Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,431 detections
Filters
Last updated
All Time
Detection languages
2,428
3
Contributors
747
554
405
315
183
Categories
1,914
1,291
689
671
449
Platforms
2,202
183
149
62
49
Products / Services
2,366
1,378
38
37
25
MITRE Techniques
537
454
342
308
301
CVEs
17
10
9
9
9
IDS Classtypes
1,098
452
204
154
102
IDS Protocols
2,431
868
408
324
97
This rule detects HTTP GET requests resulting in the download of an Android Package (.apk) file where the host is not a known official Google Play or reputable third-party application distribution source. It further validates the detection by inspecting the HTTP response headers for the specific Android application package MIME type and the response body for indicators commonly associated with fake branded application portals.
Detects the usage of s5cmd, a command-line tool for S3, to communicate with AWS S3 endpoints. This behavior is indicative of potential data exfiltration by an adversary using authorized cloud storage tools to move data out of the environment.
Detects HTTP POST requests directed at 'relay.php' containing a specific 'CrpxBoundary' in the request body and an 'Authorization' header with the value 'Bearer crpx0_c2_2026'. This pattern is indicative of the CRPx0 malware exfiltrating data in chunks over an established C2 channel.
Detects HTTP beaconing activity associated with the Kimsuky threat group (Stella_Gary), specifically identifying requests to the /unicorn/ path. This pattern is characteristic of their C2 communication mechanism, which masquerades as legitimate browsing.
Detects HTTP GET requests characteristic of SilverFox malware final-stage payload delivery. The rule monitors for requests to known C2 domains or domains using a specific naming pattern (www.[5-10 chars].com) with specific URI paths (down, load, or insdw followed by 2-4 digits), indicating the retrieval of a malicious payload.
Detects network activity associated with the SilverFox relay dispatcher, including specific cache-busting URI patterns, C2 infrastructure hosted on Cloudflare Workers, and the delivery of decoy WeChat installer links.
Detects network activity associated with the SilverFox malware, specifically targeting the discovery of relay endpoints via specific URI patterns containing cache-busting timestamps, DNS lookups for identified relay domains (noah-ssh.com.cn) and Cloudflare Workers subdomains, and suspicious HTTP response characteristics such as specific cache headers paired with wildcard CORS headers.
Detects network activity associated with the 'SilverFox' malware family's command-and-control relay dispatcher. The rules identify specific HTTP requests to 'api.php', responses containing 'download_link', and the serving of legitimate WeChat installer payloads as a fallback mechanism for evasion, including the use of cache-busting parameters.
This rule detects HTTP requests to the Microsoft device login endpoint (/devicelogin) that originate from a non-Microsoft referrer domain. This behavior is highly indicative of Adversary-in-the-Middle (AiTM) phishing attacks targeting OAuth device code flows, where a malicious proxy site redirects users to the legitimate Microsoft login page while attempting to capture session tokens.
Detects anomalous POST requests containing SharePoint 'MSOTlPn_' ToolPane markup directed at pages other than the expected 'ToolPane.aspx'. This pattern is characteristic of attempts to exploit the SPUtility.EnsureAuthentication bypass vulnerability, allowing attackers to access or execute operations on SharePoint pages without proper authentication.
Detects network indicators associated with the Exvicy ClickFix campaign, including HTTP callbacks to embed endpoints, DNS queries for the 'cloudflare-check.net' domain, direct connections to the identified C2 IP address (94.26.90.126), and HTTP responses containing fake 'Security Check' iframe content.
Detects malicious HTML pages commonly used in ClickFix-style phishing campaigns that intercept keyboard events (specifically blocking devtools and view-source shortcuts) and display fraudulent verification prompts to lure users into executing malicious actions.
Detects HTTP POST exfiltration patterns characteristic of the RevStealer malware. The rule identifies suspicious POST requests to a /cdn/ URI path with specific internal file naming, utilizing a spoofed Chrome 147 User-Agent and specific header indicators (_fbp, _sid).
This rule detects HTTP GET requests containing specific URI parameters (OKey, Who, Areyou=cake) indicative of communication patterns associated with the Konni and VelvetCake malware families during exfiltration or command-and-control operations.
Detects HTTP POST requests to gapidriver.com/api/rest.php containing stager-specific status messages like 'build started', 'launch error', or 'all builds loaded', indicating NeedleStealer malware command-and-control activity.
Detects HTTP traffic from internal hosts to the 'gapidriver.com' domain, specifically identifying the GapiUpdate stager behavior. The rule looks for authenticated GET requests to '/api/get.php' using a specific Bearer token and User-Agent, as well as status reporting to '/api/rest.php'.
Detects an attempt to exploit CVE-2026-24858 in FortiCloud SSO by sending a crafted SAML authentication request that lacks a signature. This vulnerability allows an attacker to bypass authentication by providing an unsigned SAML response.
This rule detects network traffic indicative of N0va Phishkit verification or session initialization. It looks for specific GET request URI parameters (/api/verification/init?session=, flow=, prompt_profile=) that align with the initial handshake phase of this phishing kit, which is often used for credential and session cookie theft.
Detects successful exploitation attempts targeting Vite development servers via chained access-control bypass vulnerabilities (CVE-2025-30208, CVE-2025-31125, CVE-2024-45811). The rule identifies malicious GET requests using the /@fs/ endpoint with specific query parameters, resulting in a successful HTTP 200 response, while originating from non-internal IP addresses.
This rule detects potential command and control (C2) communication related to the GhostContainer malware. It inspects HTTP POST requests directed at Microsoft Outlook Web Access (OWA) paths containing a suspicious 'x-owa-urlpostdata' header. The presence of this specific header, followed by a base64-encoded string of significant length, indicates an attempt to deliver C2 commands or exfiltrate data through OWA infrastructure.
This rule detects potential command and control (C2) communication related to the GhostContainer malware. It inspects HTTP POST requests directed at Microsoft Outlook Web Access (OWA) paths containing a suspicious 'x-owa-urlpostdata' header. The presence of this specific header, followed by a base64-encoded string of significant length, indicates an attempt to deliver C2 commands or exfiltrate data through OWA infrastructure.
Page 34 of 116