Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,594 detections
Filters
Last updated
All Time
Detection languages
2,463
65
36
12
11
Contributors
991
707
594
140
61
Categories
2,159
1,453
1,273
576
444
Platforms
2,418
272
203
71
63
Products / Services
10,683
9,759
6,695
4,421
3,750
2,594
MITRE Techniques
808
512
383
246
210
CVEs
18
12
12
12
10
IDS Classtypes
1,144
447
282
188
105
IDS Protocols
1,378
413
318
209
34
Detects high-frequency POST requests to the JFrog Artifactory '/access/api/v1/tokens' endpoint, which is indicative of mass exploitation attempts targeting vulnerabilities (CVE-2026-82329) against administrative token management.
Detects high-frequency POST requests to the JFrog Artifactory '/access/api/v1/tokens' endpoint, which is indicative of mass exploitation attempts targeting vulnerabilities (CVE-2026-82329) against administrative token management.
Detects DNS A record lookups for the domain 'mail.uaiubifas.top', which is associated with GRAYRABBIT C2 activity linked to UNC3569. This domain is known to be used for command and control communications.
Detects DNS A record lookups for the domain 'mail.uaiubifas.top', which is associated with GRAYRABBIT C2 activity linked to UNC3569. This domain is known to be used for command and control communications.
Detects DNS A record lookups for the domain 'mail.uaiubifas.top', which is associated with GRAYRABBIT C2 activity linked to UNC3569. This domain is known to be used for command and control communications.
Detects network activity (HTTP, TLS SNI, and DNS) associated with the domain 'noht1ng.top', which is linked to the GRAYRABBIT malware utilized by the threat actor UNC3569.
Detects DNS queries originating from an internal host to 'mail.uaiubifas.top', which is associated with GRAYRABBIT command-and-control (C2) activity.
Detects DNS queries originating from an internal host to 'mail.uaiubifas.top', which is associated with GRAYRABBIT command-and-control (C2) activity.
Detects rapid ICMP (ping) traffic directed towards specific internal and external hosts, characteristic of the RedTail Linux malware attempting to perform network discovery or validate connectivity to command-and-control infrastructure.
Detects established outbound network connections on TCP port 853 (DNS-over-TLS) to known C2 infrastructure associated with the RedTail malware. The rule monitors for both connection attempts to anomalous resolvers and specific TLS handshake patterns characteristic of RedTail C2 activity.
Detects established outbound network connections on TCP port 853 (DNS-over-TLS) to known C2 infrastructure associated with the RedTail malware. The rule monitors for both connection attempts to anomalous resolvers and specific TLS handshake patterns characteristic of RedTail C2 activity.
Detects an HTTP POST request targeting the host 'tt.yeyoujs.com' at the URI path '/api/agent/enroll', containing a specific Python aiohttp User-Agent string. This pattern is characteristic of a C2 agent attempting to register or enroll with an external command-and-control server.
This rule detects inbound HTTP GET requests to a specific IP address (103.86.86.244) requesting a file named 'deploy.ps1'. This behavior is characteristic of adversaries using PowerShell one-liners (cradles) like 'irm' (Invoke-RestMethod) or 'iex' (Invoke-Expression) to fetch and execute malicious scripts directly from a remote C2 infrastructure.
This rule detects inbound HTTP GET requests to a specific IP address (103.86.86.244) requesting a file named 'deploy.ps1'. This behavior is characteristic of adversaries using PowerShell one-liners (cradles) like 'irm' (Invoke-RestMethod) or 'iex' (Invoke-Expression) to fetch and execute malicious scripts directly from a remote C2 infrastructure.
Detects DNS queries and TLS SNI traffic directed towards known phishing domains that mimic Brazilian financial and government portals, specifically targeting 'gerenciadorcaixa.digital', 'aapj.digital', and 'receitafederal.digital'.
Detects an HTTP GET request to 'dl.php' containing an 'f' parameter (target file) and an 'k' parameter (access token), followed by a response body starting with the 'MZ' header, indicating the successful download of a Windows PE executable as part of a potential phishing campaign stage-2 payload delivery.
Detects sustained beaconing behavior originating from the internal network to known malicious HVNC (Hidden Virtual Network Computing) C2 infrastructure. The rule identifies repeated connection attempts (5 or more TCP SYNs within a 180-second window) targeting specific hardcoded IP addresses on non-standard ports (27015/27017), indicative of a compromised host maintaining persistent C2 communication.
Detects outbound HTTP POST requests to suspicious .ru domains and DNS queries for these domains, indicative of C2 beaconing activity likely associated with a supply chain compromise affecting the Pub.dev ecosystem.
Detects high-frequency SYN scanning activity targeting TCP port 37777 (commonly associated with Dahua devices) from an external source. This behavior is indicative of automated reconnaissance or mass-scanning campaigns, such as Operation CameraSwarm, attempting to identify exposed or potentially vulnerable IoT/surveillance hardware.
Detects specific outbound HTTP POST requests to a known Amatera Stealer command and control domain. The rule looks for the unique URI path '/T.@w' and a specific 'Command: GetEndpoints' header structure commonly used by this malware family to beacon to its C2 infrastructure.
Detects specific outbound HTTP POST requests to a known Amatera Stealer command and control domain. The rule looks for the unique URI path '/T.@w' and a specific 'Command: GetEndpoints' header structure commonly used by this malware family to beacon to its C2 infrastructure.
Page 83 of 124