Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,309 detections
Filters
Last updated
All Time
Detection languages
2,251
27
22
7
2
Contributors
910
584
506
125
48
Categories
20,456
11,839
5,876
5,155
4,865
2,309
Platforms
2,196
209
169
62
61
Products / Services
2,253
2,159
165
32
31
MITRE Techniques
713
422
390
187
184
CVEs
17
12
12
12
10
IDS Classtypes
995
426
281
190
98
IDS Protocols
1,291
401
281
117
45
Detects HTTP GET requests to external services 'trycloudflare.com' or 'workers.dev' that return a file content starting with the 'MZ' and 'PE' header signatures within the first 256 bytes, indicating a Windows executable payload download often associated with AvisLoader activity.
Detects HTTP GET requests to external services 'trycloudflare.com' or 'workers.dev' that return a file content starting with the 'MZ' and 'PE' header signatures within the first 256 bytes, indicating a Windows executable payload download often associated with AvisLoader activity.
Detects HTTP GET requests to external services 'trycloudflare.com' or 'workers.dev' that return a file content starting with the 'MZ' and 'PE' header signatures within the first 256 bytes, indicating a Windows executable payload download often associated with AvisLoader activity.
Detects a sequence of Tox P2P protocol packets consisting of a Cookie Request, Cookie Response, and Crypto Handshake within a single network flow. This pattern is indicative of the Tox P2P protocol, which is sometimes abused by malware (e.g., AvisLoader) for command-and-control (C2) communications to evade traditional network inspection.
Detects unauthenticated or unauthorized access attempts to critical Oracle PeopleSoft PeopleTools endpoints (such as PSIGW, PSC, or PORTAL). These detections trigger when suspicious requests are made to these sensitive paths without expected authentication headers or session tokens, potentially indicating an exploitation attempt as described in CVE-2026-35273.
Detects HTTP PUT requests that follow a specific pattern associated with MacSync Stealer's exfiltration mechanism. The rule identifies multipart data transmission by looking for specific URI parameters ('upload_id', 'chunk_index', 'total_chunks') used to piece together stolen ZIP files over an established HTTP connection.
Detects an unauthenticated remote code execution (RCE) attempt against Langflow via the /api/v1/validate/code endpoint. The rule monitors for POST requests containing code execution patterns such as eval, exec, os.system, or subprocess, indicating an attacker attempting to leverage the vulnerability to execute arbitrary commands.
This rule monitors for network traffic directed to 'gitnow.dev' using TLS SNI or HTTP headers consistent with WebSocket upgrades. This domain is associated with 'ClickFix' social engineering campaigns where attackers instruct users to copy and paste malicious code into a terminal to establish a reverse-tunnel C2 connection.
Detects HTTP traffic originating from curl user agents attempting to communicate with known MacSync Stealer command-and-control URI patterns, specifically targeting GET check-in requests and POST payload exfiltration requests.
Detects anomalous DNS queries with high-entropy or encoded labels that exceed 40 characters in size, potentially indicating DNS tunneling used for Command and Control (C2) communication.
Detects a specific 4-byte handshake pattern ("\x11\x22\x33\x44") within the initial data of a TCP stream, identifying the C2 communication handshake of the SparroWocky backdoor associated with the FamousSparrow threat actor.
Detects network activity associated with NetSupport Manager remote access software, specifically targeting DNS lookups, TLS SNI connections, and direct TCP beaconing to a known-malicious infrastructure IP. This rule is designed to identify unauthorized use of legitimate remote support tools for command and control purposes.
This rule detects network traffic indicative of the SCKIT MemTensor worm establishing a command-and-control (C2) beacon. The detection identifies TLS connections where the Server Name Indication (SNI) matches a specific pattern of a 12-character hexadecimal string followed by .skyleen.fr.
Detects network activity associated with the GHAPPIER implant beaconing to a hardcoded command and control (C2) server. The rule monitors for established TCP connections on port 15152 that contain specific JSON status indicators and the string 'ghappier' in the payload, which are characteristic of this malware's communication protocol.
Detects outbound HTTP GET requests containing a .ps1 file extension in the URI, originating from a host without a specified User-Agent, and targeting domains other than Microsoft or Windows Update. This pattern is characteristic of a persistence mechanism executing a PowerShell script to download a secondary payload (e.g., via Net.WebClient).
Detects repeated TLS connections to a known suspicious IP address that masquerades as gitlab.com using the TLS Server Name Indication (SNI) extension. This pattern is indicative of potential command and control (C2) traffic from compromised or unauthorized GitRunner infrastructure.
Detects HTTP and TLS traffic patterns indicative of data exfiltration to Slack, specifically targeting hardcoded Slack API tokens, Slack channel IDs in HTTP request bodies, or traffic directed to hooks.slack.com, commonly associated with malicious npm packages.
Detects network traffic from internal hosts interacting with Ethereum Sepolia testnet contracts via common blockchain infrastructure providers (Alchemy, Infura) or JSON-RPC calls. These patterns are characteristic of 'indexed-btree' malware utilizing decentralized blockchain technology for command-and-control polling.
Detects outbound network connections (HTTP/TLS) from internal hosts to a known malicious IP address associated with Adversary-in-the-Middle (AiTM) phishing infrastructure, specifically targeting Microsoft 365 credential and session cookie theft.
Detects outbound network connections (HTTP/TLS) from internal hosts to a known malicious IP address associated with Adversary-in-the-Middle (AiTM) phishing infrastructure, specifically targeting Microsoft 365 credential and session cookie theft.
Detects network traffic exhibiting beaconing patterns to 'dl.google.com' that may be indicative of Xray-core C2 tunneling disguised as legitimate Google traffic. The rule uses a threshold to identify consistent connection attempts.
Page 32 of 110