Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,309 detections
Filters
Last updated
All Time
Detection languages
2,251
27
22
7
2
Contributors
910
584
506
125
48
Categories
20,443
11,831
5,875
5,151
4,864
2,309
Platforms
2,196
209
169
62
61
Products / Services
2,253
2,159
165
32
31
MITRE Techniques
713
422
390
187
184
CVEs
17
12
12
12
10
IDS Classtypes
995
426
281
190
98
IDS Protocols
1,291
401
281
117
45
Detects network traffic containing 'Active Setup', 'Installed Components', and 'StubPath' strings, which are indicative of a potential attempt to reference or trigger a malicious StubPath registry key for persistence.
Detects anomalous SMB traffic indicating potential ransomware activity. The rule monitors for file operations associated with known ransomware naming conventions (e.g., README.txt, DECRYPT_INSTRUCTIONS) or common ransomware-related extensions. It uses a threshold to identify high-frequency occurrences within a short timeframe, suggesting bulk file renaming or ransom note creation typical of encryption phases.
Detects HTTP traffic patterns associated with LokiBot malware beaconing to a hardcoded command and control (C2) endpoint. The rule specifically looks for established network connections to identified malicious domains or IP addresses using the /fre.php URI path.
This rule detects potential adversary-in-the-middle (AiTM) activity targeting FortiGate firewalls, specifically looking for internal authentication traffic (LDAP, Kerberos, LDAPS, MS-SQL) originating from a firewall management IP. The rule triggers if there are 5 such connections within 60 seconds, indicating a possible listening post or attempt to intercept credentials.
This rule detects outbound network traffic from internal hosts to a known malicious IP address (193.242.184.150) over port 22 (SSH). This behavior is indicative of a reverse SSH tunnel established for C2 communication and the potential exposure of internal RDP services to the attacker.
This rule detects outgoing HTTP POST requests that contain a payload matching the signature of Ousaban malware's custom XOR-encoded command-and-control (C2) traffic, characterized by a specific hexadecimal structure.
This rule monitors DNS traffic for queries to the domain 'chongdaotang.net', which is associated with a phishing campaign leveraging legal threat lures to harvest credentials. Detecting these queries indicates that a host in the network is attempting to resolve a domain used in a known credential harvesting attack.
Detects DNS TXT queries for the domain '_axiom-config.m100.cloud', which is associated with fileless payload retrieval techniques.
Detects potential Windows executable or DLL file downloads originating from or directed to a specific suspicious external IP address (154.49.70.216) over HTTP port 80, based on signature-based alerts from network security tools.
Detects HTTP response bodies containing specific strings associated with the 'Montana Empire' phishing kit. This rule monitors for indicators that a web server is serving a phishing credential harvesting page.
Detects outbound HTTPS traffic from a web server to api.telegram.org. This pattern is indicative of the Montana Empire phishing kit using the Telegram Bot API for command and control (C2) communication, allowing the adversary to exfiltrate stolen data or receive instructions.
Detects outbound HTTP PUT requests to 'filen.io', which has been associated with command-and-control (C2) communication for the PRISMEX malware used by the threat actor APT28 (also known as Pawn Storm/Fancy Bear).
Detects a specific network handshake pattern (05 01 00) associated with the SystemBC malware acting as a SOCKS5 proxy. This pattern is characteristic of the initial communication phase used by SystemBC to establish C2 connectivity, often utilized by ransomware affiliates.
Detects outbound HTTP POST requests containing keywords indicative of credential and data theft associated with VBV Stealer malware, specifically looking for fields related to passwords, cookies, or wallets in the request body.
This rule detects outbound TCP traffic from internal network hosts to known Tor relay ports (9001, 9030), which is a common communication pattern for the NBLock ransomware strain to establish a command and control channel through the Tor network.
Detects outbound network traffic to the ScreenConnect service specifically targeting the /Relay/ path, which is commonly abused by ransomware operators (e.g., Interlock, RansomHub) for establishing unauthorized remote access and command-and-control channels.
Detects outbound SOCKS5 negotiation patterns commonly used by the Salt Typhoon threat group's STOWAWAY tool. The rule triggers on TCP traffic initiating a SOCKS5 handshake (represented by the sequence |05 01 00|) to non-standard ports, excluding common proxy ports (1080, 3128, 8080, 8443, 9050). This behavior is indicative of a multi-hop SOCKS5 relay or command-and-control connection.
Detects outbound HTTP POST requests containing keywords indicative of credential and data theft associated with VBV Stealer malware, specifically looking for fields related to passwords, cookies, or wallets in the request body.
Detects outbound network traffic to the ScreenConnect service specifically targeting the /Relay/ path, which is commonly abused by ransomware operators (e.g., Interlock, RansomHub) for establishing unauthorized remote access and command-and-control channels.
Detects outbound SOCKS5 negotiation patterns commonly used by the Salt Typhoon threat group's STOWAWAY tool. The rule triggers on TCP traffic initiating a SOCKS5 handshake (represented by the sequence |05 01 00|) to non-standard ports, excluding common proxy ports (1080, 3128, 8080, 8443, 9050). This behavior is indicative of a multi-hop SOCKS5 relay or command-and-control connection.
This rule detects HTTP POST requests containing the specific string 'GEMINI_TRUST_WORKSPACE', which is associated with environment variable injection attacks targeting CI/CD pipeline configurations.
Page 103 of 110