Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,594 detections
Filters
Last updated
All Time
Detection languages
2,463
65
36
12
11
Contributors
991
707
594
140
61
Categories
2,159
1,453
1,273
576
444
Platforms
2,418
272
203
71
63
Products / Services
10,683
9,759
6,695
4,421
3,750
2,594
MITRE Techniques
808
512
383
246
210
CVEs
18
12
12
12
10
IDS Classtypes
1,144
447
282
188
105
IDS Protocols
1,378
413
318
209
34
Detects HTTP POST requests to a /collect endpoint containing visitorId and stage parameters, which is characteristic of ClickFix-style fake bot-protection overlays used to trick users into executing malicious scripts under the guise of security verification.
This rule detects two-stage suspicious network activity: first, a POST request to a known Sauron Loader C2 endpoint ('/api/t'), and second, a subsequent TLS connection to 'ipinfo.io' used for geolocation. The correlation is achieved using flowbits to track the infection lifecycle.
Detects DNS lookup queries and HTTP POST beaconing attempts directed at known Sauron Loader C2 fallback infrastructure. The rule tracks specific domains associated with the malware's encrypted registration and command-and-control behavior.
Detects network beaconing activity associated with the Sauron Loader malware. The rule monitors HTTPS traffic for specific domain patterns and suspicious TLV (Type-Length-Value) protocol structures, as well as recurring beaconing cadence to identified C2 infrastructure.
Detects network beaconing activity associated with AMOS Stealer command-and-control communication. The rule identifies HTTP POST requests to the '/api/t' path with a JSON content type over port 8133, using a threshold to identify sustained communication patterns.
Detects outbound HTTP requests to a known domain associated with 'ClickFix' campaign activity. The rule identifies attempts to fetch a specific JavaScript tracker file, which is often used in social engineering campaigns to trick users into executing malicious commands in their shell or console.
Detects HTTP POST requests to '/api/credentials' over a non-standard port (8133) typical of AMOS (Atomic macOS Stealer) command and control traffic. The rule specifically looks for established network connections originating from the local network and targeting external hosts, flagging multiple occurrences within a 30-second window.
Detects HTTP POST requests to '/api/credentials' over a non-standard port (8133) typical of AMOS (Atomic macOS Stealer) command and control traffic. The rule specifically looks for established network connections originating from the local network and targeting external hosts, flagging multiple occurrences within a 30-second window.
This rule detects outgoing HTTP POST requests to the 'velvet-otter-glagceis.life' domain path '/collect'. The request body contains indicators of victim fingerprinting, specifically looking for 'visitorId' and 'events' fields, characteristic of the Macfinger/ClickFix campaign used for gathering visitor telemetry for malicious purposes.
Detects network activity associated with the AMOS (Atomic macOS Stealer) malware, specifically identifying C2 registration/heartbeat beacons and tasking retrieval requests to known C2 URI paths over port 8133.
Detects network activity associated with the Sauron Loader, including TLS connections to specific C2 domains and repeated HTTPS POST requests to api.* subdomains indicating beaconing or polling behavior.
Detects outbound TLS traffic where the Server Name Indication (SNI) matches known command-and-control (C2) domains associated with the Sauron Loader malware. This indicates a compromised host attempting to communicate with malicious infrastructure.
Detects network traffic consistent with AMOS Stealer command-and-control (C2) activity, specifically HTTP POST requests to the path '/api/t' on non-standard TCP port 8133. The rule includes a threshold to mitigate noise from single connections.
Detects HTTP POST requests to '/api/credentials' which is indicative of the AMOS (Atomic macOS) Stealer malware exfiltrating stolen credentials. The rule uses a threshold to identify multiple exfiltration attempts from the same source within a short time window.
Detects HTTP POST requests to '/api/credentials' which is indicative of the AMOS (Atomic macOS) Stealer malware exfiltrating stolen credentials. The rule uses a threshold to identify multiple exfiltration attempts from the same source within a short time window.
Detects DNS queries and TLS SNI traffic directed towards known domain names associated with the Sauron Loader command-and-control infrastructure. This rule identifies outbound communication attempts using hardcoded beaconing domains.
This rule detects known command-and-control (C2) domains associated with the Sauron Loader malware family, specifically by inspecting TLS Server Name Indication (SNI) fields. It also monitors for patterns of repeated connections to domains prefixed with 'api.' over established TLS sessions, which may indicate beaconing behavior characteristic of C2 activity.
Detects network activity associated with the AMOS (Atomic Stealer) malware, specifically identifying C2 registration, heartbeats, or credential exfiltration attempts over the non-standard port 8133 using HTTP patterns matching its known API endpoints.
Detects outbound HTTP POST requests characteristic of the Sauron Loader malware, utilizing a specific, randomized URI path structure and a known malicious User-Agent string to establish C2 communication.
Detects outbound HTTP POST requests characteristic of the Sauron Loader malware, utilizing a specific, randomized URI path structure and a known malicious User-Agent string to establish C2 communication.
Detects outbound network traffic from internal hosts to known domains associated with the Sauron Loader malware family. These alerts monitor for TLS connections where the Server Name Indication (SNI) matches domains identified as part of the malware's C2 infrastructure.
Page 41 of 124