Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,431 detections
Filters
Last updated
All Time
Detection languages
2,428
3
Contributors
747
554
405
315
183
Categories
1,914
1,291
689
671
449
Platforms
2,202
183
149
62
49
Products / Services
2,366
1,378
38
37
25
MITRE Techniques
537
454
342
308
301
CVEs
17
10
9
9
9
IDS Classtypes
1,098
452
204
154
102
IDS Protocols
2,431
868
408
324
97
Detects outbound network traffic attempting to exfiltrate data to Slack or Telegram APIs using hardcoded bot tokens or channel identifiers associated with the 'indexed-btree' malware campaign.
Detects outbound HTTP POST requests to the Polygon blockchain using the 'eth_call' JSON-RPC method, specifically targeting a known smart contract address associated with EtherHiding-style C2 infrastructure. This behavior indicates an adversary utilizing decentralized blockchain storage or services as an unconventional command-and-control channel to resolve malicious configurations or payloads.
This rule detects outbound HTTP requests to the blogspot.com domain, which is often used by malware for command-and-control (C2) communication, staging, or as an initial check-in mechanism. Attackers frequently abuse legitimate blogging platforms to host malicious content and evade network-based detections that might otherwise flag unknown or suspicious domains.
Detects network traffic associated with NarwhalRAT malware utilizing the pCloud API as a command-and-control (C2) channel or dead-drop resolver. The rule monitors both HTTP requests containing specific folder identifiers and authentication parameters, as well as TLS SNI indicating connections to api.pcloud.com.
Detects repeated large HTTP PUT or POST requests (exceeding 5MB) from a internal host to external destinations. This pattern is indicative of potential bulk data exfiltration over web services.
Detects outbound network traffic associated with identified ClickFix CPaaS payload domains and associated API endpoints. The rule monitors for specific malicious domain contact (comicstar.lat, babybon.cfd, merkantalolol.asia) and the use of the '/api/index.php?a=init' endpoint, which is indicative of the ClickFix payload delivery mechanism.
Detects outbound HTTP requests to 'relay.php' containing a static authorization bearer token 'crpx0_c2_2026', which is associated with the command and control activity of the CRPx0 ransomware family.
Detects outbound HTTP POST requests directed towards Internet Computer Protocol (ICP) canister gateways (e.g., icp0.io, ic0.app) containing specific API path patterns (/api/v2/canister/) used for executing queries or calls. The rule specifically flags traffic lacking common browser-like User-Agent strings, which is a common indicator of automated command-and-control beacons using these services as proxy infrastructure.
This rule detects network communication associated with the AMOS (Atomic macOS) Stealer malware. Specifically, it identifies inbound HTTP GET requests directed at the '/api/shell/agent' URI, which is used by the stealer to retrieve instructions or trigger remote shell operations from its command and control (C2) server.
Detects the presence of injected bot-protection tracker scripts characteristic of the Macfinger (ClickFix) attack campaign within served HTML content. The rule identifies specific patterns including DNS prefetching directives, site tracking parameters, and a specific GAnalytics tracker JavaScript reference, indicating an attempt to facilitate social engineering or malicious user interaction.
Detects the presence of injected bot-protection tracker scripts characteristic of the Macfinger (ClickFix) attack campaign within served HTML content. The rule identifies specific patterns including DNS prefetching directives, site tracking parameters, and a specific GAnalytics tracker JavaScript reference, indicating an attempt to facilitate social engineering or malicious user interaction.
Detects network traffic associated with AMOS (Atomic macOS) Stealer malware, identifying C2 beaconing and tasking requests. The rules specifically monitor POST requests to '/api/t' with JSON payloads and GET requests to '/api/shell/agent' over non-standard ports (excluding 80 and 443).
Detects HTTP GET requests to external URIs matching a specific pattern (a 10-20 character hexadecimal path followed by ?force=1), which is characteristic of the delivery or staging mechanism used by MacStealer (Macfinger) and Atomic macOS Stealer (AMOS) malware families.
Detects network traffic associated with the 'ClickFix' technique, where malicious websites masquerade as legitimate CAPTCHA or bot-protection services to exfiltrate visitor telemetry via POST requests or fetch malicious script overlays.
This rule detects the two-stage network behavior of AMOS (Atomic macOS Stealer). First, it identifies the initial C2 registration beaconing to an '/api/t' endpoint. Subsequently, it monitors for an immediate follow-up TLS connection to 'ipinfo.io', which is commonly used by the malware for geolocation and victim system reconnaissance.
Detects the presence of injected 'ganalytics-tracker-js' script on compromised webpages and the subsequent browser-initiated requests for the malicious 't.js' script. This is associated with ClickFix attack campaigns where users are socially engineered into executing malicious code.
Detects HTTP POST requests to a /collect endpoint containing visitorId and stage parameters, which is characteristic of ClickFix-style fake bot-protection overlays used to trick users into executing malicious scripts under the guise of security verification.
This rule detects two-stage suspicious network activity: first, a POST request to a known Sauron Loader C2 endpoint ('/api/t'), and second, a subsequent TLS connection to 'ipinfo.io' used for geolocation. The correlation is achieved using flowbits to track the infection lifecycle.
Detects network beaconing activity associated with AMOS Stealer command-and-control communication. The rule identifies HTTP POST requests to the '/api/t' path with a JSON content type over port 8133, using a threshold to identify sustained communication patterns.
Detects outbound HTTP requests to a known domain associated with 'ClickFix' campaign activity. The rule identifies attempts to fetch a specific JavaScript tracker file, which is often used in social engineering campaigns to trick users into executing malicious commands in their shell or console.
Detects HTTP POST requests to '/api/credentials' over a non-standard port (8133) typical of AMOS (Atomic macOS Stealer) command and control traffic. The rule specifically looks for established network connections originating from the local network and targeting external hosts, flagging multiple occurrences within a 30-second window.
Page 25 of 116