Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,154 detections
Filters
Last updated
All Time
Detection languages
683
379
342
230
173
Contributors
630
378
354
145
119
Categories
841
831
746
393
348
Platforms
1,587
586
494
263
118
Products / Services
10,683
9,759
6,695
4,421
3,750
2,154
MITRE Techniques
655
561
383
337
286
CVEs
32
20
8
7
6
IDS Classtypes
65
32
23
19
14
IDS Protocols
47
38
30
30
12
Targets high-volume account failures followed by a successful tunnel or portal authentication. The UDM rule retains principal and target context for correlation.
Targets high-volume account failures followed by a successful tunnel or portal authentication. The UDM rule retains principal and target context for correlation.
Detects successful outbound network connections to common botnet-associated remote ports (6667, 6697, 8006, 27374, 27375). The rule aggregates these connections by device to identify endpoints communicating with multiple distinct remote IP addresses, a behavior often indicative of botnet participation or command and control activity.
This rule detects network connections to known malicious IP addresses or attempts to resolve specific domains associated with malicious activity. It monitors for outbound network traffic patterns identified as potential indicators of compromise (IOCs) linked to command and control (C2) servers.
This rule detects network activity involving connections to known malicious IP addresses or DNS domains ('govtop.one') and subsequent attempts to download specific suspicious file payloads, such as archives or image files often associated with malicious activity. This activity is indicative of potential command and control communication or initial malware ingress.
Detects a web session that proxies an enterprise authorisation endpoint while also handling session-cookie names associated with authenticated access. This rule identifies suspicious activity indicative of an Adversary-in-the-Middle (AiTM) attack where an attacker proxies authentication requests and steals session cookies.
Detects one web session posting username, password, and MFA or one-time-code form fields through the same intermediary host. This behavior is indicative of an Adversary-in-the-Middle (AiTM) attack, where an attacker intercepts and relays authentication requests, including multi-factor authentication (MFA) codes, to gain unauthorized access.
Detects a phishing page upgrading to WebSocket or polling transport with Socket.IO event framing during authentication. This behavior is indicative of an adversary-in-the-middle (AiTM) attack, specifically associated with the 'Tycoon' threat activity.
Detects the VSCode executable making direct web requests to the GitHub API. This may indicate a malicious extension exfiltrating or validating stolen OAuth tokens, as demonstrated in the 1-click GitHub Dev/VSCode webview attack.
Detects outbound network connections to 'stitch-design.ai' or 'stitch-google.com', which are identified as malicious domains utilized by a compromised AI agent skill. This skill attempts to bypass security vetting by dynamically fetching its instructions from these attacker-controlled external domains post-installation.
This rule detects network communication with infrastructure associated with the 'EvilTokens' phishing kit, specifically targeting Microsoft OAuth device code API endpoints (/api/device/*) hosted on workers.dev. This behavior is indicative of an adversary conducting device code phishing (a form of AitM attack) to obtain unauthorized access tokens.
Detects use of Discord webhooks for covert C2 or data exfiltration
This rule detects network requests for specific URI paths and filenames ('css.js' or 'cf.js') known to be used by the ErrTraffic malware distribution framework for delivering ClickFix payloads. It identifies potential command and control (C2) infrastructure by grouping requests based on client IP, source IP, domain, destination IP, and URL.
This rule detects network connections to a specific destination port (37393), a known malicious IP address (62.102.148.212), or a dynamic DNS hostname (acceic.ddns.net). These indicators are often associated with command and control (C2) infrastructure used by adversaries.
Detects unauthorized or external access attempts to exposed Ollama API endpoints (port 11434) for generating or chatting, which could be indicative of LLMjacking. The rule identifies requests from known attacker IPs or any external IP, especially if the request count is high.
Detects HTTP GET requests for JavaScript or CSS resources from netdna-ssl.com or wpengine.netdna-ssl.com subdomains. This activity could indicate a supply chain compromise where malicious code is injected into legitimate web resources served from these content delivery networks.
Detects outbound network connections to 'filev2.getsession.org', a known Miasma payload hosting and exfiltration domain. This domain has been associated with Miasma malware for command and control and data exfiltration activities.
Identifies network attempts to communicate with the vulnerable AutoGen Studio MCP WebSocket endpoint using the exploited server_params parameter, indicating potential exploitation of the AutoJack vulnerability.
Detects Node.js initiating network connections over port 2222. This activity is associated with the Miasma botnet, which uses port 2222 as a fallback C2/SSH channel when standard ports are blocked.
Detects potential port scanning activity originating from a Squid proxy server targeting FTP (port 21). This rule identifies instances where a Squid process attempts to connect to port 21 on multiple remote IPs within a one-hour window, which could indicate reconnaissance or malicious activity.
This rule detects potential session token leakage through network proxy responses. It specifically looks for network events where the action type is 'NetworkSignatureInspected', the remote port is 21 (commonly FTP), and the remote URL contains keywords indicative of session tokens such as 'session', 'cookie', 'JSESSIONID', 'PHPSESSID', or 'ASP.NET_SessionId'. This could indicate a vulnerability where session information is inadvertently exposed in proxy logs or network traffic.
Page 75 of 103