Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,431 detections
Filters
Last updated
All Time
Detection languages
2,428
3
Contributors
747
554
405
315
183
Categories
1,914
1,291
689
671
449
Platforms
2,202
183
149
62
49
Products / Services
2,366
1,378
38
37
25
MITRE Techniques
537
454
342
308
301
CVEs
17
10
9
9
9
IDS Classtypes
1,098
452
204
154
102
IDS Protocols
2,431
868
408
324
97
This rule detects HTTP POST requests indicative of the RevStealer malware interacting with a Polygon blockchain smart contract via a public RPC endpoint. The rule specifically looks for 'eth_call' JSON-RPC methods targeting a known malicious contract address and a specific function selector ('0xd8b0d6ad') often used in RevStealer's command-and-control failover operations.
Detects outbound HTTP POST requests associated with the VelvetCake malware and Konni threat actor to the command-and-control (C2) domain 'medianewsonline.com'. The rule matches specific URI patterns ('/logout.php') and query parameters ('OKey=', 'Who=', 'Areyou=') commonly used for reconnaissance and data exfiltration.
Detects RevStealer malware attempting to use blockchain infrastructure for C2 communication or failover. The rules identify specific 'eth_call' JSON-RPC method calls to Polygon smart contracts containing hardcoded indicators, as well as TLS connections to known public RPC providers used as fallback C2 infrastructure.
This rule detects outgoing HTTP POST requests that contain a ZIP file with a filename prefix of 'StolenData_' in the request body. This is a known behavior of the TokenGrabber stealer family, which exfiltrates collected victim data (e.g., browser credentials, session tokens) to a remote server, often via a Discord webhook or similar infrastructure.
Detects HTTP connections between internal hosts and suspected C2 infrastructure associated with the Operation SilkParasite campaign. The rule specifically monitors for connections to known malicious IPs and identifies the retrieval of a cloned RTX Corporation homepage content, which acts as a decoy for the SpiceRAT malware.
Detects outbound HTTP requests from endpoints to a known C2 infrastructure associated with mobile device spyware. The rule identifies two specific stages: polling for new commands using a GET request and posting command execution results using a POST request, both targeting an MDM-mimicking API structure.
Detects outbound HTTP requests from endpoints to a known C2 infrastructure associated with mobile device spyware. The rule identifies two specific stages: polling for new commands using a GET request and posting command execution results using a POST request, both targeting an MDM-mimicking API structure.
Detects cleartext HTTP POST requests to specific URI endpoints (/api/v1/devices/register or /api/v1/devices/heartbeat) known to be used by the Corp_MDM Android spyware for C2 communication, registration, or heartbeat signals.
Detects cleartext HTTP POST requests to specific URI endpoints (/api/v1/devices/register or /api/v1/devices/heartbeat) known to be used by the Corp_MDM Android spyware for C2 communication, registration, or heartbeat signals.
Detects an Android device registration attempt to a known malicious C2 IP address using parameters characteristic of a mobile device management (MDM) implant. The rule looks for a POST request to a specific registration endpoint containing device identifiers like deviceId, manufacturer, model, and osVersion.
Detects an Android device registration attempt to a known malicious C2 IP address using parameters characteristic of a mobile device management (MDM) implant. The rule looks for a POST request to a specific registration endpoint containing device identifiers like deviceId, manufacturer, model, and osVersion.
Detects an Android device registration attempt to a known malicious C2 IP address using parameters characteristic of a mobile device management (MDM) implant. The rule looks for a POST request to a specific registration endpoint containing device identifiers like deviceId, manufacturer, model, and osVersion.
Detects HTTP beaconing and command-and-control (C2) communication patterns consistent with the 'Corp_MDM' Android spyware, specifically heartbeat check-ins, command polling, and result reporting to a known malicious C2 IP address.
Detects HTTP beaconing and command-and-control (C2) communication patterns consistent with the 'Corp_MDM' Android spyware, specifically heartbeat check-ins, command polling, and result reporting to a known malicious C2 IP address.
Detects HTTP beaconing and command-and-control (C2) communication patterns consistent with the 'Corp_MDM' Android spyware, specifically heartbeat check-ins, command polling, and result reporting to a known malicious C2 IP address.
Detects HTTP beaconing and command-and-control (C2) communication patterns consistent with the 'Corp_MDM' Android spyware, specifically heartbeat check-ins, command polling, and result reporting to a known malicious C2 IP address.
Detects network activity related to the SectopRAT malware downloading a secondary module named 'WbElevation.dll' from a known command and control (C2) server. This module is typically associated with browser credential theft functionality.
Detects network activity related to the SectopRAT malware downloading a secondary module named 'WbElevation.dll' from a known command and control (C2) server. This module is typically associated with browser credential theft functionality.
Detects anomalous C2 traffic associated with SectopRAT that leverages JSON-RPC 'eth_call' methods on 'binance.org'. The detection monitors for a specific POST request pattern followed by a response containing 'START' and 'FINISH' markers within the result field, indicating command-and-control communication disguised as blockchain interactions.
Detects anomalous C2 traffic associated with SectopRAT that leverages JSON-RPC 'eth_call' methods on 'binance.org'. The detection monitors for a specific POST request pattern followed by a response containing 'START' and 'FINISH' markers within the result field, indicating command-and-control communication disguised as blockchain interactions.
Detects anomalous C2 traffic associated with SectopRAT that leverages JSON-RPC 'eth_call' methods on 'binance.org'. The detection monitors for a specific POST request pattern followed by a response containing 'START' and 'FINISH' markers within the result field, indicating command-and-control communication disguised as blockchain interactions.
Page 21 of 116