Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,937 detections
Filters
Last updated
All Time
Detection languages
1,930
3
2
1
1
Contributors
592
477
360
250
124
Categories
995
927
834
546
538
Platforms
1,753
214
81
54
41
Products / Services
1,868
1,144
65
51
17
MITRE Techniques
564
412
305
201
175
CVEs
4
4
4
2
2
IDS Classtypes
1,937
503
461
381
236
IDS Protocols
1,098
362
201
171
37
Detects anomalous outbound HTTP traffic directed to /cli/check containing a specific 'X-CLI-Token' header value. This pattern is indicative of a Command and Control (C2) beaconing mechanism used by a compromised CLI tool or supply chain implant to verify connectivity or receive instructions.
This rule monitors for DNS queries, HTTP requests to '/cli/check', and TLS SNI traffic directed towards the domain 'coder-infra.com', which is associated with a suspected compromise of a Coder registry.
Detects network activity (TCP, DNS, and HTTP) directed towards a known rogue infrastructure IP identified in a supply chain compromise affecting the Coder registry. The rule alerts on attempts to resolve or communicate with this infrastructure to download backdoored Terraform modules or interact with malicious resources.
Detects network activity (TCP, DNS, and HTTP) directed towards a known rogue infrastructure IP identified in a supply chain compromise affecting the Coder registry. The rule alerts on attempts to resolve or communicate with this infrastructure to download backdoored Terraform modules or interact with malicious resources.
Detects HTTP traffic patterns associated with the JSCeal malware family, specifically focusing on the exfiltration of crypto wallet information and account balances. The rule identifies communication to suspicious domains, unauthorized access to balance field names, and the masquerading of traffic to impersonate legitimate exchanges like Binance.
Detects HTTP traffic patterns associated with the JSCeal malware family, specifically focusing on the exfiltration of crypto wallet information and account balances. The rule identifies communication to suspicious domains, unauthorized access to balance field names, and the masquerading of traffic to impersonate legitimate exchanges like Binance.
Detects the download of a JavaScript module named JSCeal, which contains code indicative of an HTTPS interception proxy. The rule looks for Node.js-based server creation code combined with cryptographic operations like keypair generation, certificate creation, and PEM conversion, excluding common legitimate JavaScript libraries and CDNs.
Detects network activity (HTTP, TLS SNI, and DNS) associated with the domain 'noht1ng.top', which is linked to the GRAYRABBIT malware utilized by the threat actor UNC3569.
Detects network activity (HTTP, TLS SNI, and DNS) associated with the domain 'noht1ng.top', which is linked to the GRAYRABBIT malware utilized by the threat actor UNC3569.
Detects DNS queries originating from an internal host to 'mail.uaiubifas.top', which is associated with GRAYRABBIT command-and-control (C2) activity.
Detects HTTP traffic involving the retrieval of 7z.exe or 7zp.dll payloads from a known Alibaba Cloud staging server associated with the UNC3569 threat actor and the GRAYRABBIT malware. The rule uses a threshold-based detection to identify repeated download attempts from the external IP 8.218.50.207.
Detects HTTP traffic involving the retrieval of 7z.exe or 7zp.dll payloads from a known Alibaba Cloud staging server associated with the UNC3569 threat actor and the GRAYRABBIT malware. The rule uses a threshold-based detection to identify repeated download attempts from the external IP 8.218.50.207.
Detects HTTP traffic involving the retrieval of 7z.exe or 7zp.dll payloads from a known Alibaba Cloud staging server associated with the UNC3569 threat actor and the GRAYRABBIT malware. The rule uses a threshold-based detection to identify repeated download attempts from the external IP 8.218.50.207.
Detects the FTP STOR command uploading a file with a .pcap extension to an external host on port 21 or 20 — consolidated from three overlapping detections (generic server, router-specific, and capture-file variants). Indicates an adversary (e.g. Fire Ant/UNC3886) exfiltrating captured network traffic from a compromised network device via FTP.
Detects high-frequency, repeated access to a specific fraud-tracking or canary token link by sources utilizing rotating VPNs or proxies over an extended period. This behavior is indicative of automated probing or credential validation attempts associated with the Phantom Deal campaign.
Detects DNS queries and TLS SNI traffic originating from internal hosts directed towards a specific set of domains associated with passkey/MFA/SSO-themed vishing lures. These domains are identified as potential components of phishing campaigns designed to deceive users into disclosing authentication credentials.
This rule detects network traffic indicative of the PEEP Browser RAT, specifically HTTP beacons targeting the URI path '/api/commands'. It monitors for unique HTTP headers ('X-PEEP-Agent-Id', 'X-PEEP-Agent-Key') and connections to known malicious infrastructure.
Detects anomalous use of the 'X-Grafana-URL' header in conjunction with an 'Authorization: Bearer' token, indicative of an attempt to exfiltrate a service account token to an unauthorized or external domain, exploiting CVE-2026-15583.
This rule detects outbound network connections from internal hosts to specific IP addresses associated with known AlexHost infrastructure identified as command-and-control (C2) servers for the Bandook Remote Access Trojan (RAT), which is utilized by the threat actor Dark Caracal.
Detects network activity associated with the ProRAM C2 infrastructure. The rule monitors for DNS resolutions, TLS SNI field matches, and specific HTTP WebSocket upgrade patterns directed towards the 'clash-verge-upgrade.com' domain.
Detects DNS queries for known typosquatted time-sync domains and associated UDP traffic on port 123 (NTP) utilized by the StyleSmuggler malware for command and control purposes.
Page 44 of 93