Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
6,537 detections
Filters
Last updated
All Time
Detection languages
3,970
998
598
428
233
Contributors
1,363
1,250
1,066
954
384
Categories
2,933
2,196
2,017
1,857
1,411
Platforms
39,936
7,266
6,537
3,866
3,647
Products / Services
4,107
2,418
1,587
270
254
MITRE Techniques
1,450
1,310
1,022
934
696
CVEs
46
46
33
18
12
IDS Classtypes
1,753
458
404
325
220
IDS Protocols
2,202
773
381
300
93
Detects the handshake process for Blackwood/Chisel reverse SOCKS5 or TCP-over-HTTP tunneling to a known malicious Iranian-hosted C2 IP address. The detection matches specific HTTP headers used by the Chisel tool during its initialization phase.
Detects the handshake process for Blackwood/Chisel reverse SOCKS5 or TCP-over-HTTP tunneling to a known malicious Iranian-hosted C2 IP address. The detection matches specific HTTP headers used by the Chisel tool during its initialization phase.
Detects a network connection handshake indicating the use of Chisel, a fast TCP/UDP tunnel over HTTP, specifically identifying potential command-and-control beaconing activity.
Detects network activity related to the 'Blinder Tunnel' C2 infrastructure. The rules identify a Chisel tunnel client initiating a WebSocket handshake (identifiable by the 'chisel-v3-channel' header) to external infrastructure and a DNS lookup for a specific domain (soroshpasargad.com) identified as a relay nameserver used by the threat actor CL-STA-1178.
Detects network activity related to the 'Blinder Tunnel' C2 infrastructure. The rules identify a Chisel tunnel client initiating a WebSocket handshake (identifiable by the 'chisel-v3-channel' header) to external infrastructure and a DNS lookup for a specific domain (soroshpasargad.com) identified as a relay nameserver used by the threat actor CL-STA-1178.
Detects network activity related to the 'Blinder Tunnel' C2 infrastructure. The rules identify a Chisel tunnel client initiating a WebSocket handshake (identifiable by the 'chisel-v3-channel' header) to external infrastructure and a DNS lookup for a specific domain (soroshpasargad.com) identified as a relay nameserver used by the threat actor CL-STA-1178.
Detects network activity (DNS queries, HTTP Host headers, and TLS SNI) directed towards the known Blinder Tunnel staging domain 'asdfafadafg.online'. This behavior is indicative of command-and-control (C2) communication or initial staging of malicious payloads.
Detects network activity (DNS queries, HTTP Host headers, and TLS SNI) directed towards the known Blinder Tunnel staging domain 'asdfafadafg.online'. This behavior is indicative of command-and-control (C2) communication or initial staging of malicious payloads.
Detects network activity (DNS queries, HTTP Host headers, and TLS SNI) directed towards the known Blinder Tunnel staging domain 'asdfafadafg.online'. This behavior is indicative of command-and-control (C2) communication or initial staging of malicious payloads.
This rule detects outbound network connections directed at a known IP address associated with Akira ransomware infrastructure. The rule specifically monitors for communication with 64.227.4.134, which has been identified as a C2 node utilizing GOST tunnels. This behavior is indicative of established C2 connectivity by Akira ransomware actors.
Detects SQL injection exploitation attempts against MOVEit Transfer targeting the CVE-2023-34362 vulnerability, followed by the deployment and subsequent interaction with the 'human2.aspx' webshell associated with Cl0p ransomware mass-exploitation campaigns.
Detects HTTP GET requests for AgtaBackupAgent.msi or AgtaBackupAgent.version, which are indicative of the download phase of the AgtaBackup Remote Access Trojan (RAT).
Detects the 'HCENC1:' marker in HTTP request and response bodies, which is associated with RUSTYSHADE malware used by the APT36 (Transparent Tribe) threat group for Command and Control communications.
Detects outbound HTTP GET requests to the known malicious domain 'docsportal.in' attempting to retrieve second-stage payloads such as '161.php' or 'com.hta'. This pattern is associated with the SideCopy threat actor's malware delivery infrastructure.
Detects network communication associated with SideCopy's ReverseRAT malware by monitoring for DNS lookups to a known malicious domain (dns.educationportals.biz) and outbound connections to a hardcoded C2 IP address (45.61.157.22).
Detects DNS queries for the domain 'docsportal.in', which is associated with the SideCopy threat group's HTA-staging activity for delivering the ReverseRAT malware.
Detects HTTP GET requests to Backblaze B2 storage hosting specific archive files identified as payloads for the RustyShade/RustyMove malware family, often used by the APT36 threat group.
Detects HTTP traffic containing the 'User-token' header, which is indicative of command-and-control (C2) communication patterns associated with the curlRAT backdoor, often attributed to North Korean threat actors such as APT37, Lazarus, or Kimsuky.
This rule detects potential exploitation attempts targeting the CAPWAP (Control and Provisioning of Wireless Access Points) protocol in FortiOS or FortiSwitchManager. The rule identifies suspicious UDP traffic on port 5246 containing an oversized payload (greater than 1400 bytes), which is characteristic of the exploitation pattern for CVE-2025-25249.
Detects VPN/IKE negotiation failures characterized by certificate validation or parsing anomalies on Check Point Security Gateway or Spark firewall devices. These anomalies, when correlated with connections originating from known anonymization infrastructure (such as Tor exit nodes, proxies, or public VPN services), indicate potential exploitation attempts of the CVE-2026-85102 vulnerability, which allows for pre-authentication remote code execution via malformed certificate inputs.
Detects outbound network connections (HTTPS/TLS) to known malicious domains used by TA419 for AitM (Adversary-in-the-Middle) phishing campaigns. These domains are identified as part of a spoofed OneDrive document/file sharing theme intended to steal user credentials.
Page 18 of 312