Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,431 detections
Filters
Last updated
All Time
Detection languages
2,428
3
Contributors
747
554
405
315
183
Categories
1,914
1,291
689
671
449
Platforms
2,202
183
149
62
49
Products / Services
2,366
1,378
38
37
25
MITRE Techniques
537
454
342
308
301
CVEs
17
10
9
9
9
IDS Classtypes
1,098
452
204
154
102
IDS Protocols
2,431
868
408
324
97
Detects HTTP GET requests to a specific URL path containing an image file, which is associated with the delivery of the LausivLoader malware. The rule monitors for external connections to the domain 'yapw.life' requesting a PNG file, a technique often used for steganographic payload delivery.
Detects HTTP traffic to the Telegram Bot API (/sendPhoto) originating from internal network hosts, which is indicative of potential exfiltration of captured images (e.g., screenshots or webcam captures) to an adversary-controlled Telegram channel.
Detects HTTP responses containing content that clones the RTX Corporation homepage, often associated with SilkParasite C2 infrastructure. The rule flags matches based on embedded text in the HTTP body combined with specific nginx server header fingerprints.
Detects network activity related to 'ClickFix' social engineering campaigns. The rules monitor for DNS queries, TLS SNI requests, and HTTP requests to the malicious domain 'cdnsuicaches.com' used for hosting malicious scripts, as well as the identification of the 'cookie-captcha-complete' string in HTTP traffic, which is a known indicator of a ClickFix social engineering overlay.
Detects outbound HTTP POST requests to the Telegram Bot API (/sendPhoto) that contain sensitive system information, including host credentials (port, login, password) and Shodan host data. This behavior is indicative of an information-stealing malware attempting to exfiltrate captured credentials via a Telegram bot.
Detects incoming HTTP requests to the WSO2 admin API endpoint that utilize a JSON Web Token (JWT) with the 'alg=none' algorithm, indicating an attempt to bypass authentication via JWT token forgery (CVE-2026-5430).
Detects attempts to exploit a vulnerability in WSO2 API Manager and Traffic Manager that allows for authentication bypass by utilizing a malformed JWT with the 'alg=none' header. Attackers can leverage this to impersonate users or bypass security controls by providing a crafted Bearer token in the Authorization header.
Detects HTTP traffic proxying Microsoft authentication paths (OAuth 2.0 authorization or CDN assets) via non-Microsoft domains. This behavior is indicative of an Adversary-in-the-Middle (AiTM) phishing attack using typosquatted infrastructure to intercept user sessions.
This rule detects network traffic indicative of an Adversary-in-the-Middle (AiTM) phishing attack targeting Microsoft 365. The rule identifies HTTP response bodies containing 'login.microsoftonline.com' and 'Enter Password' being served from a web server identified as 'openresty'. This configuration is common for phishing kits that proxy traffic between the victim and the legitimate service to harvest credentials and session cookies.
Detection rules designed to identify various stages of an Adversary-in-the-Middle (AiTM) phishing campaign, including malicious redirect chains (e.g., Google Meet/Ads redirects, AWS S3-hosted assets) and common lure patterns in SMTP traffic referencing voicemail portals.
Detects the abuse of the Google Meet 'linkredirect' service to facilitate phishing attacks, commonly used to bypass security filters and redirect users to Adversary-in-the-Middle (AiTM) phishing landing pages.
Detects outbound HTTP requests to api.telegram.org containing 'sendMessage' patterns in the URI and suspicious query parameters like 'VIEW' or 'MOBILE'. This behavior is characteristic of malicious scripts or applications using the Telegram Bot API as a command-and-control (C2) or exfiltration channel.
Detects network activity associated with the GhostCode phishing kit, specifically communication with its geolocation harvester API, DNS lookups for the FlashProxy.io residential proxy service used for geolocation evasion, and identification of the proxy_ip in HTTP responses.
Detects network traffic consistent with the download of XMRig cryptocurrency miner release tarballs from GitHub, typically used in malicious deployment scenarios including automated cron-triggered installations.
Detects outbound HTTP GET requests containing a specific '/ping' URI pattern and 'h=' query string parameter, characteristic of Redis-based cryptomining botnet C2 heartbeat check-ins.
Detects a multi-stage phishing redirect chain used in 'EvilTokens' attacks. The rule identifies communication with common serverless hosting platforms (Vercel, Cloudflare Workers, AWS Lambda/Execute-API) followed by interaction with anti-bot/CAPTCHA gates (Cloudflare Turnstile, hCaptcha, Google reCAPTCHA) and finally reaching known Microsoft device code phishing endpoints (/devicelogin or /common/oauth2/deviceauth).
Detects a multi-stage phishing redirect chain used in 'EvilTokens' attacks. The rule identifies communication with common serverless hosting platforms (Vercel, Cloudflare Workers, AWS Lambda/Execute-API) followed by interaction with anti-bot/CAPTCHA gates (Cloudflare Turnstile, hCaptcha, Google reCAPTCHA) and finally reaching known Microsoft device code phishing endpoints (/devicelogin or /common/oauth2/deviceauth).
Detects a multi-stage phishing redirect chain used in 'EvilTokens' attacks. The rule identifies communication with common serverless hosting platforms (Vercel, Cloudflare Workers, AWS Lambda/Execute-API) followed by interaction with anti-bot/CAPTCHA gates (Cloudflare Turnstile, hCaptcha, Google reCAPTCHA) and finally reaching known Microsoft device code phishing endpoints (/devicelogin or /common/oauth2/deviceauth).
Detects HTTP POST requests to the specific '/api/node/register' URI, which is associated with the RatHat RAT command and control (C2) node registration behavior.
Detects network communication to Telegram API (api.telegram.org) indicative of HEAVYGRAM malware command and control (C2) beaconing. The rule specifically looks for HTTP POST requests to the /sendMessage endpoint containing a chat ID and the hardcoded 'is online' message string, which is characteristic of this implant's check-in behavior.
Detects outbound HTTP GET requests to a specific C2 domain 'luizestrelhashapr.online' masquerading as CSS file fetches. The request pattern uses a specific path '/google_api/' followed by predefined alphanumeric filenames, consistent with the KREMLIN malware browser extension's C2 polling mechanism.
Page 33 of 116