Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,154 detections
Filters
Last updated
All Time
Detection languages
683
379
342
230
173
Contributors
630
378
354
145
119
Categories
841
831
746
393
348
Platforms
1,587
586
494
263
118
Products / Services
10,683
9,759
6,695
4,421
3,750
2,154
MITRE Techniques
655
561
383
337
286
CVEs
32
20
8
7
6
IDS Classtypes
65
32
23
19
14
IDS Protocols
47
38
30
30
12
This rule monitors network traffic for outbound connections to a specific remote IP address (38.60.253.35) on port 8084. This pattern is indicative of communication with a known command-and-control server or malicious infrastructure.
Detects anomalous network connections to HTTP/S ports (80, 443, 8080) by suspicious processes (e.g., Python, Netcat, Socat) or those executing known tunneling/web shell scripts (Neo-reGeorg, Chisel). This rule identifies potential egress-blocked environment bypass attempts by monitoring for high-frequency outbound connections that deviate from standard browser or signed-application behavior.
Detects HTTP requests directed at known MexicanMafia Operation Escaneo phishing infrastructure, specifically targeting tax authority and SeedDMS document management users. The rule alerts on access to identified artifact filenames used in the campaign, such as phishing poc and spoofed document management pages.
Detects outbound network connections to specific known malicious egress IP addresses associated with Operation Escaneo, utilizing the Wget user agent to request the '/pwned' resource over port 8888, indicative of SOCKS5-tunneled data exfiltration.
Detects one external source repeatedly requesting PeopleSoft administrative endpoints across multiple destinations or URLs within fifteen minutes. This activity could indicate an attacker performing reconnaissance or vulnerability scanning against public-facing PeopleSoft applications.
Detects HTTP network connections to the specific URI path and parameters used by the OnyxC2 stealer for C2 beaconing and data exfiltration.
Detects HTTPS POST requests to known attacker-controlled infrastructure associated with the BadBlocker campaign (e.g., Unistream SDK, adblock-for-youtube domains). These requests often originate from browser extensions via injected scripts, facilitating the potential exfiltration of sensitive browser session data or credentials.
Detects anomalous WebSocket connections that transmit DOM serialization data using the rrweb library. This activity is indicative of a Browser-in-the-Middle (BitM) phishing framework, where an attacker records and relays a live, authenticated browser session from a victim to an adversary-controlled server.
Detects behavior indicative of Bluekit Browser-in-the-Middle (AiTM) phishing, where a client system fetches the rrweb DOM-serialization library followed by the establishment of a WebSocket connection within a 5-minute window. This sequence is consistent with live session recording or interactive DOM streaming from an attacker-controlled infrastructure.
Detects behavior indicative of the 'Adblock for YouTube' browser extension (or associated malicious variants) fetching rule configuration files from 'api.adblock-for-youtube.com', followed by suspicious outbound network traffic to non-Google/YouTube domains. This pattern suggests the extension is performing unauthorized data exfiltration, such as harvesting session cookies or credentials via injected scripts.
Detects outbound network connections or DNS lookups to domains associated with the Bluekit Phishing-as-a-Service (PhaaS) platform. This activity often indicates communication with decentralized peer-to-peer phishing infrastructure or Command and Control (C2) domains utilized for phishing campaigns.
Detects Browser-in-the-Middle (BitM) phishing attacks, such as Bluekit, that utilize the rrweb library for real-time DOM serialization and WebSocket streaming to capture user sessions. The rule correlates the presence of the rrweb library in HTTP traffic with WebSocket communication patterns containing session handshakes and serialized DOM payloads.
Detects DNS requests originating from endpoints targeting the 'adblock-for-youtube.com' domain. This activity may be associated with browser extensions that exhibit unexpected or potentially unwanted network behavior.
Detects credential and session data exfiltration by browsers communicating with Bluekit PhaaS-associated domains or Telegram API webhooks. The rule filters network traffic originating from common web browsers to known malicious domains associated with Bluekit infrastructure or to the public Telegram API for automated exfiltration.
Detects HTTP requests initiated by common browser adblock extensions to remote API endpoints for retrieving rule configuration files. This behavior can be exploited by adversaries to perform remote scriptlet injection or change extension behavior via server-side updates, potentially enabling unauthorized JavaScript execution in the browser's context.
Detects Browser-in-the-Middle (BitM) phishing infrastructure associated with PhaaS kits (e.g., Bluekit). The detection monitors proxy access logs for patterns where page assets (images, fonts, CSS) are fetched through a proxy API endpoint on behalf of the victim, combined with WebSocket connections used for real-time relay of victim inputs to the attacker.
Detects network connections to known C2, VPS, VPN, and Starlink IP addresses and ranges used by the Handala group (Void Manticore) for their operations.
Detects outbound web requests to domains associated with 'Adblock for YouTube', which has been identified as malicious browser extension behavior involving fetching script rules or lifecycle signals, potentially indicative of unauthorized data collection or C2-like behavior.
This rule detects network activity associated with known malicious browser extensions identified as 'AdBlock' variants. It monitors for connections to the domain 'api.adblock-for-youtube.com' or requests to '/api/v2/rules' made by specific extension IDs that are known to perform unauthorized or suspicious activities.
This rule monitors network device telemetry for three distinct indicators of compromise: usage of specific botnet-associated User-Agent strings, high-volume automated scanning against known IoT-vulnerable ports (80, 8080, 7547, 52869, 37215), and outbound network connections to known RondoDox command and control server infrastructure.
This rule detects suspicious network connections, process activity, and file events related to Node.js or systemd-userdbd, potentially indicating C2 communication or the presence of malicious tools. Specifically, it looks for outbound TCP connections to port 4444, process command lines containing shell commands or 'node-pty', and file paths/names associated with 'apintergrationpost' or 'node-pty'.
Page 74 of 103