Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,989 detections
Filters
Last updated
All Time
Detection languages
1,774
868
397
195
188
Contributors
1,070
924
756
221
96
Categories
2,448
1,307
1,164
785
713
Platforms
2,415
1,310
658
528
133
Products / Services
1,307
886
808
561
337
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
3,989
CVEs
6
5
5
5
5
IDS Classtypes
564
275
11
8
6
IDS Protocols
537
174
64
64
12
Detects suspicious network activity where processes like wscript.exe or rundll32.exe initiate HTTPS (port 443) connections directly to raw IP addresses, bypassing DNS. This behavior is often associated with malware like SocGholish for rapid command and control check-ins.
Detects HTTPS POST requests to known attacker-controlled infrastructure associated with the BadBlocker campaign (e.g., Unistream SDK, adblock-for-youtube domains). These requests often originate from browser extensions via injected scripts, facilitating the potential exfiltration of sensitive browser session data or credentials.
Detects the 'Adblock for YouTube' browser extension (cmedhionkhpnakcndndgjdbohmhepckk) initiating network connections to api.adblock-for-youtube.com to fetch scriptlets. This behavior is associated with bypassing URL validation to enable script injection on non-YouTube domains.
Detects anomalous WebSocket connections that transmit DOM serialization data using the rrweb library. This activity is indicative of a Browser-in-the-Middle (BitM) phishing framework, where an attacker records and relays a live, authenticated browser session from a victim to an adversary-controlled server.
Detects behavior indicative of Bluekit Browser-in-the-Middle (AiTM) phishing, where a client system fetches the rrweb DOM-serialization library followed by the establishment of a WebSocket connection within a 5-minute window. This sequence is consistent with live session recording or interactive DOM streaming from an attacker-controlled infrastructure.
Detects behavior indicative of the 'Adblock for YouTube' browser extension (or associated malicious variants) fetching rule configuration files from 'api.adblock-for-youtube.com', followed by suspicious outbound network traffic to non-Google/YouTube domains. This pattern suggests the extension is performing unauthorized data exfiltration, such as harvesting session cookies or credentials via injected scripts.
Detects outbound network connections or DNS lookups to domains associated with the Bluekit Phishing-as-a-Service (PhaaS) platform. This activity often indicates communication with decentralized peer-to-peer phishing infrastructure or Command and Control (C2) domains utilized for phishing campaigns.
Identifies outbound traffic to specific task dispatch endpoints.
Outbound network connections from a sideloaded process context to Alibaba Cloud IPs.
Detects credential and session data exfiltration by browsers communicating with Bluekit PhaaS-associated domains or Telegram API webhooks. The rule filters network traffic originating from common web browsers to known malicious domains associated with Bluekit infrastructure or to the public Telegram API for automated exfiltration.
Detects HTTP requests initiated by common browser adblock extensions to remote API endpoints for retrieving rule configuration files. This behavior can be exploited by adversaries to perform remote scriptlet injection or change extension behavior via server-side updates, potentially enabling unauthorized JavaScript execution in the browser's context.
Detects the execution of a malicious npm package (scope squatting on @withgoogle/stitch-sdk) that runs a preinstall script designed to harvest sensitive credentials (Claude, Git, SSH, GitHub, npm, Docker) and exfiltrate them to the domain 'stitch-production.org'.
This rule detects network activity associated with known malicious browser extensions identified as 'AdBlock' variants. It monitors for connections to the domain 'api.adblock-for-youtube.com' or requests to '/api/v2/rules' made by specific extension IDs that are known to perform unauthorized or suspicious activities.
Detects explorer.exe making DNS requests to Discord or Telegram, which is anomalous and indicates potential process injection for data exfiltration. This behavior is associated with information stealer malware like Phantom Stealer.
Detects the installation of known-malicious browser extensions followed by network communication from the browser process to associated Command and Control (C2) domains within a one-hour window. This behavior is indicative of malicious browser-based activity such as ad-fraud or credential theft.
Detects browser processes exhibiting a pattern consistent with 'Browser-in-the-Middle' attacks, specifically the streaming of DOM content (e.g., using rrweb) over persistent WebSocket connections to external IP addresses. The rule identifies high-density connection events to the same remote IP on port 443 lasting for more than 120 seconds and correlates these events with a preceding phishing email click on the same device.
This rule monitors network device telemetry for three distinct indicators of compromise: usage of specific botnet-associated User-Agent strings, high-volume automated scanning against known IoT-vulnerable ports (80, 8080, 7547, 52869, 37215), and outbound network connections to known RondoDox command and control server infrastructure.
This rule detects suspicious network connections, process activity, and file events related to Node.js or systemd-userdbd, potentially indicating C2 communication or the presence of malicious tools. Specifically, it looks for outbound TCP connections to port 4444, process command lines containing shell commands or 'node-pty', and file paths/names associated with 'apintergrationpost' or 'node-pty'.
Detects unexpected shell or suspicious utility execution as a child process of media processing or machine learning pipeline services (e.g., ffmpeg, ffprobe, Jellyfin, Nextcloud, Immich, PhotoPrism, vLLM). This behavior can indicate exploitation of vulnerabilities like CVE-2026-8461 (PixelSmash) or other forms of arbitrary code execution, especially when combined with reverse shell indicators or execution by service accounts.
Identifies Havoc Demon payloads beaconing to anomalous, predictable HTTP/HTTPS URIs used by default Havoc profiles (e.g., /weather, /api/v1). The detection specifically looks for HTTP connections originating from processes located in the 'Downloads' folder.
Detects processes containing sensitive credential-related keywords (cookies, creds, password, token) in their command lines followed by a network connection to known suspicious remote IP addresses within a 60-minute window, suggesting potential credential exfiltration.
Page 144 of 190