Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,309 detections
Filters
Last updated
All Time
Detection languages
2,251
27
22
7
2
Contributors
910
584
506
125
48
Categories
20,453
11,837
5,876
5,154
4,865
2,309
Platforms
2,196
209
169
62
61
Products / Services
2,253
2,159
165
32
31
MITRE Techniques
713
422
390
187
184
CVEs
17
12
12
12
10
IDS Classtypes
995
426
281
190
98
IDS Protocols
1,291
401
281
117
45
This rule detects outgoing TCP traffic to port 1082 that initiates or utilizes a SOCKS5 proxy connection, specifically identifying patterns associated with the Myxa VPN tool. The detection monitors for the specific SOCKS5 handshake byte and identifies known hardcoded IP addresses associated with this tool's proxy infrastructure.
Detects HTTP GET requests to a specific Cloudflare Workers domain ('is-01-ast.ols-img-12.workers.dev') used for msaRAT WebRTC signaling, characterized by the presence of spoofed 'Origin' and 'Referer' headers pointing to 'microsoft.com' alongside a 'HeadlessChrome' user agent, indicating malicious command-and-control behavior.
Detects outbound network connections initiated by a process identifying itself as 'HeadlessChrome' within the User-Agent string. This behavior is indicative of a headless browser being misused as a proxy for Command and Control (C2) communication, as observed in msaRAT infections.
Detects HTTP requests for fingerprinted JavaScript/CSS assets shared across UNC6671's cloned SSO and cryptocurrency vault-drainer phishing panels.
Detects HTTP requests to known UNC6671 AiTM reverse-proxy phishing kit IPs on MFA/OTP interception URI paths (push-tap, duo-push, oauth2 2fa, community verify), indicating live MFA bypass.
Detects outbound network traffic from internal hosts to domains and IP addresses identified as part of the LinX Coders infrastructure used for Mirage2FA adversary-in-the-middle (AiTM) phishing and credential harvesting campaigns.
Detects malicious heartbeat check-ins to a C2 server endpoint '/api/bot/heartbeat' by monitoring for unauthorized exfiltration of hardware identifiers (Host/Device/HW ID) or potential remote task execution via Base64-encoded instructions in the response body, characteristic of ClickFix-related infostealer campaigns targeting macOS users.
Detects outbound HTTP POST requests associated with the ChainDrop/Shai-Hulud malware family. The rule looks for 'eth_call' JSON-RPC method calls targeting a specific Ethereum smart contract address known to be used for EtherHiding C2 infrastructure, where malicious payloads or commands are embedded within blockchain interactions.
Detects macOS infostealer malware using the curl utility to exfiltrate archived data (zip, tar, tgz, etc.) via multipart POST requests to specific known staging endpoints associated with the ClickFix campaign.
This rule detects suspicious outbound HTTP POST requests containing specific JSON fingerprint payloads associated with ClickFix campaigns. The fingerprint contains a mode set to 'php', typically delivered via hidden, auto-submitting forms on malicious domains to profile victims or deliver secondary payloads.
Detects DNS query bursts from a single source to a predefined set of domains mimicking passkey or single-sign-on (SSO) login portals. These domains are known to be part of the infrastructure used by the UNC6671 threat actor for credential harvesting activities.
This rule detects sustained network communication (at least 5 connections within a 300-second window) between internal hosts and a specific list of IP addresses identified by Unit 42 as malicious infrastructure used for AI token jacking. These servers operate as transfer stations, likely utilizing platforms like new-api or one-api to facilitate the illicit resale of stolen frontier-AI API keys. The rule incorporates an exclusion for internal security scanning and proxy infrastructure to minimize false positives, and it is specifically designed to flag exfiltration or unauthorized API usage patterns associated with stolen credentials (T1539) and potential proxy-based obfuscation of command and control or data relay (T1090).
UNC6671 - Outbound connection to known automated SaaS data exfiltration IP, excluding maintained allowlist of legitimate backup/sync/CDN and sanctioned bulk-transfer destinations
UNC6671 AiTM passkey/SSO lookalike domain DNS query
Detects outbound HTTP POST requests associated with the ChainDrop/Shai-Hulud malware family. The rule looks for 'eth_call' JSON-RPC method calls targeting a specific Ethereum smart contract address known to be used for EtherHiding C2 infrastructure, where malicious payloads or commands are embedded within blockchain interactions.
UNC6671 AiTM Phishing Infrastructure - Maintained IOC Dataset Match with TTL-Based Expiry (High Confidence)
Detects a specific fingerprinting activity by the ClickFix Traffic Direction System (TDS) within HTTP POST request bodies. The rule identifies the combination of 'mode:php', a 'MacIntel' platform string (spoof-check), and WebGL rendering fields ('webglVendor', 'webglRenderer') in a JSON-encoded body, which is characteristic of the macOS ClickFix infostealer campaign delivery.
Detects HTTP POST requests to an Apache Tomcat server containing a Java serialized-object header (AC ED 00 05) in a request body larger than 512 bytes, consistent with CVE-2026-34486 deserialization exploitation.
Detects network communication associated with the TOKYOCORE malware C2 infrastructure. The rule monitors for specific API endpoints (/api/victim/(log|data|command|archive)) combined with known malicious User-Agent strings (RansomAgent or fsociety/1.0), as well as suspicious multipart form data uploads that may indicate data staging or exfiltration.
Detects outbound FOFA asset-search traffic containing an exact title="Langflow" query directed at the FOFA API host (fofa.info), indicating reconnaissance for Langflow deployments.
Detects network activity associated with the Dolphin X malware, including DNS queries, TLS SNI requests, and direct TCP traffic to known C2 infrastructure patterns on specific ports.
Page 84 of 110