Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,605 detections
Filters
Last updated
All Time
Detection languages
495
433
214
119
105
Contributors
403
350
248
92
65
Categories
20,456
11,839
5,876
5,155
4,865
1,605
Platforms
860
775
236
213
66
Products / Services
469
348
348
319
208
MITRE Techniques
726
541
453
167
163
CVEs
6
5
2
2
2
IDS Classtypes
235
83
34
19
18
IDS Protocols
283
56
51
16
12
Detects instances where the Claude Code AI agent process spawns shell interpreters (bash, sh) or network utilities (curl, wget, dig, nslookup) with potentially malicious command line arguments. This behavior can be indicative of indirect prompt injection or unauthorized remote code execution attempts, such as reverse shells, base64 encoded payloads, or DNS-based exfiltration.
This rule monitors DNS query traffic to detect potential C2 beaconing or exfiltration attempts by identifying source IP addresses that query a high volume of unique domains within a short, one-hour time window. It triggers when a host performs at least 10 unique domain queries within 60 minutes.
This rule monitors network traffic for DNS queries or remote IP connections to domains that appear to be typosquatting or lookalike domains targeting specific organizations (Boeing, Airbus, Teledyne FLIR). The rule identifies potential phishing or malicious infrastructure by looking for the string 'career' combined with specific entity names or specific suspicious TLD patterns like '.com.de'.
Detects high-frequency DNS queries for long, random-looking subdomains that result in NXDomain responses, a behavioral indicator of malware using Domain Generation Algorithms (DGA) for command-and-control beaconing.
Detects network, DNS, proxy, and email interactions with known Microsoft-themed lookalike domains used in Adversary-in-the-Middle (AiTM) phishing campaigns. These domains impersonate Microsoft login portals to facilitate credential and session token harvesting by kits such as EvilProxy, Sneaky2FA, and Tycoon.
Detects a potential SSRF-based exfiltration attempt by correlating DNS traffic. The rule identifies a browser session that accesses M365 Copilot (m365.cloud.microsoft) followed by a connection to Bing (bing.com), which is indicative of the exfiltration technique associated with CVE-2026-42824 involving the Bing 'searchbyimage' feature.
This rule detects potential phishing activity by correlating emails containing links to a specific suspicious domain and path with network activity (DNS queries or direct network connections) to the same domain. It targets both the initial email delivery and subsequent user interaction (e.g., clicking the link or downloading files).
This rule detects network connections or DNS queries originating from common web browsers (chrome.exe, msedge.exe, chromium.exe) towards domains related to Perplexity AI. Such activity may indicate data exfiltration or the use of AI tools for processing sensitive organizational data via browser-based interfaces.
Detects network activity initiated by wscript.exe or DNS queries related to the Kimsuky downloader infrastructure, specifically identifying callbacks to the domain 'acnms.dmdoc.dynv6.net' and associated malicious bootservice.php script retrieval behavior.
Detects potential data exfiltration activity to the file sharing service 'easyupload.io' by monitoring DNS queries, HTTP POST requests, and general network connections to the domain.
Detects Bumblebee loader delivery via trojanized MSI installers. The rule identifies suspicious process chains originating from common web browsers, identifies DLL side-loading or loader execution from msiexec.exe child processes in temporary directories, and flags network connections to known Bumblebee delivery domains.
Detects suspected Grandoreiro banking trojan command-and-control (C2) activity. The rule monitors for STUN/TURN traffic over non-browser/non-conferencing processes on port 3478, outbound MQTT connections to common cloud broker domains, and DNS lookups for specific C2-related infrastructure including geolocation checks via icanhazip.com.
Detects signs of persistence via suspicious scheduled task creation or local user creation/group escalation, and C2 activity involving a specific IP address or unauthorized connections to the Telegram bot API.
Detects coordinated malicious behaviors associated with BQTLock ransomware, specifically identifying external IP reconnaissance, direct communication with known C2 infrastructure, abuse of the Telegram API for command-and-control or exfiltration, and host enumeration via system utilities by non-standard processes. The rule aggregates these suspicious signals and triggers an alert when multiple events occur within the same process storyline.
Detects command-and-control (C2) communication patterns associated with the threat group Obsidian Sandstorm (Storm-2571). The rule monitors for network connections and DNS queries to various Azure App Services subdomains initiated by suspicious processes running from user-accessible temporary directories (AppData or Temp), excluding known browser processes. This technique leverages legitimate cloud infrastructure for malicious command delivery.
This rule detects network communication (DNS, connection, or traffic) with known infrastructure and specific URI paths associated with the SpectralViper threat actor. It enriches these findings by identifying if the communication originated from processes commonly associated with SpectralViper, such as OneDrive Sync services or specific Intel audio service files.
Detects DNS query traffic with unusually long subdomains (over 100 characters) that exhibit Base64-like encoding patterns. This is a common behavioral indicator for DNS tunneling tools like iodine or dnscat2, which use DNS queries to encapsulate non-DNS protocol traffic for command and control or data exfiltration.
Detects unusual DNS requests initiated by common development, scripting, and administrative tools (e.g., node, python, powershell, curl) to domains that follow patterns often used for webhooks, relays, or command-and-control services. The rule specifically excludes common package management or source code repositories to reduce noise.
This rule detects DNS queries for domain names that exhibit patterns indicative of 'phantom squatting' targeting postal and courier services. These patterns often involve concatenating brand-related keywords (e.g., 'post', 'parcel', 'delivery') with service-oriented suffixes (e.g., '-login', '-verify', '-app') to create lookalike domains intended for phishing, credential harvesting, or infrastructure staging.
Detects network, DNS, and process-level activity associated with BQTLock ransomware command-and-control communication, specifically targeting Telegram Bot API and Discord webhook traffic originating from non-standard (non-browser/non-messaging) processes.
Detects browser-initiated DNS queries to bing.com during an active Microsoft 365 Copilot session within the same process storyline. This pattern is indicative of a potential SearchLeak HTML rendering race condition (CVE-2026-42824), where a malicious streamed <img> tag triggers an outbound request to Bing before Content Security Policy (CSP) sanitization is applied, potentially exfiltrating sensitive Copilot-retrieved mailbox data.
Page 38 of 77