Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,309 detections
Filters
Last updated
All Time
Detection languages
2,251
27
22
7
2
Contributors
910
584
506
125
48
Categories
20,453
11,837
5,876
5,154
4,865
2,309
Platforms
2,196
209
169
62
61
Products / Services
2,253
2,159
165
32
31
MITRE Techniques
713
422
390
187
184
CVEs
17
12
12
12
10
IDS Classtypes
995
426
281
190
98
IDS Protocols
1,291
401
281
117
45
Detects anomalous, high-frequency inbound TCP connection attempts to port 102 (S7comm), which is used by Siemens S7 PLCs. This behavior is indicative of automated network scanning or reconnaissance targeting industrial control system (ICS) infrastructure.
This rule detects command and control (C2) communication patterns utilized by the GoCaracal malware family, specifically its fallback mechanism which leverages Ethereum blockchain RPC calls (eth_getStorageAt) to interact with known malicious smart contracts or wallet addresses.
Detects incoming S7comm/ISO-TSAP connection attempts directed at Siemens Programmable Logic Controllers (PLCs) originating from an external network. This behavior is indicative of unauthorized access or reconnaissance attempts against Industrial Control System (ICS) assets.
Detects network activity (DNS queries, TLS SNI, and HTTP Host headers) directed towards domains ending in the .vu Top-Level Domain (TLD). This is associated with NovaCookies phishing infrastructure which utilizes these TLDs for malicious redirection or staging.
Detects anomalous OAuth redirection chains initiated from login.microsoftonline.com or accounts.google.com that target infrastructure identified as malicious .vu domains. This pattern is indicative of a consent-phishing campaign attempting to redirect users to malicious infrastructure.
Detects periodic outbound TLS connections over port 443 exhibiting beaconing behavior (5+ established connections with a non-empty SNI from a source host within 300 seconds), consistent with BridgeAgent malware C2 heartbeat/reverse-shell maintenance. Correlate with EDR detections of a process masquerading as /usr/bin/gnome-shell running as root and persisted via a fraudulent zabbix_agent.service.
This rule monitors for HTTP traffic directed at .vu TLD domains, which contain the specific Cloudflare 'Just a moment' browser-check page. This pattern is characteristic of the NovaCookies Phishing-as-a-Service (PhaaS) platform, which uses such gates to prevent automated analysis and security scanners from accessing the final phishing page.
Detects high-frequency, repeated exploitation attempts or IDS alerts referencing Siemens S7 CVEs directed at a single destination IP, potentially indicating iterative exploit development or automated vulnerability testing against Industrial Control System (ICS) hardware.
Detects outbound HTTP POST requests characterized by an 'application/octet-stream' content type, a specific URI structure consisting of three components (20-40 characters, alpha-numeric, 20-40 characters), and an encrypted payload. This behavioral pattern is associated with SynkLoader malware command-and-control (C2) communications.
Detects HTTP traffic directed to known abused web hosting platforms and SaaS site builders frequently used by the BengalSEO campaign to host search engine optimization (SEO) poisoning lures. These lures typically mimic service activation or support pages to trick users into downloading malicious content.
Detects outbound network traffic to the Telegram Bot API (api.telegram.org) via TLS SNI or HTTP requests, which is a common communication channel for Command and Control (C2) or management for Phishing-as-a-Service (PhaaS) platforms.
Detects repeated attempts to establish S7comm connections to a Programmable Logic Controller (PLC) on port 102. This behavior is indicative of network reconnaissance or scanning targeting Industrial Control Systems (ICS).
Detects network activity (DNS, TLS SNI, and HTTP Host) associated with the SynkLoader malware's command-and-control infrastructure using the domain 'dondermicapp.net'.
Detects persistent outbound TCP connections to external infrastructure, which is indicative of a potential backconnect proxy or C2 communication tunnel. The rule uses a threshold to filter out transient connections.
This rule detects QUIC network traffic where the TLS certificate subject and issuer match specific patterns associated with 'RAT System' and 'RAT CA'. This signature indicates potential command-and-control (C2) communication utilizing self-signed certificates for authentication pinning in an attempt to masquerade or secure malicious traffic.
Detects network activity associated with the NovaCookies phishing campaign, specifically identifying HTTP redirects, TLS SNI connections, or HTTP host headers pointing to infrastructure utilizing .vu top-level domains.
This rule detects patterns characteristic of the ClearFake/EtherHiding campaign, specifically identifying the injection of malicious JavaScript within HTTP responses. The rule monitors for the creation of a script element and the use of base64-encoded javascript content, which is a known technique used in these attacks to facilitate drive-by compromises.
Detects outbound network connections from internal hosts to known IP addresses associated with Dark Caracal's GoCaracal malware command and control infrastructure.
Detects DNS queries for domains identified as part of the GoCaracal campaign, associated with the threat actor Dark Caracal. These domains are known to be used for the delivery and staging of SVG-based phishing attacks.
Detects Microsoft-branded phishing pages served from non-Microsoft domains, the subsequent credential submission, and the establishment of a WebSocket relay connection characteristic of the Mirage2FA Adversary-in-the-Middle (AiTM) toolkit. This rule correlates multiple stages of the phishing flow to identify active proxy-based credential and MFA bypass attempts.
Detects outbound HTTP POST requests to known SynkLoader C2 domains or URI patterns, characterized by 'application/octet-stream' Content-Type headers. The rule targets specific hardcoded domains used by the malware and a suspicious nested URI path pattern commonly associated with its beaconing behavior.
Page 82 of 110