Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,154 detections
Filters
Last updated
All Time
Detection languages
683
379
342
230
173
Contributors
630
378
354
145
119
Categories
841
831
746
393
348
Platforms
1,587
586
494
263
118
Products / Services
10,683
9,759
6,695
4,421
3,750
2,154
MITRE Techniques
655
561
383
337
286
CVEs
32
20
8
7
6
IDS Classtypes
65
32
23
19
14
IDS Protocols
47
38
30
30
12
This rule detects network communication (connections, DNS queries, or proxy logs) between endpoints and a list of known malicious domains and IP addresses associated with Mistic and Woodgnat/KongTuke threat families. It identifies these activities across network event logs, DNS queries, and security logs.
This rule detects potential exposure of API keys, tokens, or secrets within FTP directory listings. It specifically looks for network events on remote port 21 (FTP) where the 'RemoteUrl' contains keywords like 'api_key', 'apikey', 'token', 'secret', or 'key=' during a network signature inspection.
Detects network events where FTP (port 21) traffic contains specific timestamp-like patterns in the RemoteUrl, which could indicate an attempt to exploit the Squidbleed vulnerability related to timestamp-to-filename parsing anomalies. The rule looks for 'LIST' command combined with '12:34:56', '2026-', or 'timestamp' in the URL.
This rule detects anomalous DNS query activity that may indicate command and control (C2) or data exfiltration over the DNS protocol. It monitors for three specific indicators: excessive query volume to a single domain family within a short timeframe, the use of abnormally long DNS subdomain labels, and the transmission of TXT record queries from endpoints not acting as designated DNS servers.
Detects a single host making Zulip REST API POST requests to multiple distinct topics, specifically looking for patterns associated with system profiling and command/tasking as observed in ZiChatBot. The rule identifies activity where a source IP uses the Zulip API to send messages to at least two different topics, with the raw request content indicating either 'channel/stream' and 'topic/subject' or keywords like 'system info', 'shellcode', 'task', or 'command'.
This rule monitors for network connections to a specific remote IP (62.171.185.97) associated with suspicious activity. It flags connections involving specific high-risk ports, the use of Wget/1.18 for user agents, or access to the '/pwned' URL path, which are common indicators of automated attack tools or post-exploitation activity.
Detects potential Windows executable or DLL file downloads originating from or directed to a specific suspicious external IP address (154.49.70.216) over HTTP port 80, based on signature-based alerts from network security tools.
Detects HTTP responses that utilize JavaScript Web Crypto API (subtle.importKey, subtle.decrypt) or AES-GCM encryption in conjunction with data decoding functions (atob, Uint8Array.from). This behavior is characteristic of malicious landing pages, such as those used by ErrTraffic ClickFix and EvilTokens campaigns, which encrypt payloads to evade static analysis by security tools.
Detects outbound HTTPS traffic from a web server to api.telegram.org. This pattern is indicative of the Montana Empire phishing kit using the Telegram Bot API for command and control (C2) communication, allowing the adversary to exfiltrate stolen data or receive instructions.
Detects network connections from a host to the api.adblock-for-youtube.com domain at the /api/v2/rules endpoint. This behavior is associated with the 'Adblock for YouTube' browser extension (cmedhionkhpnakcndndgjdbohmhepckk) as it retrieves remote JavaScript scriplets for rule updates, which can be a vector for unauthorized code execution if the domain is compromised or used maliciously.
Detects unauthorized access attempts to sensitive SD-WAN control plane endpoints via REST API or the presence of suspicious 'evil_tenant.csv' artifacts, which may indicate reconnaissance or staging activities.
This rule detects potential Bluekit malware activity by identifying specific CSS filter function combinations (saturate, hue-rotate, brightness, and contrast) within HTTP header data. These functions are used by Bluekit to generate unique pixel hashes for page loads, intended to bypass screenshot-based detection. The rule also flags instances where these headers co-occur with content-length and javascript identifiers.
Detects SSH network connections initiated by common administrative service accounts 'vmanage-admin' or 'troot' using the ssh or sshd process. This pattern may indicate unauthorized use of these service accounts or anomalous remote access behavior.
This rule detects network connections or DNS queries originating from an endpoint towards domains or IP addresses associated with BlueKit command-and-control (C2) infrastructure, including TLDs (pk, ws, cc, su) and onion-based addresses. This activity is indicative of potential malware communication or C2 beacons.
This rule monitors DNS query logs for attempts to resolve domains associated with 'rrweb' or 'rrweb-snapshot'. These libraries are legitimate tools for session recording and DOM snapshotting but have been increasingly observed in malicious activity, specifically in web-based credential theft, automated session hijacking, or exfiltration of sensitive user activity via session recording.
Detects HTTP GET requests to api.adblock-for-youtube.com to retrieve scriptlet rules. This endpoint is used by various browser extensions to fetch dynamic configuration updates, which can potentially facilitate MAIN-world JavaScript injection.
This rule monitors network logs (proxy, web gateway, and DNS) to detect connections to a curated list of known malicious domains associated with phishing, credential harvesting, and malware delivery infrastructure.
Detects suspicious authentication and management events associated with SD-WAN devices, specifically targeting indicators of CVE-2026-20245 exploitation. The rule monitors for unauthorized SSH access, usage of tenant-upload commands, execution of rogue scripts like vconfd_script_upload_tenant_list, and anomalous peering activity indicative of device injection.
This rule detects potentially malicious web content by identifying the use of randomized or specific combinations of CSS filters (saturate, hue-rotate, brightness, contrast) within HTML responses. These techniques are often used by attackers to obfuscate malicious content, such as phishing pages, from automated scanners and security filters. The rule also incorporates a check for unusually large JavaScript bundle sizes, which may indicate the presence of injected malicious scripts.
This rule identifies suspicious outbound network traffic potentially related to data exfiltration or command-and-control (C2) communication. It monitors for connections to the Telegram Bot API utilizing 'sendMessage' methods, often used by malware for exfiltrating credentials or sensitive data, as well as connections to known 'Bluekit' PhaaS (Phishing-as-a-Service) operator domains.
This rule monitors network and email gateway logs to detect activity related to the Bluekit Phishing-as-a-Service (PhaaS) platform. It identifies traffic to known Bluekit command-and-control or phishing domains, detects the presence of rrweb scripts often associated with session recording on phishing pages, alerts on brand-impersonation phishing pages using specific keyword combinations, and flags the presence of FortiBleed campaign lures.
Page 66 of 103