Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,594 detections
Filters
Last updated
All Time
Detection languages
2,463
65
36
12
11
Contributors
991
707
594
140
61
Categories
2,159
1,453
1,273
576
444
Platforms
2,418
272
203
71
63
Products / Services
10,683
9,759
6,695
4,421
3,750
2,594
MITRE Techniques
808
512
383
246
210
CVEs
18
12
12
12
10
IDS Classtypes
1,144
447
282
188
105
IDS Protocols
1,378
413
318
209
34
Detects outbound network traffic containing the hardcoded user-agent string 'Remcos', which is indicative of a Remcos RAT beacon communicating with a command-and-control (C2) server. The rule inspects HTTP requests to identify this specific malware signature within the established communication flow.
Detects network traffic indicating the use of Rclone to exfiltrate data to MEGA cloud storage, a technique associated with Akira ransomware campaigns.
This rule detects unauthorized or unauthenticated attempts to call the NetrServerPasswordSet2 method on a Domain Controller via the MS-NRPC (Netlogon) interface, which is indicative of an exploitation attempt related to CVE-2020-1472 (Zerologon). This vulnerability allows an attacker to bypass authentication and reset a Domain Controller's computer account password, leading to full domain compromise.
Detects network activity associated with ngrok tunnel domains or suspicious lookalike Microsoft SSO domains (microsoft-sso.com) attempting to perform OIDC discovery, JWKS retrieval, or MFA-related EAM endpoint interactions. This behavior is indicative of adversary-in-the-middle (AiTM) attacks targeting authentication processes.
This rule detects network traffic patterns associated with ARToken-style OAuth device code phishing attacks, specifically monitoring for initial backend requests to Cloudflare Workers infrastructure, response payloads containing known phishing template indicators, and subsequent polling activity against device code endpoints that indicate an active phishing session.
Detects outbound TCP traffic originating from internal network hosts to a known hardcoded AsyncRAT C2 IP address (158.51.122.136). This indicates a successful infection where a host has established communication with the C2 infrastructure.
Detects network activity associated with a known malicious campaign using fake Cloudflare CAPTCHA pages as a lure. This includes requests to retrieve tracker scripts from 'fsputnik.com', loading of fake verification pages from 'uasputnik.com', and communication with a known command retrieval endpoint ('admin777111777.php') potentially used for clipboard hijacking.
Detects HTTP and TLS traffic directed toward Vercel subdomains (vercel.app) that are consistent with known patterns for document-lure phishing or gated ZIP file distribution, often used for RMM-phishing campaigns.
Detects HTTP requests to Vercel deployment domains where the requested resource is a specific phishing kit asset ('font1.woff2'). This pattern is commonly associated with phishing campaigns hosted on free web hosting platforms.
Detects HTTP requests and responses involving the download of an executable file named 'ClaudeDesktop.exe' from the 'claude.ai' host, which is indicative of a malicious campaign distributing SectopRAT.
This rule detects network requests directed at raw.githubusercontent.com that attempt to retrieve 'init.dat' or files named with a specific GUID format, patterns which are characteristic of the Kimsuky threat group using GitHub as a dead drop resolver for C2 infrastructure discovery.
Detects DNS queries to major public LLM API endpoints (OpenAI, Anthropic, Google Generative Language). This may indicate potential use of these services as a command and control (C2) channel or for data exfiltration by insiders or compromised systems, which may bypass traditional security controls.
Detects specific C2 communication patterns associated with SCKIT, including HTTPS beaconing to the skyleen.fr domain and structured URI patterns used for configuration and status requests.
This rule detects outbound network beaconing from the SCKit malware to known command-and-control (C2) domains hosted on skyleen.fr or to a specific malicious IP address (139.84.223.178). The rule monitors both TLS SNI indicators in HTTPS traffic and direct IP connections to identify compromised hosts communicating with the attacker's infrastructure.
Detects HTTP POST requests directed to OpenAI or Anthropic API endpoints originating from non-browser user agents (e.g., Python requests, curl, Go-http-client). This activity may indicate automated interactions, potentially for malicious purposes such as script-based interaction with LLMs or unauthorized API usage.
Detects repeated, small outbound HTTP/HTTPS requests to an external destination, a behavior characteristic of scripted command-and-control (C2) beaconing where a client periodically polls a server for instructions.
Detects large HTTP POST requests (exceeding 100KB) directed to public LLM API endpoints such as OpenAI or Anthropic. This behavior may indicate potential bulk data exfiltration or unauthorized sharing of sensitive data with external AI providers.
Detects high-frequency TCP SYN scanning activity originating from external networks targeting port 37777, commonly associated with the Dahua DVR P2P discovery service. This behavior is indicative of automated reconnaissance and scanning campaigns searching for vulnerable IoT devices.
Detects network traffic attempting to exploit CVE-2021-33044, an authentication bypass vulnerability in Dahua NetKeyboard devices, by identifying specific login request strings used in the exploit chain.
Detects network traffic associated with Adversary-in-the-Middle (AiTM) phishing kits that impersonate Microsoft and Google login pages. The rules identify the presence of specific HTML elements (like Cloudflare Turnstile anti-bot gates) and authentication session cookie headers served from non-authorized/non-official domains, indicating a reverse-proxy phishing attack.
This rule detects malicious HTTP POST requests attempting a path traversal attack against Grav CMS, specifically targeting the __unique_form_id__ parameter. The rule looks for directory traversal sequences ('..') following the parameter, which is characteristic of attempts to read sensitive files outside the intended web directory.
Page 24 of 124