Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,431 detections
Filters
Last updated
All Time
Detection languages
2,428
3
Contributors
747
554
405
315
183
Categories
1,914
1,291
689
671
449
Platforms
2,202
183
149
62
49
Products / Services
2,366
1,378
38
37
25
MITRE Techniques
537
454
342
308
301
CVEs
17
10
9
9
9
IDS Classtypes
1,098
452
204
154
102
IDS Protocols
2,431
868
408
324
97
Detects network activity associated with the 'ClickFix' social engineering campaign, specifically targeting the 'Macfinger' variant. This involves detecting the fetching of obfuscated tracker JavaScripts (t.js), the delivery of deceptive 'Bot Protection' overlay HTML prompts used to trick users into executing malicious code, and network connections to known C2 infrastructure.
This rule detects network traffic originating from the RatHat Android malware, specifically identifying the 'SCROLL_DOWN' command in HTTP response bodies. This suggests the malware is receiving instructions from a C2 server to perform UI automation or interaction tasks.
Detects outbound network activity associated with the ChainScript malware family, including WebSocket C2 communication identified by a specific 'X-Agent-Token' header and TLS connections to known rotating command-and-control domains.
Detects the initialization sequence of the ORAX command-and-control framework, characterized by a handoff via a spoofed Cloudflare verification page followed by a WebSocket upgrade request.
This rule detects an HTTP GET request for 'static/js/main.js', a specific URI path associated with the JWR phishing framework's client-side engine. This indicates an interaction with a phishing infrastructure hosting malicious redirection or credential harvesting scripts.
This rule set detects network communication patterns associated with the AnonyMousKIT phishing kit, specifically targeting the exfiltration of captured user credentials to the Telegram Bot API and communication with known phishing panel infrastructure. It monitors for DNS lookups of 'anomkit.shop', established TCP connections to the associated backend relay, and HTTP requests containing specific credential-related keywords directed towards the Telegram API.
Detects network activity associated with the JWR Phishing-as-a-Service (PhaaS) platform. This includes the retrieval of the client-side JavaScript engine (main.js) from lookalike domains related to courier or government services, and subsequent client-side detection of the 'window.__HOST_MODE' flag, which indicates the browser has been primed for a specific phishing scenario.
These rules detect behavioral patterns associated with GhostCode-style anti-analysis, including URI-based gate redirection (turnstile checks), automated client filtering (User-Agent scanning), and UI-based spoofing (tab title masquerading) often used to protect malicious infrastructure from automated analysis tools and bots.
Detects HTTP GET requests to a specific path structure /scanna/ which includes a token-like identifier and a check=1 parameter. This pattern is indicative of a bot-filtering relay mechanism often used by malicious scripts or malware to validate or redirect traffic while attempting to evade security scanners.
Detects network activity associated with the 'RatHat' Android malware, specifically identifying attempts to retrieve tunnel configuration, deployment confirmation, and the initial reverse tunnel handshake using the fatedier/frp (Fast Reverse Proxy) tool.
This rule detects network activity associated with the NovaCookies Adversary-in-the-Middle (AiTM) phishing framework, specifically looking for traffic to domains with a .vu TLD, matching a specific URI pattern used for phishing lures in HTTP requests/responses, and related DNS queries.
This rule detects anomalous OAuth authorization requests to Microsoft and Google services where the 'redirect_uri' parameter points to suspicious external domains (specifically ending in .vu) or, in the case of silent Microsoft OAuth requests, points to domains outside of recognized Microsoft/Office 365 infrastructure. Such abuse is often indicative of OAuth consent phishing campaigns designed to steal application access tokens.
Detects network activity associated with Mirage2FA Adversary-in-the-Middle (AiTM) phishing infrastructure. The rules monitor for HTTP responses containing specific spoofed Microsoft 365 sign-in page content, DNS resolutions for known proxy-associated domain suffixes, and client requests fetching malicious loader scripts from suspected AiTM hosting infrastructure.
Detects network traffic associated with Mirage2FA Phishing-as-a-Service (PhaaS), including HTTP requests to specific URI patterns characteristic of their backend loader and DNS queries to known malicious domain families (cheecker.store and volatilesour.store), as well as direct TCP connections to identified hosting infrastructure.
This rule detects potential Adversary-in-the-Middle (AiTM) phishing kit exfiltration behavior. It correlates the initial victim geolocation lookup via 'api.ipgeolocation.io' with subsequent data exfiltration to the Telegram Bot API ('api.telegram.org') originating from the same host, indicating an automated sequence where victim context is gathered and then exfiltrated by the phishing kit.
This rule detects a two-stage network redirect sequence indicative of an Adversary-in-the-Middle (AiTM) phishing campaign. The first stage identifies traffic interacting with a Google Ads click-tracker, and the second stage identifies a subsequent request to an AWS S3 bucket, often used to host malicious landing pages or phishing proxies.
This rule set detects multi-stage network patterns indicative of AiTM phishing campaigns. It identifies common redirection techniques, including lookalike domains hosting Microsoft OAuth authorize URLs, DNS resolution of Google ad-tech infrastructure followed by novel domains, malicious use of Google Meet and Google Ads click-tracking endpoints as phishing hops, and references to AWS S3-hosted intermediate landing pages.
Detects network traffic indicating a potential adversary-in-the-middle (AiTM) phishing proxy attempting to relay authentication requests to the legitimate Microsoft login service. The rule triggers when an external host acts as a reverse proxy for login.microsoftonline.com endpoints without being the legitimate Microsoft service itself.
Detects network activity associated with Adversary-in-the-Middle (AiTM) phishing kits. This includes detection of kit-specific fingerprinting scripts (class_identifier.php), use of specific server banners (openresty), unauthenticated geolocation lookups (api.country.is), setting of geolocation cookies, and proxying of requests to Microsoft OAuth endpoints.
Detects communication patterns associated with the OnyxC2 malware, including host-fingerprint synchronization over HTTP, potential reverse SOCKS5 proxy tunnel initialization, and inbound HTTP responses containing command tasking such as cmd.exe.
Detects unauthorized attempts to access the Marimo Notebook terminal via a WebSocket connection, indicative of an exploit attempt targeting CVE-2026-39987.
Page 27 of 116