Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,309 detections
Filters
Last updated
All Time
Detection languages
2,251
27
22
7
2
Contributors
910
584
506
125
48
Categories
20,453
11,837
5,876
5,154
4,865
2,309
Platforms
2,196
209
169
62
61
Products / Services
2,253
2,159
165
32
31
MITRE Techniques
713
422
390
187
184
CVEs
17
12
12
12
10
IDS Classtypes
995
426
281
190
98
IDS Protocols
1,291
401
281
117
45
Detects HTTP traffic communicating with known domains (grove-12.com and trekmesh15.com) associated with the Codex ClickFix/AMOS campaign, specifically looking for indicators of payload staging or beaconing activity through specific URI patterns.
Detects network traffic consistent with SynkLoader malware communicating with its C2 infrastructure. The rule identifies suspicious TLS SNI requests to known hardcoded domains and HTTP POST requests using the application/octet-stream content type, which are characteristic of SynkLoader C2 beaconing.
Detects outbound HTTP POST requests with a specific URI pattern associated with C2Looper malware communication, indicating potential C2 activity or data exfiltration.
This rule monitors outgoing HTTP traffic for a specific numeric URI path pattern ( /49890878) which is characteristic of beaconing behavior to a command-and-control (C2) server. Such static, non-descriptive URI paths are frequently used by malware to maintain consistent connectivity to an adversary-controlled infrastructure.
Detects DNS queries containing high-entropy domain labels that exhibit patterns common to Domain Generation Algorithms (DGA). The rule triggers when a threshold of such suspicious queries is exceeded from a single source within a 60-second window, which is a common indicator of malware beaconing or C2 communication.
This rule detects potential command-and-control (C2) activity from the TWINLOOT malware, which utilizes Microsoft Teams TURN relay infrastructure to establish a reverse SOCKS5 tunnel. The detection identifies connections to 'worldaz-msit.relay.teams.microsoft.com' followed immediately by a SOCKS5 handshake pattern (05 01 00), indicating encapsulated tunneling within the relay communication.
This rule detects two components of a malicious campaign using Google Sites to host fake OpenAI Codex installer lures. The first rule detects when a response body from an external server contains an iframe pointing to the domain 'bright-links.com'. The second rule detects client-side requests to Google Sites paths containing 'codex', indicating a user is navigating to the lure page.
Detects outbound network traffic from internal hosts to known command-and-control (C2) server IP addresses associated with C2Looper malware on port 8888.
Detects periodic beaconing and configuration polling by the TWINLOOT implant using Azure Blob Storage as a dead-drop mechanism. The rules identify specific TLS SNI patterns and HTTP requests for 'cfg.json' files hosted on Azure Blob storage using non-browser user-agents.
Detects network traffic indicating potential Command and Control (C2) tasking communication via Microsoft SharePoint. The rule monitors for requests to specific SharePoint paths associated with the TWINLOOT campaign, which leverages legitimate cloud infrastructure for malicious command delivery.
Detects outbound HTTP POST requests to a URI path '/api/beacon' containing a specific JSON structure ('id', 'user', 'host', 'pid'), which is characteristic of the C2Looper beaconing behavior.
This rule detects network traffic patterns associated with the msaRAT remote access trojan (RAT) as it initializes WebRTC communication. It identifies the initial POST request to a token service and the subsequent response containing Twilio TURN and Google STUN relay server configurations, which are used by the malware to establish peer-to-peer tunnels for command-and-control communication.
Detects outbound network traffic from internal hosts to known malicious IP addresses associated with AdaptixC2 infrastructure. This rule identifies both general TCP connections and HTTP beaconing activity to these C2 servers, which are used for command and control purposes.
Detects anomalous, non-browser process activity interacting with Microsoft Teams APIs associated with the TWINLOOT threat campaign. The rules identify suspicious token retrieval requests and unauthorized authentication headers from processes that do not identify as legitimate browser or Teams application agents, indicating potential abuse of application access tokens and authentication flows.
This rule detects outbound TLS connections from the local network to an external destination where the server provides a self-signed certificate. Self-signed certificates are often used by malware for command-and-control (C2) communication or by data exfiltration tools to establish encrypted channels while avoiding the need for legitimate, verifiable PKI infrastructure.
Detects network activity associated with the TWINLOOT malware, identifying command-and-control communication through TLS ALPN, custom HTTP User-Agent strings, and specific SNI values for known C2 infrastructure.
Detects HTTP GET requests to known Mirage2FA phishing infrastructure domains and specific URI patterns associated with the retrieval of JavaScript loaders. This rule monitors for specific URL paths ('/xls/') and naming conventions (e.g., 'a1p2i.js') characteristic of the Mirage2FA phishing kit, which is used to harvest 2FA tokens.
This rule detects HTTP requests directed towards known malvertising domains that serve trojanized MSI installers. The rule identifies specific suspicious hostnames and a common URL pattern used for payload delivery.
Detects DNS queries to UNC6671 vishing-lure lookalike domains (createssopasskey/addssopasskey/passkeyhelpdesk) used to harvest credentials after a helpdesk-impersonation vishing call.
Detects network activity associated with the BumbleBee malware, including domain-generation algorithm (DGA) pattern matches within TLS Server Name Indication (SNI) fields and direct connections to known C2 infrastructure IP addresses over HTTPS.
Detects the ClickFix TDS (Traffic Direction System) gate, which uses browser-based JavaScript to perform anti-analysis and anti-instrumentation checks. Specifically, it looks for the unauthorized hooking of Array.prototype.includes and the use of canPlayType as a tripwire to detect sandboxes or debuggers, correlated with signs of developer tool usage or prototype property modifications.
Page 83 of 110