Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,937 detections
Filters
Last updated
All Time
Detection languages
1,930
3
2
1
1
Contributors
592
477
360
250
124
Categories
995
927
834
546
538
Platforms
1,753
214
81
54
41
Products / Services
1,868
1,144
65
51
17
MITRE Techniques
564
412
305
201
175
CVEs
4
4
4
2
2
IDS Classtypes
1,937
503
461
381
236
IDS Protocols
1,098
362
201
171
37
Detects potential data exfiltration activity where a host is communicating with the Telegram Bot API. The rule identifies high-frequency connections to api.telegram.org and inspects HTTP URIs for signs of Telegram Bot token usage combined with 'sendDocument' or 'sendPhoto' commands, which are common indicators of malicious exfiltration.
This rule detects network traffic directed to the subdomain 'testing.perplexity.com', which is identified as being associated with the BragJack campaign. This specific subdomain is leveraged by the campaign to facilitate browser session redirect bypasses, indicative of an attempt to intercept or manipulate user sessions.
This rule detects network traffic directed to the subdomain 'testing.perplexity.com', which is identified as being associated with the BragJack campaign. This specific subdomain is leveraged by the campaign to facilitate browser session redirect bypasses, indicative of an attempt to intercept or manipulate user sessions.
Detects outbound network traffic from internal hosts to known MeshCentral Command and Control (C2) infrastructure. MeshCentral is legitimate remote monitoring and management (RMM) software that is frequently abused by threat actors to maintain persistent remote access to victim environments. This rule monitors for established TCP connections on specific ports associated with MeshCentral C2 nodes.
Detects outbound network traffic from internal hosts to known MeshCentral Command and Control (C2) infrastructure. MeshCentral is legitimate remote monitoring and management (RMM) software that is frequently abused by threat actors to maintain persistent remote access to victim environments. This rule monitors for established TCP connections on specific ports associated with MeshCentral C2 nodes.
Detects TLS connections using suspicious certificates identified as belonging to the SilkParasite threat actor. The rule monitors for specific certificate issuer strings paired with either malicious subject domain patterns (targeting Central Asian entities) or specific JA4X fingerprints associated with known malicious activity.
Detects TLS connections using suspicious certificates identified as belonging to the SilkParasite threat actor. The rule monitors for specific certificate issuer strings paired with either malicious subject domain patterns (targeting Central Asian entities) or specific JA4X fingerprints associated with known malicious activity.
This rule monitors for network traffic related to known fake GitHub pages and malicious loader sites impersonating LastPass Authenticator. It detects attempts to access specific malicious domains and organization pages on GitHub, as well as the delivery of malicious pages containing spoofed trust badges and branding, commonly used in phishing campaigns.
Detects outbound network traffic to a known malicious IP address associated with Rapuncel Stealer, specifically looking for HTTP POST requests to the /upload endpoint, indicating possible data exfiltration.
Detection of network traffic associated with the delivery of the Rapuncel information stealer. The rules monitor for large ZIP archives masquerading as LastPass Authenticator installers and detect attempts to reach out to external domains for DLL sideloading artifacts (TitanStorage.dll and ProManager.dll).
Detects DNS queries and TLS SNI traffic directed towards domains identified as part of Storm-3121/Storm-3032 phishing campaigns. These domains are themed around passkey management and single sign-on (SSO) services, likely intended for credential harvesting.
Detects network activity and email headers associated with the DoppelBrand campaign. The rule monitors DNS queries for specific IOC domains (service-nowinc.com, domainlify.net) and inspects SMTP traffic for malicious MAIL FROM addresses and Reply-To headers targeting these domains.
Detects outbound network traffic consistent with the Chisel proxy/tunneling tool establishing a connection to an external VPS associated with the Miku threat actor. The rule monitors for established TCP connections to a specific remote IP address on port 443, utilizing a threshold to reduce noise by ensuring multiple connection attempts occur.
Detects outbound network traffic consistent with the Chisel proxy/tunneling tool establishing a connection to an external VPS associated with the Miku threat actor. The rule monitors for established TCP connections to a specific remote IP address on port 443, utilizing a threshold to reduce noise by ensuring multiple connection attempts occur.
Detects outbound TCP traffic originating from the internal network destined for a known malicious IP associated with Meterpreter Java payload retrieval and post-exploitation Command and Control (C2) activity, potentially related to PaperCut vulnerability exploitation.
This rule detects potential Adversary-in-the-Middle (AiTM) activity by monitoring for a two-stage pattern: a SignalR negotiation POST request followed by a WebSocket upgrade request to a suspicious domain structure. The pattern specifically targets lookalike domains featuring a random subdomain of at least 12 alphanumeric characters, which is indicative of ORAX-style AiTM infrastructure.
This rule detects potential Adversary-in-the-Middle (AiTM) activity by monitoring for a two-stage pattern: a SignalR negotiation POST request followed by a WebSocket upgrade request to a suspicious domain structure. The pattern specifically targets lookalike domains featuring a random subdomain of at least 12 alphanumeric characters, which is indicative of ORAX-style AiTM infrastructure.
This rule detects potential Adversary-in-the-Middle (AiTM) activity by monitoring for a two-stage pattern: a SignalR negotiation POST request followed by a WebSocket upgrade request to a suspicious domain structure. The pattern specifically targets lookalike domains featuring a random subdomain of at least 12 alphanumeric characters, which is indicative of ORAX-style AiTM infrastructure.
This rule detects potential command and control (C2) communication related to the GhostContainer malware. It inspects HTTP POST requests directed at Microsoft Outlook Web Access (OWA) paths containing a suspicious 'x-owa-urlpostdata' header. The presence of this specific header, followed by a base64-encoded string of significant length, indicates an attempt to deliver C2 commands or exfiltrate data through OWA infrastructure.
This rule detects outbound TLS connections from server-role assets to 'devtunnels.ms', a service that facilitates temporary public tunnels to internal services. This behavior is flagged as a potential indicator of unauthorized command-and-control (C2) tunneling, particularly when originating from critical infrastructure like Domain Controllers or Exchange OWA servers.
This rule detects outbound TLS connections from server-role assets to 'devtunnels.ms', a service that facilitates temporary public tunnels to internal services. This behavior is flagged as a potential indicator of unauthorized command-and-control (C2) tunneling, particularly when originating from critical infrastructure like Domain Controllers or Exchange OWA servers.
Page 35 of 93