Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,309 detections
Filters
Last updated
All Time
Detection languages
2,251
27
22
7
2
Contributors
910
584
506
125
48
Categories
20,456
11,839
5,876
5,155
4,865
2,309
Platforms
2,196
209
169
62
61
Products / Services
2,253
2,159
165
32
31
MITRE Techniques
713
422
390
187
184
CVEs
17
12
12
12
10
IDS Classtypes
995
426
281
190
98
IDS Protocols
1,291
401
281
117
45
This rule monitors TLS traffic for a specific combination of certificate issuer Common Name (CN) matching 'YE1' and Server Name Indication (SNI) hostnames using known disposable or high-risk top-level domains (TLDs). This behavior is associated with the IronToll campaign, often indicative of command-and-control communication or malicious infrastructure staging.
Detects high-frequency POST requests to the JFrog Artifactory '/access/api/v1/tokens' endpoint, which is indicative of mass exploitation attempts targeting vulnerabilities (CVE-2026-82329) against administrative token management.
Detects high-frequency POST requests to the JFrog Artifactory '/access/api/v1/tokens' endpoint, which is indicative of mass exploitation attempts targeting vulnerabilities (CVE-2026-82329) against administrative token management.
Detects DNS A record lookups for the domain 'mail.uaiubifas.top', which is associated with GRAYRABBIT C2 activity linked to UNC3569. This domain is known to be used for command and control communications.
Detects DNS A record lookups for the domain 'mail.uaiubifas.top', which is associated with GRAYRABBIT C2 activity linked to UNC3569. This domain is known to be used for command and control communications.
Detects DNS A record lookups for the domain 'mail.uaiubifas.top', which is associated with GRAYRABBIT C2 activity linked to UNC3569. This domain is known to be used for command and control communications.
Detects network activity (HTTP, TLS SNI, and DNS) associated with the domain 'noht1ng.top', which is linked to the GRAYRABBIT malware utilized by the threat actor UNC3569.
Detects DNS queries originating from an internal host to 'mail.uaiubifas.top', which is associated with GRAYRABBIT command-and-control (C2) activity.
Detects DNS queries originating from an internal host to 'mail.uaiubifas.top', which is associated with GRAYRABBIT command-and-control (C2) activity.
Detects rapid ICMP (ping) traffic directed towards specific internal and external hosts, characteristic of the RedTail Linux malware attempting to perform network discovery or validate connectivity to command-and-control infrastructure.
Detects established outbound network connections on TCP port 853 (DNS-over-TLS) to known C2 infrastructure associated with the RedTail malware. The rule monitors for both connection attempts to anomalous resolvers and specific TLS handshake patterns characteristic of RedTail C2 activity.
Detects established outbound network connections on TCP port 853 (DNS-over-TLS) to known C2 infrastructure associated with the RedTail malware. The rule monitors for both connection attempts to anomalous resolvers and specific TLS handshake patterns characteristic of RedTail C2 activity.
Detects an HTTP POST request targeting the host 'tt.yeyoujs.com' at the URI path '/api/agent/enroll', containing a specific Python aiohttp User-Agent string. This pattern is characteristic of a C2 agent attempting to register or enroll with an external command-and-control server.
This rule detects inbound HTTP GET requests to a specific IP address (103.86.86.244) requesting a file named 'deploy.ps1'. This behavior is characteristic of adversaries using PowerShell one-liners (cradles) like 'irm' (Invoke-RestMethod) or 'iex' (Invoke-Expression) to fetch and execute malicious scripts directly from a remote C2 infrastructure.
This rule detects inbound HTTP GET requests to a specific IP address (103.86.86.244) requesting a file named 'deploy.ps1'. This behavior is characteristic of adversaries using PowerShell one-liners (cradles) like 'irm' (Invoke-RestMethod) or 'iex' (Invoke-Expression) to fetch and execute malicious scripts directly from a remote C2 infrastructure.
Detects an HTTP GET request to 'dl.php' containing an 'f' parameter (target file) and an 'k' parameter (access token), followed by a response body starting with the 'MZ' header, indicating the successful download of a Windows PE executable as part of a potential phishing campaign stage-2 payload delivery.
Detects sustained beaconing behavior originating from the internal network to known malicious HVNC (Hidden Virtual Network Computing) C2 infrastructure. The rule identifies repeated connection attempts (5 or more TCP SYNs within a 180-second window) targeting specific hardcoded IP addresses on non-standard ports (27015/27017), indicative of a compromised host maintaining persistent C2 communication.
Detects high-frequency TCP/445 connection attempts (a 'connect sweep') characteristic of automated SMB share enumeration, which is commonly used for lateral movement reconnaissance. The rule triggers when a threshold of 40 connection requests occurs from a single source within a 30-second window, specifically targeting SMB-related lateral movement behaviors.
Detects high-frequency SYN scanning activity targeting TCP port 37777 (commonly associated with Dahua devices) from an external source. This behavior is indicative of automated reconnaissance or mass-scanning campaigns, such as Operation CameraSwarm, attempting to identify exposed or potentially vulnerable IoT/surveillance hardware.
Detects specific outbound HTTP POST requests to a known Amatera Stealer command and control domain. The rule looks for the unique URI path '/T.@w' and a specific 'Command: GetEndpoints' header structure commonly used by this malware family to beacon to its C2 infrastructure.
Detects specific outbound HTTP POST requests to a known Amatera Stealer command and control domain. The rule looks for the unique URI path '/T.@w' and a specific 'Command: GetEndpoints' header structure commonly used by this malware family to beacon to its C2 infrastructure.
Page 75 of 110