Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,605 detections
Filters
Last updated
All Time
Detection languages
495
433
214
119
105
Contributors
403
350
248
92
65
Categories
20,445
11,833
5,875
5,151
4,864
1,605
Platforms
860
775
236
213
66
Products / Services
469
348
348
319
208
MITRE Techniques
726
541
453
167
163
CVEs
6
5
2
2
2
IDS Classtypes
235
83
34
19
18
IDS Protocols
283
56
51
16
12
Detects malware checking internet connectivity via external IP services
This rule detects processes other than common web browsers (e.g., chrome, firefox, msedge) initiating outbound network connections on ports 80, 443, or 8084 to specific domains commonly associated with CDN, telemetry, or cloud-based update services. This behavior might indicate unauthorized processes communicating with external infrastructure, potentially for command and control or data exfiltration, masquerading as legitimate traffic.
Detects DNS resolution to attacker-controlled AWS S3 buckets masquerading as Outlook/OneDrive service pages used by UNC6692 for phishing delivery, SNOWBELT C2, and credential exfiltration. The rule specifically looks for DNS queries to S3 domains with patterns indicative of spoofed Outlook/OneDrive service pages or specific known malicious S3 bucket names.
This rule detects DNS queries to known public tunneling service domains, such as devtunnels.ms, loophole.site, loca.lt, and bore.pub, originating from processes other than the legitimate developer tunneling tools (devtunnel.exe, code.exe, code-tunnel.exe). This activity is highly indicative of unauthorized remote access or command-and-control communication.
Detects execution of PowerShell commands associated with the Gamaredon Group's Ptero malware family. This rule monitors for suspicious PowerShell command lines (including encoded commands and common obfuscation patterns) originating from Office applications or temporary directories, correlated with network connections to known Gamaredon C2 domains or registry modifications to Run keys for persistence.
This rule detects potentially suspicious outbound network connections or DNS queries to known Generative AI service domains (OpenAI, Anthropic, Google, Mistral, Cohere) from non-browser and non-developer processes. It also triggers on suspicious Windows binaries (e.g., PowerShell, bitsadmin, mshta) initiating external connections to these domains or other destinations over port 443, helping identify potential data exfiltration or automated abuse of LLM APIs.
Flags traffic targeting known rogue DNS infrastructure IPs associated with recent SOHO router hijacking campaigns. This rule specifically looks for outbound network connections to IP addresses starting with '5.' or '185.' on destination port 53 (DNS).
This rule monitors build agent processes (e.g., Jenkins, Bamboo, Gradle, MSBuild) for suspicious DNS activity. It alerts when these processes resolve a high volume (3 or more) of unique external domains that are not associated with typical development, build, or dependency management platforms (e.g., Microsoft, Azure, GitHub, NPM, PyPI, Maven, Sonatype). This behavior may indicate an attempt by an adversary to reach command-and-control servers or exfiltrate data from a compromised build environment.
Detects anomalous activity associated with 'winupdate.exe', including suspicious registry run key persistence, execution from abnormal directories (e.g., AppData, .cache), and unauthorized outbound network connections to Pastebin. The rule triggers when multiple signals are observed from the same host and user, indicating potential malware behavior.
This rule monitors for indicators of unauthorized Tor usage or anonymization activity, including non-standard Tor executable paths, suspicious library loads, the creation of Tor configuration files (torrc), non-browser processes communicating over known Tor ports, and DNS queries for .onion domains. It also specifically monitors for potential data exfiltration via the temp.sh file-sharing service from non-browser applications. The rule aggregates these suspicious signals over a 24-hour period to calculate a risk severity score based on the frequency and variety of indicators detected.
This rule monitors for DNS queries, network connections, and HTTP proxy requests originating from node/npm processes or targeting known infrastructure associated with the Trum3it campaign. It covers common malicious domains and specific Vercel subdomains identified as command-and-control (C2) endpoints.
This rule detects a process initiated by Node.js or NPM performing a DNS lookup for known malicious domains while simultaneously accessing sensitive local files such as SSH keys, AWS credentials, browser cookies, browser login data, or bash history. This pattern is indicative of a post-compromise activity where an adversary leverages a JavaScript runtime to perform credential theft and communicate with C2 infrastructure.
This rule detects potential supply chain compromise involving typosquatted npm packages. It monitors for the execution of npm packages with names closely resembling legitimate libraries (e.g., 'thirdweb', 'rainbownkit'), followed by suspicious post-install scripts that attempt to initiate network connections to known malicious domains or modify sensitive files.
Detects network connections or DNS queries to ErrTraffic Beer cluster domains impersonating AI platforms (ChatGPT, Google Antigravity) delivering DanaBot/HijackLoader via BSOD or reCAPTCHA ClickFix lures, and subsequent browser-spawned PowerShell execution.
Detects SPECTRALVIPER threat activity by monitoring for unauthorized masquerading as legitimate OneDrive sync processes. The rule identifies suspicious process creation, beaconing to C2 infrastructure, DtlCrashCatch.dll sideloading, and unauthorized cross-process injection behaviors associated with this threat actor.
Detects DNS queries for the domain 'screenai.online', which is associated with the Phoenix Backdoor used by the MuddyWater (also known as Seedworm or MERCURY) threat group for command-and-control (C2) communication.
Detects DNS queries for the domain 'screenai.online', which is associated with the Phoenix Backdoor used by the MuddyWater (also known as Seedworm or MERCURY) threat group for command-and-control (C2) communication.
Detects the use of Gsocket or gs-netcat utilities for outbound network connections on non-standard ports, as well as the execution of masqueraded 'uptime' binaries making network connections. It also monitors for DNS resolutions associated with Gsocket relay infrastructure to identify potential command and control or unauthorized tunneling attempts.
This rule identifies network connections (DNS queries, HTTPS/WebSocket traffic) directed toward known suspicious domains associated with potentially malicious C2 infrastructure.
This rule detects network activity involving known suspicious domains and the download of specific, potentially malicious files (archives and installers). The monitoring focuses on HTTP/proxy/DNS traffic where hostnames, URLs, or query parameters match indicators of malicious activity.
Detects DNS traffic patterns indicative of the Iodine DNS tunneling tool, specifically identifying version handshake queries or base32 encoded payloads commonly associated with the tool's C2 communication.
Page 49 of 77