Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,309 detections
Filters
Last updated
All Time
Detection languages
2,251
27
22
7
2
Contributors
910
584
506
125
48
Categories
20,456
11,839
5,876
5,155
4,865
2,309
Platforms
2,196
209
169
62
61
Products / Services
2,253
2,159
165
32
31
MITRE Techniques
713
422
390
187
184
CVEs
17
12
12
12
10
IDS Classtypes
995
426
281
190
98
IDS Protocols
1,291
401
281
117
45
Detects network activity associated with the JWR Phishing-as-a-Service (PhaaS) platform. This includes the retrieval of the client-side JavaScript engine (main.js) from lookalike domains related to courier or government services, and subsequent client-side detection of the 'window.__HOST_MODE' flag, which indicates the browser has been primed for a specific phishing scenario.
These rules detect behavioral patterns associated with GhostCode-style anti-analysis, including URI-based gate redirection (turnstile checks), automated client filtering (User-Agent scanning), and UI-based spoofing (tab title masquerading) often used to protect malicious infrastructure from automated analysis tools and bots.
Detects HTTP GET requests to a specific path structure /scanna/ which includes a token-like identifier and a check=1 parameter. This pattern is indicative of a bot-filtering relay mechanism often used by malicious scripts or malware to validate or redirect traffic while attempting to evade security scanners.
Detects network activity associated with the 'RatHat' Android malware, specifically identifying attempts to retrieve tunnel configuration, deployment confirmation, and the initial reverse tunnel handshake using the fatedier/frp (Fast Reverse Proxy) tool.
This rule detects network activity associated with the NovaCookies Adversary-in-the-Middle (AiTM) phishing framework, specifically looking for traffic to domains with a .vu TLD, matching a specific URI pattern used for phishing lures in HTTP requests/responses, and related DNS queries.
This rule detects anomalous OAuth authorization requests to Microsoft and Google services where the 'redirect_uri' parameter points to suspicious external domains (specifically ending in .vu) or, in the case of silent Microsoft OAuth requests, points to domains outside of recognized Microsoft/Office 365 infrastructure. Such abuse is often indicative of OAuth consent phishing campaigns designed to steal application access tokens.
Detects network traffic associated with Mirage2FA Phishing-as-a-Service (PhaaS), including HTTP requests to specific URI patterns characteristic of their backend loader and DNS queries to known malicious domain families (cheecker.store and volatilesour.store), as well as direct TCP connections to identified hosting infrastructure.
This rule detects potential Adversary-in-the-Middle (AiTM) phishing kit exfiltration behavior. It correlates the initial victim geolocation lookup via 'api.ipgeolocation.io' with subsequent data exfiltration to the Telegram Bot API ('api.telegram.org') originating from the same host, indicating an automated sequence where victim context is gathered and then exfiltrated by the phishing kit.
This rule detects a two-stage network redirect sequence indicative of an Adversary-in-the-Middle (AiTM) phishing campaign. The first stage identifies traffic interacting with a Google Ads click-tracker, and the second stage identifies a subsequent request to an AWS S3 bucket, often used to host malicious landing pages or phishing proxies.
This rule set detects multi-stage network patterns indicative of AiTM phishing campaigns. It identifies common redirection techniques, including lookalike domains hosting Microsoft OAuth authorize URLs, DNS resolution of Google ad-tech infrastructure followed by novel domains, malicious use of Google Meet and Google Ads click-tracking endpoints as phishing hops, and references to AWS S3-hosted intermediate landing pages.
Detects network activity associated with Adversary-in-the-Middle (AiTM) phishing kits. This includes detection of kit-specific fingerprinting scripts (class_identifier.php), use of specific server banners (openresty), unauthenticated geolocation lookups (api.country.is), setting of geolocation cookies, and proxying of requests to Microsoft OAuth endpoints.
Detects communication patterns associated with the OnyxC2 malware, including host-fingerprint synchronization over HTTP, potential reverse SOCKS5 proxy tunnel initialization, and inbound HTTP responses containing command tasking such as cmd.exe.
Detects high-frequency, unauthenticated Redis PING/AUTH attempts indicative of a reconnaissance scan against the Redis service. This activity typically represents an adversary performing mass fingerprinting or attempting to identify unsecured Redis instances.
Detects attempts to execute arbitrary JavaScript code on a MongoDB server using the deprecated eval command or patterns consistent with sandbox escape techniques (probing for process, load, and require functions).
Detects attempts to bypass the Redis Lua scripting environment sandbox by injecting 'require' and 'dofile' commands within an 'EVAL' request. These commands are typically used to load external modules or files, which, if successful, could allow an attacker to achieve arbitrary code execution on the server hosting the Redis instance.
Detects unauthorized attempts to access the Marimo Notebook terminal via a WebSocket connection, indicative of an exploit attempt targeting CVE-2026-39987.
Detects a multi-stage phishing redirect chain used in 'EvilTokens' attacks. The rule identifies communication with common serverless hosting platforms (Vercel, Cloudflare Workers, AWS Lambda/Execute-API) followed by interaction with anti-bot/CAPTCHA gates (Cloudflare Turnstile, hCaptcha, Google reCAPTCHA) and finally reaching known Microsoft device code phishing endpoints (/devicelogin or /common/oauth2/deviceauth).
Detects outbound network traffic from internal hosts to a known Cobalt Strike-compatible C2 server at 45.32.253.166 on port 8088. This activity is indicative of a compromised host establishing a command-and-control connection.
Detects internal SMB traffic indicative of P2P beaconing using the IPC$ named pipe, which is often a sign of lateral movement or command-and-control communication between compromised hosts.
Detects outbound HTTP requests where the user-agent starts with 'PHP/' and the URI contains the path for the Admin Menu Editor Pro plugin, suggesting communication between a trojanized WordPress plugin and a remote command-and-control server.
Detects HTTP responses containing a file named 'ClaudeDesktop.exe' served from paths containing '/artifacts/' on the 'claude.ai' host where the request referrer is not 'claude.ai' or 'anthropic.com', suggesting a malvertising or supply chain delivery attempt of a malicious installer.
Page 41 of 110