Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,309 detections
Filters
Last updated
All Time
Detection languages
2,251
27
22
7
2
Contributors
910
584
506
125
48
Categories
20,443
11,831
5,875
5,151
4,864
2,309
Platforms
2,196
209
169
62
61
Products / Services
2,253
2,159
165
32
31
MITRE Techniques
713
422
390
187
184
CVEs
17
12
12
12
10
IDS Classtypes
995
426
281
190
98
IDS Protocols
1,291
401
281
117
45
Detects network traffic characterized by a specific rotating domain generation algorithm (DGA) pattern using .xyz TLD with a 10-digit timestamp, in combination with a specific URI structure containing 'script?id=' and the suspicious 'tag=WinUpdateHelper' parameter. This behavior is indicative of C2 communication.
Detects incoming HTTP requests directed at the Nacos server application path that contain specific identifiers indicative of an exploitation attempt for CVE-2021-29441. This vulnerability allows an attacker to bypass authentication mechanisms.
Detects network traffic (DNS, TLS SNI, and HTTP Host header) to the domain 'couldinstallup.com', which is associated with Command and Control (C2) activity by the threat group Mustang Panda.
Detects specific URI patterns associated with the DEBULL (also known as CloakGuard) Phishing-as-a-Service (PhaaS) platform. These URI paths are commonly used by attackers managing phishing campaigns, including administrative authentication or deployment script execution on compromised infrastructure acting as a phishing panel.
Detects HTTP POST requests containing 'poll_auth_broker_token' and 'device_code' parameters, which are characteristic of malicious OAuth 2.0 device authorization grant flows commonly used in phishing campaigns.
This rule detects HTTP POST requests to known phishing domains (frenksv.sbs, debull.app) which include specific parameters indicative of an attempt to initiate the OAuth 2.0 device authorization grant flow ('get_auth_broker_device_code'). This pattern is associated with phishing campaigns aiming to hijack a user's session by tricking them into authorizing a malicious application, eventually leading to the theft of application access tokens.
Detects DNS queries for domains associated with Kratos Phishing-as-a-Service (PhaaS) hosting infrastructure. This activity is indicative of a user or system attempting to resolve domains used for phishing campaigns or command and control communication.
Detects outbound network traffic containing the string 'Secret: ', which indicates potential sensitive data exfiltration. The rule specifically targets the use of netcat-like behavior directed toward external endpoints, which are commonly associated with tunneling services like ngrok used to bypass network egress restrictions.
Detects established TLS traffic over WebSockets where the certificate subject field lacks a common name (CN), often indicative of non-standard, self-signed, or improperly generated TLS certificates used by command-and-control (C2) agents to bypass standard certificate validation or hide within encrypted channels.
Detects unauthenticated HTTP POST requests targeting the /api/v1/validate/code endpoint in Langflow, which is indicative of an exploitation attempt associated with CVE-2025-3248.
Detects HTTP traffic identified as MarkiRAT command and control beaconing, characterized by a specific multipart POST request structure directed at a known malicious URI and domain.
Detects HTTP POST requests directed at a '/save.php' URI, a common signature associated with the Kratos phishing kit used for capturing and exfiltrating user credentials.
Detects outbound network traffic consistent with CrySome RAT Command and Control (C2) communication, including direct connections to a known hardcoded IP address on port 5555 and the observation of the '##CRYCFG##' configuration marker within the TCP stream.
This rule detects outbound TLS 1.2 traffic communicating over TCP port 99, which is a non-standard port for TLS/HTTPS traffic. This behavior is indicative of potential command-and-control (C2) communication where an adversary is attempting to hide traffic using encryption on an unconventional port.
This Suricata rule detects potential exfiltration of stolen data by the StealC or Amadey malware families. It specifically looks for an HTTP POST request to a .php URI containing a 'PK' header (the magic bytes for a ZIP file), suggesting the transmission of compressed stolen logs to a C2 server.
Detects network activity (DNS queries, HTTP requests, and TLS SNI) associated with the PamStealer malware communicating with its known command and control domain maccyapp.com.
This rule detects attempts to exploit the Nacos CVE-2021-29441 authentication bypass vulnerability. The vulnerability allows an attacker to bypass authentication by leveraging default or forged JWT tokens, specifically targeting the /nacos/ path with an Authorization header containing a Bearer token starting with 'eyJ'.
Detects established TLS connections to external networks where the server certificate subject contains a Common Name (CN) but lacks Organization (O) or Organizational Unit (OU) fields. This pattern is characteristic of basic, potentially malicious self-signed certificates used by command-and-control (C2) frameworks to mask communication.
Detects network traffic associated with Cavern Manticore command-and-control communication. The rule identifies a specific HTTP request pattern characterized by a static User-Agent string resembling a Chrome/Edge browser on Windows and the inclusion of a specific 'X-User-token' header in the HTTP request.
This rule detects HTTP GET requests for specific file paths associated with known malicious lure archives (e.g., YEPlayer.rar, Pis2rayVPN.zip, YEMPlayer.msi). These files are typically used in social engineering campaigns to trick users into downloading and executing malware.
Detects HTTP GET requests to the URI '/beacon' destined for a known JadePuffer command-and-control server IP address (45.131.66.106) on port 4444. This signature identifies potential beaconing activity, which is a common communication pattern for malware implants communicating with an adversary-controlled server.
Page 88 of 110