Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,937 detections
Filters
Last updated
All Time
Detection languages
1,930
3
2
1
1
Contributors
592
477
360
250
124
Categories
995
927
834
546
538
Platforms
1,753
214
81
54
41
Products / Services
1,868
1,144
65
51
17
MITRE Techniques
564
412
305
201
175
CVEs
4
4
4
2
2
IDS Classtypes
1,937
503
461
381
236
IDS Protocols
1,098
362
201
171
37
Detects specific outbound HTTP POST requests to a known Amatera Stealer command and control domain. The rule looks for the unique URI path '/T.@w' and a specific 'Command: GetEndpoints' header structure commonly used by this malware family to beacon to its C2 infrastructure.
Detects specific outbound HTTP POST requests to a known Amatera Stealer command and control domain. The rule looks for the unique URI path '/T.@w' and a specific 'Command: GetEndpoints' header structure commonly used by this malware family to beacon to its C2 infrastructure.
This rule detects outgoing HTTP requests to 'apimantax.otax.fun' attempting to initiate a WebSocket upgrade connection. This is characteristic of the Mantax Otax v2 malware family establishing a Command and Control (C2) channel.
Detects repeated manual HTTP GET requests from many distinct source IPs to a canary token resource. The URI pattern follows a format indicative of a tracked canary token resource, and the threshold of 49 unique source IPs accessing the resource within a prolonged period suggests potential unauthorized reconnaissance or probing activities.
This rule monitors for DNS queries, HTTP requests to '/cli/check', and TLS SNI traffic directed towards the domain 'coder-infra.com', which is associated with a suspected compromise of a Coder registry.
Detects outbound TCP traffic originating from the internal network destined for a known malicious IP associated with Meterpreter Java payload retrieval and post-exploitation Command and Control (C2) activity, potentially related to PaperCut vulnerability exploitation.
Detects outbound TCP traffic originating from the internal network destined for a known malicious IP associated with Meterpreter Java payload retrieval and post-exploitation Command and Control (C2) activity, potentially related to PaperCut vulnerability exploitation.
Detects outbound TLS traffic where the Server Name Indication (SNI) matches the hardcoded domain 'ms.checrity.com', which is associated with ShadowPad backdoor activity.
Detects DNS queries and TLS SNI traffic originating from internal hosts directed towards a specific set of domains associated with passkey/MFA/SSO-themed vishing lures. These domains are identified as potential components of phishing campaigns designed to deceive users into disclosing authentication credentials.
This rule detects network traffic indicative of the PEEP Browser RAT, specifically HTTP beacons targeting the URI path '/api/commands'. It monitors for unique HTTP headers ('X-PEEP-Agent-Id', 'X-PEEP-Agent-Key') and connections to known malicious infrastructure.
Detects the use of a specific magic string ('sxcdewqaz!@#') commonly associated with the Fire Ant implant to trigger or activate reverse-tunneling capabilities over TCP ports 443, 541, 8443, and 10443.
Detects SMTP MAIL FROM/Reply-To headers, DNS queries, or TLS SNI matches for known Business Email Compromise (BEC) lookalike domains (e.g., service-nowinc.com, domainlify.net) used for phishing or spoofing organizational identities.
Detects DNS queries and TLS SNI traffic directed towards known phishing domains that mimic Brazilian financial and government portals, specifically targeting 'gerenciadorcaixa.digital', 'aapj.digital', and 'receitafederal.digital'.
Detects an HTTP GET request to 'dl.php' containing an 'f' parameter (target file) and an 'k' parameter (access token), followed by a response body starting with the 'MZ' header, indicating the successful download of a Windows PE executable as part of a potential phishing campaign stage-2 payload delivery.
Detects an HTTP GET request to 'dl.php' containing an 'f' parameter (target file) and an 'k' parameter (access token), followed by a response body starting with the 'MZ' header, indicating the successful download of a Windows PE executable as part of a potential phishing campaign stage-2 payload delivery.
Detects sustained beaconing behavior originating from the internal network to known malicious HVNC (Hidden Virtual Network Computing) C2 infrastructure. The rule identifies repeated connection attempts (5 or more TCP SYNs within a 180-second window) targeting specific hardcoded IP addresses on non-standard ports (27015/27017), indicative of a compromised host maintaining persistent C2 communication.
Detects sustained beaconing behavior originating from the internal network to known malicious HVNC (Hidden Virtual Network Computing) C2 infrastructure. The rule identifies repeated connection attempts (5 or more TCP SYNs within a 180-second window) targeting specific hardcoded IP addresses on non-standard ports (27015/27017), indicative of a compromised host maintaining persistent C2 communication.
Detects the specific C2 handshake pattern associated with HVNC (Hidden Virtual Network Computing) remote access trojans. The rule monitors for a unique sequence of markers, specifically CLIENT_ID, COMPUTER, IDENTIFIER_CHANNEL, and a version string, indicating a malware-specific communication protocol.
Detects potential exfiltration activity by identifying HTTP POST/PUT requests to known suspicious domains, including specific operator-controlled hosts and anonymous file sharing services, as well as the use of HTTP Range headers for bulk API data exfiltration.
Detects outbound HTTP POST requests to suspicious .ru domains and DNS queries for these domains, indicative of C2 beaconing activity likely associated with a supply chain compromise affecting the Pub.dev ecosystem.
Detects network activity associated with the ProRAM C2 infrastructure. The rule monitors for DNS resolutions, TLS SNI field matches, and specific HTTP WebSocket upgrade patterns directed towards the 'clash-verge-upgrade.com' domain.
Page 43 of 93