Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,431 detections
Filters
Last updated
All Time
Detection languages
2,428
3
Contributors
747
554
405
315
183
Categories
1,914
1,291
689
671
449
Platforms
2,202
183
149
62
49
Products / Services
2,366
1,378
38
37
25
MITRE Techniques
537
454
342
308
301
CVEs
17
10
9
9
9
IDS Classtypes
1,098
452
204
154
102
IDS Protocols
2,431
868
408
324
97
Detects network traffic indicating the use of Rclone to exfiltrate data to MEGA cloud storage, a technique associated with Akira ransomware campaigns.
This rule detects network traffic patterns associated with ARToken-style OAuth device code phishing attacks, specifically monitoring for initial backend requests to Cloudflare Workers infrastructure, response payloads containing known phishing template indicators, and subsequent polling activity against device code endpoints that indicate an active phishing session.
Detects network activity associated with a known malicious campaign using fake Cloudflare CAPTCHA pages as a lure. This includes requests to retrieve tracker scripts from 'fsputnik.com', loading of fake verification pages from 'uasputnik.com', and communication with a known command retrieval endpoint ('admin777111777.php') potentially used for clipboard hijacking.
Detects HTTP requests and responses involving the download of an executable file named 'ClaudeDesktop.exe' from the 'claude.ai' host, which is indicative of a malicious campaign distributing SectopRAT.
This rule detects network requests directed at raw.githubusercontent.com that attempt to retrieve 'init.dat' or files named with a specific GUID format, patterns which are characteristic of the Kimsuky threat group using GitHub as a dead drop resolver for C2 infrastructure discovery.
Detects HTTP POST requests directed to OpenAI or Anthropic API endpoints originating from non-browser user agents (e.g., Python requests, curl, Go-http-client). This activity may indicate automated interactions, potentially for malicious purposes such as script-based interaction with LLMs or unauthorized API usage.
Detects large HTTP POST requests (exceeding 100KB) directed to public LLM API endpoints such as OpenAI or Anthropic. This behavior may indicate potential bulk data exfiltration or unauthorized sharing of sensitive data with external AI providers.
Detects network traffic associated with Adversary-in-the-Middle (AiTM) phishing kits that impersonate Microsoft and Google login pages. The rules identify the presence of specific HTML elements (like Cloudflare Turnstile anti-bot gates) and authentication session cookie headers served from non-authorized/non-official domains, indicating a reverse-proxy phishing attack.
This rule detects malicious HTTP POST requests attempting a path traversal attack against Grav CMS, specifically targeting the __unique_form_id__ parameter. The rule looks for directory traversal sequences ('..') following the parameter, which is characteristic of attempts to read sensitive files outside the intended web directory.
This rule detects malicious HTTP POST requests attempting a path traversal attack against Grav CMS, specifically targeting the __unique_form_id__ parameter. The rule looks for directory traversal sequences ('..') following the parameter, which is characteristic of attempts to read sensitive files outside the intended web directory.
Detects HTTP beaconing and command-and-control (C2) communication patterns associated with the Exvicy malware family. This includes heartbeat polling, victim fingerprinting registration, and CAPTCHA handling over HTTP GET and POST requests to the '/api.php' endpoint.
Detects high-volume account enumeration activity associated with the TeamFiltration tool, characterized by the use of legacy Microsoft Teams desktop client User-Agent strings (specific versions of Teams, Electron, and Chrome) within a short time window.
Detects high-volume account enumeration activity associated with the TeamFiltration tool, characterized by the use of legacy Microsoft Teams desktop client User-Agent strings (specific versions of Teams, Electron, and Chrome) within a short time window.
Detects anomalous POST requests to the RubyGems webhook API endpoint (/api/v1/web_hooks) containing specific indicators ('A000' or 'ZZEND') in the request body, which suggests the misuse of legitimate webhooks for chunked data exfiltration.
Detects HTTP GET requests to Cloudflare Pages subdomains (.pages.dev) ending in '/File_download', often used as a distribution point for malicious HTA (HTML Application) or WSF (Windows Script File) payloads in spearphishing campaigns.
Detects SQL injection exploitation attempts against MOVEit Transfer targeting the CVE-2023-34362 vulnerability, followed by the deployment and subsequent interaction with the 'human2.aspx' webshell associated with Cl0p ransomware mass-exploitation campaigns.
Detects outbound HTTP requests to 'third-party.com', a domain identified as being associated with 'ClickFix' social engineering lures, which are commonly used to deceive users into executing malicious scripts or downloading payloads.
Detects anomalous WebSocket upgrade requests using a suspicious Firefox/21.0 User-Agent followed by a C2 buffer containing 'google.com' associated with the NeedyMantis threat actor group.
Detects network activity associated with ORAX Phishing-as-a-Service (PhaaS), specifically identifying fake Cloudflare security-verification pages and emoji-based CAPTCHA gates used as anti-analysis techniques to frustrate automated sandboxing.
This rule detects network traffic patterns associated with the ARToken phishing campaign, specifically identifying access to lure pages hosted on 'workers.dev' domains with 'docviewer' in the hostname and 'turnstile' challenge responses in the HTTP body, which is used for anti-analysis/evasion.
Detects network traffic patterns associated with the ORAX/OraxRDP AiTM (Adversary-in-the-Middle) phishing toolkit. The rule monitors for specific SignalR WebSocket upgrade requests and session-related GraphQL commands (such as MirrorChallenge, Init, and Input) used to facilitate MFA relay and web session hijacking.
Page 16 of 116