Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,309 detections
Filters
Last updated
All Time
Detection languages
2,251
27
22
7
2
Contributors
910
584
506
125
48
Categories
20,456
11,839
5,876
5,155
4,865
2,309
Platforms
2,196
209
169
62
61
Products / Services
2,253
2,159
165
32
31
MITRE Techniques
713
422
390
187
184
CVEs
17
12
12
12
10
IDS Classtypes
995
426
281
190
98
IDS Protocols
1,291
401
281
117
45
Detects outbound network traffic from internal hosts to known PIVOTPIPE-associated infrastructure, including attempts to access open directories for payload distribution and suspected Cobalt Strike command-and-control communications.
Detects network traffic consistent with PIVOTPIPE command-and-control activity and potential Cobalt Strike beaconing to known malicious infrastructure on specific ports.
Detects network traffic associated with PIVOTPIPE Cobalt Strike beacon activity communicating with a known suspicious external IP address on port 8088. This includes generic TCP, HTTP-based beaconing, and TLS-encrypted C2 sessions.
Detects outbound network traffic directed to Bitbucket (via TLS/443) or using the git protocol (via port 9418). Such connections from internal systems to unverified or unauthorized external Git repositories may indicate malicious activity, including the potential installation of malicious plugins or code via supply chain compromises (e.g., Plugin4Shell).
This rule detects HTTP POST requests to Vercel-hosted domains containing suspected phishing telemetry (such as device fingerprinting, keystrokes, and user agent collection) originated from a Google Sites frame. This is a common pattern for phishing kits masquerading as legitimate Ledger service pages to harvest credentials and hardware information.
This rule detects HTTP POST requests to Vercel-hosted domains containing suspected phishing telemetry (such as device fingerprinting, keystrokes, and user agent collection) originated from a Google Sites frame. This is a common pattern for phishing kits masquerading as legitimate Ledger service pages to harvest credentials and hardware information.
This rule detects HTTP POST requests to Vercel-hosted domains containing suspected phishing telemetry (such as device fingerprinting, keystrokes, and user agent collection) originated from a Google Sites frame. This is a common pattern for phishing kits masquerading as legitimate Ledger service pages to harvest credentials and hardware information.
This rule detects HTTP traffic where a response from a Google Cloud Storage bucket (storage.googleapis.com) initiates a redirect via meta-refresh or JavaScript to a Vercel-hosted domain. This pattern is indicative of phishing infrastructure, where attackers leverage legitimate, trusted storage platforms to redirect users to malicious landing pages.
This rule detects HTTP traffic where a response from a Google Cloud Storage bucket (storage.googleapis.com) initiates a redirect via meta-refresh or JavaScript to a Vercel-hosted domain. This pattern is indicative of phishing infrastructure, where attackers leverage legitimate, trusted storage platforms to redirect users to malicious landing pages.
This rule detects HTTP traffic where a response from a Google Cloud Storage bucket (storage.googleapis.com) initiates a redirect via meta-refresh or JavaScript to a Vercel-hosted domain. This pattern is indicative of phishing infrastructure, where attackers leverage legitimate, trusted storage platforms to redirect users to malicious landing pages.
This rule detects HTTP traffic where a response from a Google Cloud Storage bucket (storage.googleapis.com) initiates a redirect via meta-refresh or JavaScript to a Vercel-hosted domain. This pattern is indicative of phishing infrastructure, where attackers leverage legitimate, trusted storage platforms to redirect users to malicious landing pages.
Detects outbound HTTP requests to the Telegram Bot API associated with the malicious 'indexed-btree' npm package. The rule specifically monitors for hardcoded Telegram bot tokens and chat IDs used for data exfiltration.
This rule detects HTTP GET requests to a specific GitHub repository path (raw.githubusercontent.com/omskiwdcvoiuyfd0998/) identified as staging infrastructure associated with Konni/VelvetCake malware operations. This activity is indicative of a compromised host attempting to download malicious payloads or stage tools from actor-controlled infrastructure.
Detects specific command-and-control (C2) communication patterns associated with the VelvetCake malware. The rules identify initial authentication with a hardcoded password string, module enumeration requests, and session termination signals transmitted over TCP.
Detection of network traffic associated with VelvetCake (Konni) malware, identifying communication with known hardcoded C2 infrastructure, domain lookups, and exfiltration attempts via HTTP/TLS and raw TCP protocols.
Detection of network traffic associated with VelvetCake (Konni) malware, identifying communication with known hardcoded C2 infrastructure, domain lookups, and exfiltration attempts via HTTP/TLS and raw TCP protocols.
Detects network activity (TCP, DNS, TLS, HTTP) associated with the UNC6240 threat actor's infrastructure, specifically targeting communications with known malicious IP addresses and domains used in a campaign leveraging PeopleSoft-related lures.
Detects network activity (TCP, DNS, TLS, HTTP) associated with the UNC6240 threat actor's infrastructure, specifically targeting communications with known malicious IP addresses and domains used in a campaign leveraging PeopleSoft-related lures.
Detects established, bidirectional TCP connections between internal hosts and known infrastructure associated with the SIDEEYE backdoor on specific control and data ports (3333 and 3334).
Detects established, bidirectional TCP connections between internal hosts and known infrastructure associated with the SIDEEYE backdoor on specific control and data ports (3333 and 3334).
Detects unauthorized outbound HTTP requests to the Telegram Bot API (api.telegram.org) utilizing hardcoded credentials, specific chat IDs, or standard Bot API communication patterns (sendMessage/sendDocument) which are often used by malware for data exfiltration and command-and-control communication.
Page 36 of 110