Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
301 detections
Filters
Last updated
All Time
Detection languages
119
80
68
11
9
Contributors
87
39
27
26
22
Categories
136
107
105
84
44
Platforms
133
127
29
28
16
Products / Services
113
105
39
30
24
MITRE Techniques
18,116
15,638
12,587
8,397
6,227
CVEs
2
2
2
1
1
IDS Classtypes
78
36
3
1
1
IDS Protocols
74
30
11
2
Detects two-stage phishing activity involving an initial visit to a Vercel-hosted lure page followed by the exfiltration or relay of fingerprinting and sandbox-evasion results to api.telegram.org.
Detects the deployment and operational artifacts associated with the Hermes Agent framework using the CARBONATO GH0ST persona on Linux systems. This detection focuses on identifying specific file-system indicators, including persona configuration files (SOUL.md), loot staging directories, and deployment entry scripts (entry.sh or CARBONATO_API_KEY artifacts) that indicate malicious activity and potential AI-driven Telegram command and control (C2) staging.
Detects network connections from server or workload identities (excluding SYSTEM) to known public Generative-AI inference API domains. This may indicate the use of AI services for data exfiltration, automated content generation, or C2 communication via legitimate web services.
Detects network activity (DNS, TLS, HTTP) associated with suspected C2 infrastructure hosted on Cloudflare Workers, specifically identifying patterns consistent with trojanized authentication pages acting as browser-based C2 relays or WebRTC/WebSocket signaling channels.
Detects outbound HTTP POST requests to known blockchain RPC endpoints (bsc-dataseed and rpc.ankr.com) that utilize the 'eth_call' method. This behavior is associated with the ClearFake malware strain using the EtherHiding technique, where malicious scripts or payloads are hidden or retrieved via blockchain smart contracts.
Detects network activity associated with ngrok tunnel domains or suspicious lookalike Microsoft SSO domains (microsoft-sso.com) attempting to perform OIDC discovery, JWKS retrieval, or MFA-related EAM endpoint interactions. This behavior is indicative of adversary-in-the-middle (AiTM) attacks targeting authentication processes.
Detects instances where the Firefox browser or its plugin container process initiates a DNS query for domains containing 'pdf.gusercontent.com', which is a known lookalike pattern used to masquerade as legitimate Google infrastructure for potential command and control or data exfiltration activities.
Detects HTTP beaconing and command-and-control (C2) communication patterns associated with the Exvicy malware family. This includes heartbeat polling, victim fingerprinting registration, and CAPTCHA handling over HTTP GET and POST requests to the '/api.php' endpoint.
Detects an abnormally high frequency of tool/function invocations by an AI agent within a one-minute timeframe. This pattern is indicative of a potential hijack where an attacker forces the agent into a runaway loop to perform resource exhaustion (DoS), repetitive brute-force operations, or automated exfiltration of sensitive data via manipulated tool execution.
Detects network indicators and session patterns associated with the JWR Phishing Framework, specifically targeting its WebSocket-based command and control (C2) communication, client engine (main.js/ws-worker.js) retrieval, and unique session token (JWRCVV) usage.
Detects network connections to the Slack API (api.slack.com) initiated by processes executing from temporary directories commonly used by the Go build system ('go-build'). This pattern is indicative of a second-stage RAT or malicious payload compiled on-the-fly using 'go run' or similar mechanisms, utilizing Slack's infrastructure for C2 communication.
Detects non-browser and non-approved application processes establishing outbound network connections to known public LLM/AI API endpoints, such as OpenAI or Azure OpenAI services. This behavior is indicative of potential command-and-control (C2) activity where an attacker abuses legitimate AI APIs as a bidirectional communication channel to poll for instructions.
Detects network communication associated with the CARBONATO Hermes Agent, including direct C2 beaconing to a hardcoded IP on port 8989 and TLS connections to Vercel-hosted proxy infrastructure identifying as 'carbonato-proxy'.
Detects network activity associated with the RatHat Android malware, specifically the exfiltration of accessibility tree data and calls to Google's Generative Language API (gemini-2.5-flash-lite) for UI target resolution and automation.
Detects HTTP traffic patterns associated with a custom 'RatHat' malware variant utilizing Google's Gemini API for command and control or remote automation. The rule identifies the initial POST request to the API with specific generation parameters (temperature 0.1, 256 tokens) and the corresponding JSON-formatted coordinate response from the server.
Detects high-volume, broad enumeration of sensitive Microsoft Graph API endpoints (users, groups, directory objects, applications, and mail folders) from a single host or user. This behavior is indicative of automated reconnaissance or post-compromise discovery of cloud identity environments.
Detects anomalous GitLab CI pipeline execution that matches patterns associated with GitRunner C2 abuse. The detection identifies pipelines triggered via API (CI_PIPELINE_SOURCE=api) with cloning disabled (GIT_STRATEGY=none) and a specific static job name (run_command), which can indicate the CI runner is being abused as a command-and-control channel for arbitrary script execution.
Detects HTTP POST requests to a known suspicious endpoint ('/board.php') often used by the Chinotto Python backdoor. The rule monitors for outgoing web traffic containing 'data=' parameters or connections to known malicious domains, indicating potential exfiltration of base64-encoded command output.
Detects network traffic (HTTP, TLS, and DNS) originating from the internal network directed toward Telegram's API endpoints (api.telegram.org) and domains (t.me). This behavior is often associated with the use of the Telegram Bot API as a command-and-control (C2) channel or for data exfiltration by malware.
Detects network traffic (HTTP, TLS, and DNS) originating from the internal network directed toward Telegram's API endpoints (api.telegram.org) and domains (t.me). This behavior is often associated with the use of the Telegram Bot API as a command-and-control (C2) channel or for data exfiltration by malware.
Detects HTTP and TLS traffic patterns indicative of data exfiltration to Slack, specifically targeting hardcoded Slack API tokens, Slack channel IDs in HTTP request bodies, or traffic directed to hooks.slack.com, commonly associated with malicious npm packages.
Page 2 of 15