Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,309 detections
Filters
Last updated
All Time
Detection languages
2,251
27
22
7
2
Contributors
910
584
506
125
48
Categories
20,443
11,831
5,875
5,151
4,864
2,309
Platforms
2,196
209
169
62
61
Products / Services
2,253
2,159
165
32
31
MITRE Techniques
713
422
390
187
184
CVEs
17
12
12
12
10
IDS Classtypes
995
426
281
190
98
IDS Protocols
1,291
401
281
117
45
This rule detects network traffic patterns where an internal host initiates an HTTP connection to a specific Steam Community profile, which is used as a dead-drop resolver by the TELEPUZ malware (associated with the CLICKFIX-VIDAR campaign) to retrieve secondary command-and-control infrastructure information.
This rule detects network activity associated with a phishing campaign impersonating the RENAPO CURP lookup service. It monitors for TLS SNI and HTTP Host headers containing the typosquatted domain 'gobf.mx', as well as HTTP responses containing specific keywords related to the Mexican CURP registration form originating from this domain.
Detects network communication associated with the Blind Eagle (APT-C-36) threat actor's use of AsyncRAT. This rule identifies DNS queries for a specific DuckDNS domain, matching TLS SNI for the same domain, and network connections to a known historic C2 IP address historically used via a shared VPN egress.
Detects outbound TLS traffic directed toward ngrok.io infrastructure originating from Azure Container Instances. Ngrok is frequently used by adversaries to establish reverse proxies and tunnels to maintain persistent command-and-control access to compromised cloud-hosted containers.
Detects unauthenticated HTTP POST requests targeting the /api/v1/validate/code endpoint in Langflow, which is indicative of an exploitation attempt associated with CVE-2025-3248.
Detects DNS queries for the Twilio TURN relay domain 'global.turn.twilio.com', which is associated with msaRAT C2 activity. This indicator is low-confidence and intended to be used as part of a correlation with other behaviors like loopback C2 traffic or suspicious DevTools usage.
Detects outbound HTTP POST requests containing JSON-RPC 'eth_call' methods, which are indicative of EtherHiding activity where blockchain infrastructure is abused for command and control or data retrieval.
Detects network traffic originating from the internal network directed towards a specific IP range associated with known PureRAT command and control infrastructure.
Detects outbound network traffic established to an *.ngrok.io domain, which is frequently used by adversaries to create secure tunnels for command and control (C2) or unauthorized data exfiltration.
Detects periodic, repetitive TLS network connections from internal hosts to external destinations using threshold-based analysis. This pattern is indicative of potential command-and-control (C2) beaconing, which may be used for exfiltrating stolen credentials or sensitive data from build or developer environments.
Detects sequential HTTP GET requests for specific SVG assets (barr.svg followed by lg.svg) associated with the Kratos V1 phishing kit landing page, indicating potential interaction with a phishing site.
Detects outbound network traffic to a specific .onion domain associated with underground ransomware or crypter sales. This suggests potential interaction with C2 or malicious infrastructure hosted via the Tor network.
Detects outbound network traffic containing the specific string 'Secret: ' using raw TCP, often indicative of data exfiltration or unauthorized command-and-control communication via tunneling tools like netcat or ngrok.
This rule monitors for a high volume of WebDAV PROPFIND HTTP requests directed toward a specific domain associated with malware staging activities. The detection threshold is set to 50 requests within a 300-second window, which is indicative of automated attempts to enumerate or download malicious content using the WebDAV protocol.
Detects outbound TCP network traffic originating from internal assets to known hardcoded IP addresses and ports associated with PureRAT and DlrtyGames RAT malware families, indicating active command and control (C2) communication.
Detects HTTP POST requests directed at known Kratos Phishing-as-a-Service (PhaaS) URI paths, specifically 'PTT', 'SOft', or 'mini.php'. These paths are commonly associated with credential exfiltration activities.
This rule detects unauthorized or suspicious access to the Komari remote administration panel over unencrypted HTTP. Detecting such access is critical as it indicates potential management interface exposure or unauthorized administrative activity within the network.
Detects DNS query attempts to a known malicious IP address (179.43.166.242) associated with the CrashStealer malware campaign, indicating potential command-and-control communication.
Detects HTTP POST requests indicative of credential exfiltration associated with the Kratos phishing kit. The rule monitors for specific endpoint patterns (e.g., next.php, nex.php, n3xt.php, or officers*eur.php) commonly utilized by this kit to receive stolen credentials.
Detects HTTP GET requests for specific static assets (dsa.svg, sid.gif, imag.jpg) known to be associated with the Kratos V2 phishing kit, which is often used in credential harvesting campaigns.
Detects HTTP traffic originating from external sources that contains response body patterns associated with a DEBULL-themed phishing lure. This rule specifically identifies content indicators related to device-code broker phishing, where a user is tricked into navigating to a malicious URL (debull.app) to authorize access or provide credentials.
Page 87 of 110