Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,154 detections
Filters
Last updated
All Time
Detection languages
683
379
342
230
173
Contributors
630
378
354
145
119
Categories
841
831
746
393
348
Platforms
1,587
586
494
263
118
Products / Services
10,678
9,759
6,693
4,421
3,749
2,154
MITRE Techniques
655
561
383
337
286
CVEs
32
20
8
7
6
IDS Classtypes
65
32
23
19
14
IDS Protocols
47
38
30
30
12
Detects Spring4Shell remote code execution exploitation attempts
Detects Node.js or Bun processes making network connections to the GitHub API. This rule is designed to identify potential exfiltration attempts, specifically referencing the Miasma campaign which spoofs a 'python-requests/2.31.0' User-Agent to evade network detection while exfiltrating credentials to api.github.com/repos/.
Detects DNS requests to domains matching known UNC3753 data leak sites or phishing domains masquerading as IT helpdesks, serving as an early warning of an ongoing vishing campaign or active extortion.
Detects repeated SSH connections used to grab banners for host information gathering
This rule detects network connections or DNS queries to a specific Internet Computer Protocol (ICP) domain and canister ID (tdtqy-oyaaa-aaaae-af2dq-cai.raw.icp0.io or tdtqy-oyaaa-aaaae-af2dq-cai). This pattern is associated with command and control (C2) activity, where compromised systems communicate with an adversary-controlled server.
This rule identifies web traffic containing the custom User-Agent string 'HarborWatchAgent', which is indicative of Command and Control (C2) communication by the HarborWatch Agent. It searches both endpoint network events and network appliance/proxy logs for this specific User-Agent string.
Detects HTTP requests utilizing a specific, highly verbose, and legacy Internet Explorer 8 User-Agent string. This exact hardcoded string is utilized by a fileless .NET loader (originating from a malspam campaign) to download subsequent payload stages from its staging server.
Detects attempts to bypass the UniFi OS authentication gateway by exploiting a path traversal vulnerability. The rule looks for requests to the '/api/auth/validate-sso/' endpoint containing URL-encoded path traversal sequences like '..%2f' or '..%2e'. This indicates an attacker is trying to access internal resources or bypass authentication mechanisms.
Detects JavaScript used to fingerprint browser and client configurations
This rule detects potential network port scanning activity by identifying a single source IP address attempting to connect to 10 or more distinct destination ports on a single destination IP address within a 5-minute window. This behavior is indicative of an attacker attempting to discover open services on a target host.
This rule detects an unusually high number of network connection events originating from a single device to a remote IP address within a one-minute interval. This behavior can be indicative of various malicious activities, including network scanning, port scanning, or a denial-of-service (DoS) attempt. It could also signal a compromised host attempting to establish numerous connections for command and control, data exfiltration, or further reconnaissance.
Detects compromised websites being abused as C2 relay infrastructure
Detects DNS queries resolving privnote.com. This self-destructing message service is actively abused by threat actors like UNC3753 to transmit malicious installation links and commands to compromised users while bypassing traditional chat and email filtering.
Detects DNS over HTTPS (DoH) traffic originating directly from edge appliances (e.g., to 8.8.8.8 on port 443), which VerdantBamboo uses to obscure BRICKSTORM C2 resolution.
This rule detects network connections to suspicious domains or IP addresses associated with potentially compromised or malicious VPN infrastructure. Specifically, it looks for connections to 'vpn-fortinet.com', 'ivanti-vpn.org', 'forticlient-vpn.de', or the IP address '194.76.226.93'. These indicators may suggest attempts to establish command and control, exfiltrate data, or engage in other malicious activities via compromised VPN services.
Detects network requests associated with FallSpy, an Android spyware utilized by the Russia-nexus threat group GREYVIBE. FallSpy is deployed via fake persona lures and spoofed applications to harvest critical intelligence. While the original YARA rule targets file-based artifacts (e.g., class names like DataCollectorWork), this Sigma rule adapts the logic to focus on the highly reliable exfiltration URL parameters observable in proxy and web gateway logs.
This rule detects potential HTTP/2 Rapid Reset or similar denial-of-service (DoS) attacks by identifying an unusually high number of streams and total requests within a single HTTP/2 network connection over a one-minute interval. Such behavior is indicative of an attacker attempting to exhaust server resources by rapidly opening and closing streams.
Detects the specific User-Agent string 'NSIS_InetLoad (Mozilla)' associated with the SessionGate multi-stage loader during its command and control (C2) check-ins. SessionGate is delivered via impersonated open-source tooling websites and gated TDS redirection chains.
This rule detects an unusually high number of network connection events originating from a single device to a remote IP address within a one-minute interval. This behavior can be indicative of various malicious activities, including network scanning, port scanning, or a denial-of-service (DoS) attempt. It could also signal a compromised host attempting to establish numerous connections for command and control, data exfiltration, or further reconnaissance.
This rule detects network connections originating from clients using a specific User-Agent string associated with the SessionGate malware. The User-Agent string 'NSIS_InetLoad' combined with 'Mozilla' is indicative of SessionGate C2 check-ins, leveraging the NSIS (Nullsoft Scriptable Install System) InetLoad plugin. The rule searches across common proxy and web logs for this pattern.
Detects web requests containing the specific user-agent or custom secret headers used by the Moika campaign beacon to retrieve its stage 2 payload.
Page 78 of 103