Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,605 detections
Filters
Last updated
All Time
Detection languages
495
433
214
119
105
Contributors
403
350
248
92
65
Categories
20,456
11,839
5,876
5,155
4,865
1,605
Platforms
860
775
236
213
66
Products / Services
469
348
348
319
208
MITRE Techniques
726
541
453
167
163
CVEs
6
5
2
2
2
IDS Classtypes
235
83
34
19
18
IDS Protocols
283
56
51
16
12
Detects unauthorized usage of the RustDesk remote access tool, including process execution from suspicious parents, service installation, outbound connections to known relay infrastructure, and DNS queries for RustDesk relay domains originating from non-browser processes. This rule is designed to identify secondary or redundant remote access channels potentially established by adversaries.
This rule detects network connections to suspicious domains or IP addresses associated with potentially compromised or malicious VPN infrastructure. Specifically, it looks for connections to 'vpn-fortinet.com', 'ivanti-vpn.org', 'forticlient-vpn.de', or the IP address '194.76.226.93'. These indicators may suggest attempts to establish command and control, exfiltrate data, or engage in other malicious activities via compromised VPN services.
This rule detects suspicious outbound DNS queries originating from a device that are not directed to common public DNS servers (Google DNS, Cloudflare DNS). The rule specifically flags queries where the remote DNS name contains keywords like 'malware', 'c2', or 'c&c', and where at least 5 such queries occur within an hour from the same device. This pattern can indicate potential malware communication or command and control (C2) activity.
Detects DNS queries to GitHub API domains originating from non-standard or potentially spoofed process names associated with various AI tools, which may indicate data exfiltration or unauthorized interaction with repositories.
Detects DNS queries to GitHub API domains originating from non-standard or potentially spoofed process names associated with various AI tools, which may indicate data exfiltration or unauthorized interaction with repositories.
Detects DNS queries containing unusually long subdomains (50+ characters) encoded in Base64, which is a common technique used for command-and-control (C2) communication or data exfiltration via DNS tunneling.
This rule detects potential command and control (C2) beaconing activity using DNS tunneling. It monitors for a high frequency of DNS TXT record queries to long subdomains (exceeding 50 characters), which is a common characteristic of tools like DNScat and iodine that encode data within DNS requests.
This rule detects potentially malicious DNS traffic where queries contain exceptionally long, encoded, or randomized subdomains. Attackers often use these patterns to exfiltrate data from a target network, bypassing traditional security controls by encapsulating information within DNS requests (DNS tunneling). The detection looks for DNS queries exceeding 100 bytes in length with specific character patterns indicative of Base64 or similar encoding.
This rule detects DNS queries for domains that mimic legitimate package registry domains (such as PyPI, npm, etc.) using common typosquatting or lookalike patterns often exploited for dependency confusion or supply chain attacks. It identifies when systems reach out to domains attempting to impersonate trusted package management services.
Detects potential DNS-based command and control (C2) or exfiltration behavior by monitoring for DGA-like domain patterns, high-volume DNS requests, and the use of command-line tools (nslookup.exe, dnscmd.exe) to perform TXT record lookups often associated with data exfiltration.
Detects network connections from common browser processes and script execution engines to the known Payroll Pirate (Storm-2755 / Storm-2657) phishing domain 'bluegraintours.com', which is associated with Adversary-in-the-Middle (AiTM) session cookie and OAuth token harvesting.
This rule detects suspicious outbound DNS queries originating from a device that are not directed to common public DNS servers (Google DNS, Cloudflare DNS). The rule specifically flags queries where the remote DNS name contains keywords like 'malware', 'c2', or 'c&c', and where at least 5 such queries occur within an hour from the same device. This pattern can indicate potential malware communication or command and control (C2) activity.
Detects network connections to specific cloud service providers (Google Cloud PubSub/MQTT, Azure Service Bus) or common STUN/WebRTC ports (3478) initiated by processes other than standard web browsers or common communication applications.
This rule detects DNS queries for the domain 'teledyneflir.com.de', which is known to be used by the threat actor UNC1549 as a fake recruitment portal to conduct phishing campaigns impersonating the Teledyne FLIR careers site.
Detects two distinct suspicious patterns indicative of OAuth consent abuse and browser-based credential theft. The first pattern identifies non-Microsoft script interpreters or binaries initiating network connections to Microsoft's OAuth endpoints. The second pattern identifies unauthorized processes attempting to access or modify sensitive browser data files (e.g., 'Login Data', 'Cookies') which are typically reserved for browser-specific processes.
Detects network connections to the Telegram Bot API (api.telegram.org) originating from processes executing from potentially suspicious or non-standard locations (Temp, AppData, ProgramData), excluding the legitimate Telegram Desktop client. This pattern is commonly observed in Remote Access Trojans (RATs) such as the Millenium RAT and other malware families utilizing Telegram as a C2 channel.
Detects the TONResolver RAT attempting to resolve its Command and Control (C2) server address by querying TON blockchain API endpoints. The rule monitors network connections and DNS queries made by non-standard processes to known TON API infrastructure, specifically tracking potential dead-drop resolver behavior where smart contract data is used to obtain malicious infrastructure addresses.
Detects the use of nslookup.exe to query DNS TXT records from non-Microsoft signed processes. This behavior is often associated with DNS-based Command and Control (C2) channels or data exfiltration techniques where small amounts of data are encoded within DNS TXT records.
Detects suspicious network activity from common scripting and runtime environments (Python, Node.js) that communicate with known blockchain-related infrastructure (e.g., Tron, Aptos). The rule flags processes that establish connections to multiple distinct external IP addresses while querying these specific domains, which may indicate cryptocurrency mining, wallet-stealing malware, or unauthorized distributed computing activity.
This rule detects DNS queries originating from the internal network towards the domain 'direct-download.giize.com', which has been associated with the unauthorized distribution of the ScreenConnect remote access tool. This activity is indicative of an attempt to download potentially malicious or unauthorized remote administration software.
This rule identifies suspicious activity involving potential trojanized software installers and connections to known typosquatting or malicious domains. It flags processes spawned by common web browsers that match known malicious installer filenames and monitors for DNS queries to domains frequently associated with software supply chain or distribution-based malicious activity.
Page 40 of 77