Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,309 detections
Filters
Last updated
All Time
Detection languages
2,251
27
22
7
2
Contributors
910
584
506
125
48
Categories
20,456
11,839
5,876
5,155
4,865
2,309
Platforms
2,196
209
169
62
61
Products / Services
2,253
2,159
165
32
31
MITRE Techniques
713
422
390
187
184
CVEs
17
12
12
12
10
IDS Classtypes
995
426
281
190
98
IDS Protocols
1,291
401
281
117
45
Detects network traffic associated with the NPM Btree malware campaign, specifically identifying command-and-control (C2) polling activities directed toward blockchain RPC endpoints like Alchemy and Infura. The rules monitor for specific API keys, C2 smart contract addresses via 'eth_call' JSON-RPC requests, and overall traffic patterns to known malicious infrastructure.
Detects network traffic indicating the use of Slack APIs as a command and control (C2) channel or for exfiltration. The rules monitor for specific TLS SNI strings, hardcoded Slack bot tokens, and specific channel IDs associated with the 'indexed-btree' malware campaign, which utilizes Slack as a C2 platform.
Detects network activity associated with a malicious npm package campaign leveraging Sepolia Ethereum testnet RPC endpoints (Alchemy and Infura) for command-and-control (C2) communication. The detection looks for JSON-RPC 'eth_call' requests and specific contract address references characteristic of this campaign.
Detection of suspicious network traffic directed toward Slack APIs, characterized by the use of hardcoded Slack bot tokens and specific communication patterns associated with the 'indexed-btree' npm malware family, indicating potential C2 communication or data exfiltration.
Detects outbound HTTP requests to the Telegram Bot API associated with the malicious 'indexed-btree' npm package. The rule specifically monitors for hardcoded Telegram bot tokens and chat IDs used for data exfiltration.
Detects outbound network traffic attempting to exfiltrate data to Slack or Telegram APIs using hardcoded bot tokens or channel identifiers associated with the 'indexed-btree' malware campaign.
Detects outbound HTTP POST requests to the Polygon blockchain using the 'eth_call' JSON-RPC method, specifically targeting a known smart contract address associated with EtherHiding-style C2 infrastructure. This behavior indicates an adversary utilizing decentralized blockchain storage or services as an unconventional command-and-control channel to resolve malicious configurations or payloads.
This rule detects outbound HTTP requests to the blogspot.com domain, which is often used by malware for command-and-control (C2) communication, staging, or as an initial check-in mechanism. Attackers frequently abuse legitimate blogging platforms to host malicious content and evade network-based detections that might otherwise flag unknown or suspicious domains.
Detects network traffic associated with NarwhalRAT malware utilizing the pCloud API as a command-and-control (C2) channel or dead-drop resolver. The rule monitors both HTTP requests containing specific folder identifiers and authentication parameters, as well as TLS SNI indicating connections to api.pcloud.com.
This rule detects network traffic patterns indicative of a reverse shell established by DSCourier, a tool or script that leverages the ConfigurationRemotingServer interface to facilitate interactive command execution on a remote host.
Detects specific FTP commands (STOR, RETR, TYPE I) and passive mode responses directed to or originating from identified malicious IP addresses associated with the LucidRook threat actor. This rule monitors for potential file exfiltration, payload retrieval, and command-and-control communication over the FTP protocol.
Detects outbound network traffic associated with identified ClickFix CPaaS payload domains and associated API endpoints. The rule monitors for specific malicious domain contact (comicstar.lat, babybon.cfd, merkantalolol.asia) and the use of the '/api/index.php?a=init' endpoint, which is indicative of the ClickFix payload delivery mechanism.
Detects outbound HTTP requests to 'relay.php' containing a static authorization bearer token 'crpx0_c2_2026', which is associated with the command and control activity of the CRPx0 ransomware family.
Detects network traffic associated with the AdaptixC2 framework agent check-in process. The rule looks for specific HTTP GET request patterns, including URI paths commonly used by the agent, session-related cookies, and Content-Type headers set to application/octet-stream.
Detects network traffic associated with NGate Android malware communicating with its Command and Control (C2) server. The rule monitors for specific HTTP POST patterns, including an 'okhttp' user-agent and binary body content characteristic of NFC relay relay attempts used for fraudulent payment activities.
Detects outbound HTTP POST requests directed towards Internet Computer Protocol (ICP) canister gateways (e.g., icp0.io, ic0.app) containing specific API path patterns (/api/v2/canister/) used for executing queries or calls. The rule specifically flags traffic lacking common browser-like User-Agent strings, which is a common indicator of automated command-and-control beacons using these services as proxy infrastructure.
This rule detects outbound TLS traffic to the Solana mainnet beta RPC API endpoint (api.mainnet-beta.solana.com). Attackers may abuse legitimate public blockchain infrastructure as a command-and-control channel to bypass traditional network defenses or obfuscate communication.
Detects network beaconing activity associated with the TuxBot v3 IoT botnet. The rule identifies specific User-Agent strings (TuxBot/3, BusyBox wget, Wget/1.x), requests for .elf files, and connections to suspicious top-level domains frequently used for botnet command-and-control (C2) infrastructure.
This rule detects attempts to exploit a vulnerability in Cisco IOS XE devices (specifically related to CVE-2025-20188) by identifying suspicious Authorization headers containing JWT tokens ('Bearer eyJ...') targeted at the '/webui/' endpoint. This behavior is associated with Akira ransomware exploitation efforts against networking infrastructure.
Detects high-frequency connection attempts to SMB (445) or RDP (3389) ports originating from a single source, which is characteristic of the SoftPerfect Network Scanner (NetScan) tool performing reconnaissance or network discovery sweeps.
This rule detects network communication associated with the AMOS (Atomic macOS) Stealer malware. Specifically, it identifies inbound HTTP GET requests directed at the '/api/shell/agent' URI, which is used by the stealer to retrieve instructions or trigger remote shell operations from its command and control (C2) server.
Page 37 of 110