Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,605 detections
Filters
Last updated
All Time
Detection languages
495
433
214
119
105
Contributors
403
350
248
92
65
Categories
20,456
11,839
5,876
5,155
4,865
1,605
Platforms
860
775
236
213
66
Products / Services
469
348
348
319
208
MITRE Techniques
726
541
453
167
163
CVEs
6
5
2
2
2
IDS Classtypes
235
83
34
19
18
IDS Protocols
283
56
51
16
12
This rule detects potential unauthorized remote access activity by correlating the execution or network activity of known remote access tools (Tailscale) or suspicious network patterns (DuckDNS, port 4444) with the subsequent execution or network activity of secondary RAT/remote desktop software (RustDesk, AnyDesk, TeamViewer) on the same host within a 10-minute window. This behavior is indicative of an adversary establishing an initial C2 connection followed by deploying secondary remote access tools for persistent remote control.
This rule detects potential Domain Generation Algorithm (DGA) activity by analyzing network connection logs. It identifies suspicious domains based on their structure (length, character set) and then filters them using a trigram analysis. Domains with non-repeating trigrams and rare trigrams (not found in a baseline of Alexa Top 1M domains) are flagged as DGA candidates. The rule then joins these candidates back to the original network logs to identify actual connections to these suspicious domains.
This rule monitors DNS query traffic for unusually long, encoded subdomain labels (50 characters or more). Such patterns are indicative of data exfiltration or command-and-control (C2) communication using DNS tunneling tools like iodine or dnscat2, which encapsulate non-DNS protocols within the DNS query structure to evade network inspection.
Detects the execution and network activity of known reverse tunneling and proxy tools such as Chisel, Ngrok, and FRP. These tools are commonly abused by adversaries to establish persistence, bypass firewalls, and facilitate command and control (C2) communication. The rule monitors for specific process names, command-line arguments, and DNS requests related to these services.
Detects network and process execution activity involving Google or Microsoft OAuth2 token endpoints from non-browser and non-trusted processes. This behavior is indicative of potential token theft or session hijacking attempts, where malicious tools (e.g., curl, python) are used to access authentication endpoints to bypass standard user interaction.
Detects network activity initiated by the WinSCP utility, or DNS queries and HTTP requests directed toward easyupload.io, a common file-sharing site. This behavior may indicate an adversary staging or exfiltrating data to an external, potentially unauthorized location.
This rule detects potential Domain Generation Algorithm (DGA) activity by analyzing network connection logs. It identifies suspicious domains based on their structure (length, character set) and then filters them using a trigram analysis. Domains with non-repeating trigrams and rare trigrams (not found in a baseline of Alexa Top 1M domains) are flagged as DGA candidates. The rule then joins these candidates back to the original network logs to identify actual connections to these suspicious domains.
Detects DNS queries for domains matching a specific typosquatting pattern ('[a-z]{3,20}business.com') associated with the Montana Empire campaign, likely used for corporate banking credential harvesting.
Detects browser processes performing DNS resolution for Bing search endpoints immediately following access to M365 Copilot services within the same process storyline. This pattern is indicative of a SearchLeak exploitation chain where an adversary leverages M365 Copilot search to perform SSRF, using Bing as a proxy for data exfiltration.
Detects DNS queries for domains that mimic software package naming conventions (e.g., [name]-utils, [name]-api, [name]-client) that do not resolve to known legitimate registry domains. This behavior is indicative of potential dependency confusion attacks or malicious package installation attempts, where an attacker registers a domain designed to lure developers into downloading malicious code.
This rule identifies potential BRICKSTORM command and control (C2) activity by detecting sustained beaconing patterns to known public DNS-over-HTTPS (DoH) providers (8.8.8.8, 1.1.1.1) over port 443. It buckets network connections into 10-minute windows and flags source devices exhibiting frequent, repetitive traffic patterns, enriched with asset context to prioritize alerts from edge appliances such as firewalls, NAS devices, or storage sync services.
This rule detects DNS queries for reverse lookups, specifically those ending with '.in-addr.arpa' or '.ip6.arpa'. While legitimate, frequent or unusual reverse DNS queries from a specific device or process could indicate reconnaissance activities or attempts to map internal network infrastructure by an attacker.
This rule detects network connections to or from known suspicious IP addresses and requests to known suspicious domains. These indicators are often associated with command and control (C2) activity, malware distribution, or other malicious infrastructure.
Detects potential DNS-based command and control (C2) or exfiltration behavior by monitoring for DGA-like domain patterns, high-volume DNS requests, and the use of command-line tools (nslookup.exe, dnscmd.exe) to perform TXT record lookups often associated with data exfiltration.
Detects DNS query traffic where the subdomain label length exceeds 50 characters and contains patterns consistent with Base64 or Hexadecimal encoding. This behavior is indicative of potential data exfiltration or command-and-control communication performed over the DNS protocol by tunneling data within query labels.
Detects network activity (DNS queries, TLS SNI, and HTTP requests) directed towards known attacker-controlled command-and-control domains associated with AsyncRAT and ScreenConnect abuse.
This rule detects potential command and control (C2) activity associated with a known npm RAT, identified by network connections to specific C2 infrastructure (95.216.92.207:8080) or DNS resolution of 'nvidiadriver.net'. The rule specifically flags these events when performed by common execution tools like 'python.exe' or 'chost.exe', or when the process image is running from a temporary directory, which is a common persistence or execution indicator for malware.
This rule identifies network activity or DNS queries associated with the known malicious domain 'perplexity-ai.online'. It monitors both endpoint network event logs and DNS logs to alert on any attempts to establish communication with or resolve this specific domain.
Detects a malicious Chrome extension exfiltrating keystrokes entered into the browser's Omnibox. The rule monitors for high-frequency GET requests (indicative of keystroke-by-keystroke transmission) from chrome.exe to a specific C2 domain (perplexity-ai.online), correlated with DNS resolution of that domain within the same session.
Detects DNS queries to Gofile infrastructure originating from processes executing from typically transient directories (AppData or Temp). This behavior is characteristic of VILE ransomware, which stages compressed user files in these directories before exfiltrating them via Gofile as part of a double-extortion strategy.
This rule detects common activity patterns associated with the Havoc C2 framework and general malicious PowerShell usage. It monitors for three primary indicators: VBScript stagers spawning PowerShell processes (e.g., in a Havoc-like delivery chain), PowerShell processes initiating DNS queries to DuckDNS infrastructure, and PowerShell processes performing cross-process memory injection indicative of shellcode execution (e.g., Demon in-memory agent).
Page 39 of 77