Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,309 detections
Filters
Last updated
All Time
Detection languages
2,251
27
22
7
2
Contributors
910
584
506
125
48
Categories
20,456
11,839
5,876
5,155
4,865
2,309
Platforms
2,196
209
169
62
61
Products / Services
2,253
2,159
165
32
31
MITRE Techniques
713
422
390
187
184
CVEs
17
12
12
12
10
IDS Classtypes
995
426
281
190
98
IDS Protocols
1,291
401
281
117
45
Detects incoming HTTP GET requests targeting known API endpoints associated with the GhostCode phishing kit. These endpoints (/api/harvester) are used by the phishing kit to poll for session details, device codes, or flow identifiers, characteristic of credential harvesting operations.
Detects DNS queries and TLS SNI traffic directed towards known typosquatted domains associated with the SilkParasite campaign. These domains are designed to impersonate Central Asian government, energy, and telecommunications entities to facilitate malicious activity.
Detects periodic outbound network connections (beaconing) from internal hosts to external networks that exhibit patterns consistent with BabylonRAT malware. This rule monitors for a specific threshold of connection attempts over time, which is characteristic of a C2 heartbeat.
Detects outbound connections to and inbound responses from known command-and-control infrastructure associated with the SpiceRAT malware, as part of the SilkParasite campaign. This rule monitors established TCP traffic on ports 80 and 443.
Detects network activity, including DNS queries and TLS certificate usage, related to the impersonation of the Uzbekistan state railway authority through the domain 'uzrailwaystax.com' and associated SSL/TLS certificates.
Detects outbound network traffic from internal devices interacting with Dahua Easy4IP cloud relay services, specifically identifying device resolution requests, probe actions, and the submission of WSSE authentication headers (UsernameToken and PasswordDigest) to the cloud relay host.
Detects anomalous STUN bind-requests containing 'PTCP' headers directed at the loopback interface, commonly associated with the exploitation of Dahua P2P relay services for traffic redirection or unauthorized access.
Detects network traffic to known Transparent Tribe (APT36) C2 IP addresses and DNS resolution attempts for their associated command and control domains. This rule monitors for communication with identified malicious infrastructure often used by the group for C2 activity.
This rule detects network traffic containing the 'HCENC1' signature prefix within the payload, which is associated with the RUSTYSHADE malware family. This pattern indicates an encrypted communication channel used for command and control (C2) purposes.
This rule detects network traffic containing the 'HCENC1' signature prefix within the payload, which is associated with the RUSTYSHADE malware family. This pattern indicates an encrypted communication channel used for command and control (C2) purposes.
Detects network beaconing activity associated with Transparent Tribe (APT36) Golang-based remote access trojans (RAT). The rule identifies specific HTTP POST requests to suspicious domains and URI paths ('/api/gym-facility', '/api/gym-membership') that mimic legitimate fitness-related traffic to blend in with environment noise.
Detects DNS queries and HTTP GET requests directed at known typosquatted domains associated with the APT36 (Transparent Tribe) threat group, which are utilized for payload staging and delivery.
This rule detects network traffic patterns indicative of the Transparent Tribe threat group using the GitHub API for command-and-control (C2) operations. It specifically identifies HTTP requests to GitHub's content API that attempt to access or exchange files named 'command.txt', 'results.txt', 'heartbeat.txt', or 'screenshot.png', which are known indicators of this actor's C2 communication strategy.
This rule detects suspicious outbound HTTP POST requests to a specific domain ('monitorondomainwintgt') containing known API endpoints ('/api/gym-facility', '/api/gym-membership', '/api/coach-instructions') often used by Golang-based Remote Access Trojans (RATs) for command-and-control communication.
Detects network activity (DNS, TLS SNI, and direct TCP connections) associated with the Transparent Tribe threat group's command-and-control infrastructure, specifically targeting the domain 'sharema128.net' and its associated IP address.
Detects network communication patterns associated with the RUSTYSHADE malware family, which leverages the GitHub REST API for command-and-control (C2) operations. The rule monitors for specific SNI indicators, GitHub API URL patterns for command retrieval, task/result file interactions, exfiltration of files (screenshots/webcam photos), and custom encrypted request body markers.
Detects DNS queries, HTTP requests, and TLS connections associated with known APT36 (Transparent Tribe) malicious infrastructure, specifically targeting typosquatted news domains used for staging payloads.
Detects a host making 3 or more outbound connections within 5 minutes to AWS-hosted IP addresses known to host NJRAT C2 infrastructure from the GTA6 lure campaign, consistent with periodic RAT beaconing rather than a one-off incidental connection.
Detects a host making 3 or more outbound connections within 5 minutes to AWS-hosted IP addresses known to host NJRAT C2 infrastructure from the GTA6 lure campaign, consistent with periodic RAT beaconing rather than a one-off incidental connection.
Detects potential unauthenticated Remote Code Execution (RCE) exploitation attempts targeting the IKEv2/ISAKMP VPN service on WatchGuard Firebox devices (CVE-2025-14733). The rule monitors UDP traffic on standard IKE ports 500 and 4500, looking for specific payload patterns and elevated data sizes consistent with exploitation attempts, coupled with a threshold to reduce noise.
Detects potential unauthenticated Remote Code Execution (RCE) exploitation attempts targeting the IKEv2/ISAKMP VPN service on WatchGuard Firebox devices (CVE-2025-14733). The rule monitors UDP traffic on standard IKE ports 500 and 4500, looking for specific payload patterns and elevated data sizes consistent with exploitation attempts, coupled with a threshold to reduce noise.
Page 59 of 110