Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,431 detections
Filters
Last updated
All Time
Detection languages
2,428
3
Contributors
747
554
405
315
183
Categories
1,914
1,291
689
671
449
Platforms
2,202
183
149
62
49
Products / Services
2,366
1,378
38
37
25
MITRE Techniques
537
454
342
308
301
CVEs
17
10
9
9
9
IDS Classtypes
1,098
452
204
154
102
IDS Protocols
2,431
868
408
324
97
Detects HTTP POST requests to '/api/credentials' over a non-standard port (8133) typical of AMOS (Atomic macOS Stealer) command and control traffic. The rule specifically looks for established network connections originating from the local network and targeting external hosts, flagging multiple occurrences within a 30-second window.
This rule detects outgoing HTTP POST requests to the 'velvet-otter-glagceis.life' domain path '/collect'. The request body contains indicators of victim fingerprinting, specifically looking for 'visitorId' and 'events' fields, characteristic of the Macfinger/ClickFix campaign used for gathering visitor telemetry for malicious purposes.
Detects network activity associated with the AMOS (Atomic macOS Stealer) malware, specifically identifying C2 registration/heartbeat beacons and tasking retrieval requests to known C2 URI paths over port 8133.
Detects network traffic consistent with AMOS Stealer command-and-control (C2) activity, specifically HTTP POST requests to the path '/api/t' on non-standard TCP port 8133. The rule includes a threshold to mitigate noise from single connections.
Detects HTTP POST requests to '/api/credentials' which is indicative of the AMOS (Atomic macOS) Stealer malware exfiltrating stolen credentials. The rule uses a threshold to identify multiple exfiltration attempts from the same source within a short time window.
Detects HTTP POST requests to '/api/credentials' which is indicative of the AMOS (Atomic macOS) Stealer malware exfiltrating stolen credentials. The rule uses a threshold to identify multiple exfiltration attempts from the same source within a short time window.
Detects network activity associated with the AMOS (Atomic Stealer) malware, specifically identifying C2 registration, heartbeats, or credential exfiltration attempts over the non-standard port 8133 using HTTP patterns matching its known API endpoints.
Detects outbound HTTP POST requests characteristic of the Sauron Loader malware, utilizing a specific, randomized URI path structure and a known malicious User-Agent string to establish C2 communication.
Detects outbound HTTP POST requests characteristic of the Sauron Loader malware, utilizing a specific, randomized URI path structure and a known malicious User-Agent string to establish C2 communication.
Detects network activity associated with the SloppyRAT malware, specifically identifying C2 authentication attempts via HTTP POST requests containing specific headers and user-agent strings, as well as TLS connections to known malicious domains and IP addresses.
Detects periodic outbound HTTP POST requests consistent with C2 beaconing behavior associated with the Latrodectus malware. The rule identifies multiple POST requests occurring within a 10-minute window, a pattern often used by Latrodectus for command-and-control heartbeats.
Detects command-and-control (C2) communication patterns associated with the Graphalgo framework, which utilizes the Arbitrum Sepolia blockchain for dead-drop resolution and task orchestration. The rules monitor for specific JSON-RPC method calls ('eth_call', 'setCPubKey') and repeated polling of contract functions ('serviceData') characteristic of this threat actor's network behavior.
Detects network traffic to GitHub API endpoints that matches patterns indicative of RUSTYSHADE malware communicating with a private repository for command and control. The rule specifically looks for access to repository content paths related to commands, results, heartbeats, screenshots, or information files, coupled with the inclusion of an Authorization token in the HTTP header.
Detects anomalous HTTP POST requests to a suspected C2 endpoint ('/beacon/pre-register') on a typosquatted domain ('thecovnresation') characterized by an application/octet-stream content type, which is indicative of encrypted C2 beacon registration activity.
Detects anomalous HTTP POST requests to a suspected C2 endpoint ('/beacon/pre-register') on a typosquatted domain ('thecovnresation') characterized by an application/octet-stream content type, which is indicative of encrypted C2 beacon registration activity.
Detects anomalous HTTP POST requests to a suspected C2 endpoint ('/beacon/pre-register') on a typosquatted domain ('thecovnresation') characterized by an application/octet-stream content type, which is indicative of encrypted C2 beacon registration activity.
Detects HTTP POST requests directed to the URI path '/api/credentials' over the non-standard TCP port 8133, which is indicative of AMOS (Atomic macOS) Stealer exfiltrating stolen credentials to a C2 server.
Detects network activity associated with the AMOS (Atomic macOS Stealer) malware, specifically identifying C2 communication patterns such as heartbeat beacons and agent tasking requests occurring over non-standard port 8133.
Detects network activity associated with the AMOS (Atomic macOS Stealer) malware, specifically identifying C2 communication patterns such as heartbeat beacons and agent tasking requests occurring over non-standard port 8133.
Detects network activity associated with the AMOS (Atomic macOS Stealer) malware, specifically identifying C2 communication patterns such as heartbeat beacons and agent tasking requests occurring over non-standard port 8133.
Detects network activity associated with the 'ClickFix' social engineering campaign, specifically targeting the 'Macfinger' variant. This involves detecting the fetching of obfuscated tracker JavaScripts (t.js), the delivery of deceptive 'Bot Protection' overlay HTML prompts used to trick users into executing malicious code, and network connections to known C2 infrastructure.
Page 26 of 116