Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,309 detections
Filters
Last updated
All Time
Detection languages
2,251
27
22
7
2
Contributors
910
584
506
125
48
Categories
20,456
11,839
5,876
5,155
4,865
2,309
Platforms
2,196
209
169
62
61
Products / Services
2,253
2,159
165
32
31
MITRE Techniques
713
422
390
187
184
CVEs
17
12
12
12
10
IDS Classtypes
995
426
281
190
98
IDS Protocols
1,291
401
281
117
45
Detects outbound HTTP PUT requests characteristic of data exfiltration associated with Qilin ransomware. The rule monitors for the use of command-line tools like s5cmd or rclone for uploading data, often used during the double extortion phase where stolen data is uploaded to leak sites.
Detects web traffic containing indicators of 'ClickFix' social engineering attacks. These attacks present a fake 'CAPTCHA' or verification prompt to the user and instruct them to copy and paste a malicious script (involving PowerShell or mshta) into their system terminal.
Detects anomalous, oversized fragmented UDP traffic (exceeding 1400 bytes) targeting or originating from the MikroTik btest service port (2000). This behavior is indicative of attempts to trigger integer underflows, system crashes, or uninitialized memory disclosures within the btest protocol implementation.
Detects repetitive network traffic to the Slack API endpoint '/api/conversations.history' using the 'Go-http-client' User-Agent. This behavior is indicative of the Graphalgo RAT polling Slack for command-and-control (C2) instructions.
This rule detects potential attempts to exploit an SSH pre-authentication rekey or authentication bypass vulnerability (CVE-2026-67279) in MikroTik RouterOS devices. It monitors incoming TCP traffic on port 22 that contains the 'ROSSSH' signature followed by specific binary sequences indicative of exploitation attempts.
Detects HTTP traffic identified as Sauron Loader, characterized by specific POST requests to hardcoded domains, URI path structures, and user-agent strings indicative of automated C2 activity.
Detects HTTP traffic identified as Sauron Loader, characterized by specific POST requests to hardcoded domains, URI path structures, and user-agent strings indicative of automated C2 activity.
Detects network activity related to the exploitation of the CVE-2025-31702 vulnerability in Dahua P2P Relay services. The rules monitor for probe attempts, device parameter fetching (randsalt), serial number enumeration bursts, and successful no-auth channel responses, indicating a bypass of authentication mechanisms on vulnerable Dahua devices.
Detects a multi-stage network communication pattern characteristic of agent sandbox evasion and subsequent data exfiltration. The rule first identifies an unusual volume of connections to URL-shorteners using encoded fragments in the URI, and subsequently flags calls to common screenshot or rendering services containing 'url=' parameters, suggesting possible pixel-based data exfiltration over a command and control channel.
Detects network traffic consistent with a hardcoded C2 channel used by PolinRider or NullReceiver malware families. The rule monitors TCP traffic directed to a specific IP address (193.26.115.131) and port (15152) that contains serialized command/status structures formatted with specific JSON-like content patterns.
Detects network activity, including HTTP requests and TLS SNI traffic, directed towards the known GRIMWEDGE C2 domain 'ocr.opusaccel.top'. This includes monitoring for repeated polling behavior indicative of a command and control heartbeat mechanism.
Detects a network request to download a file named 'msgbox.exe' using the curl command-line utility, consistent with the activity observed from threat actor UTA0560 (GRIMWEDGE). This rule monitors for HTTP GET requests targeting the specific file path while the User-Agent string begins with 'curl/'.
Detects network indicators associated with the BambooToken C2 infrastructure, including DNS lookups for specific domains, TLS SNI mismatches, non-standard MQTT port usage, and specific command-and-control tasking keywords within MQTT payloads.
This rule detects HTTP GET requests containing suspicious URL query parameters (nfe_valid_access_key_2026_secure or chave_tecl_cresol) that are associated with phishing kits targeting Brazilian taxpayers, often used to deliver or facilitate HVNC (Hidden Virtual Network Computing) remote access tools.
Detects periodic outbound network traffic to the Telegram Bot API (api.telegram.org) indicative of potential command and control (C2) beaconing, specifically monitoring for repeating connections over extended time intervals.
Detects network traffic associated with the WallStealer malware, including the download of malicious payloads from a known C2 server, communication with a cryptominer C2, and the use of Steam Community profiles as dead-drop resolvers for C2 instructions.
Detects network communication associated with the Cyclops Blink modular malware, specifically targeting known Sandworm C2 IP addresses and non-standard ports used for firewall rule manipulation and C2 beaconing. The rule identifies both inbound and outbound traffic, including potential TLS handshakes on specific non-standard ports.
Detects network traffic associated with the RatHat Android RAT, specifically monitoring for HTTP and TLS connections to the command and control (C2) delivery domain 'kingbss.com', as well as detecting characteristic FRP (Fast Reverse Proxy) client login handshake patterns used for tunnel establishment.
Detects network communication associated with the Rapuncel MaaS (Malware-as-a-Service) campaign, specifically identifying the Command and Control (C2) connection, GitHub Pages-based redirect chains, and subsequent delivery of large, suspicious ZIP archives containing renamed executable/system files.
This rule detects potential NTLM relay or authentication downgrade attempts by monitoring HTTP POST requests to the Certificate Enrollment Service (CES) endpoint. It specifically flags when an 'Authorization' header contains an NTLM-wrapped 'Negotiate' token, which is often indicative of an attacker attempting to coerce or relay authentication material to the service.
Detects Xray-core C2 tunnel traffic where the TLS SNI is spoofed to appear as 'dl.google.com'. The detection specifically looks for this behavior originating from non-browser processes such as 'wkspbroker.exe' or 'radcui.dll', which is indicative of malicious tunneling activity.
Page 22 of 110