat signals, and task fetching activity over HTTP. It uses stateful inspection (flowbits) to correlate device registration with subsequent heartbeat behavior to improve detection fidelity.
Detects HTTP responses containing script content indicative of anti-analysis or anti-debugging techniques, such as timing checks, debugger detection, and proof-of-work challenges commonly used on adversary-in-the-middle (AiTM) phishing landing pages.
Page 28 of 110