Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,150 detections
Filters
Last updated
All Time
Detection languages
2,296
1,070
640
289
288
Contributors
918
814
769
696
224
Categories
20,438
11,829
5,873
5,150
4,864
Platforms
2,853
2,017
812
520
213
Products / Services
1,334
1,144
831
576
366
MITRE Techniques
1,819
1,307
787
746
576
CVEs
9
7
7
6
6
IDS Classtypes
538
151
101
57
48
IDS Protocols
375
373
132
64
42
Detects outbound IPv4 and IPv6 connections from endpoints to public addresses on ports other than DNS (53), HTTP (80), HTTPS (443), 8000.
Command-and-control tools and tunnels often use uncommon ports to avoid web-focused filtering. Private, loopback, link-local, multicast and documentation ranges are excluded, and repeated connections are grouped by endpoint, process, remote IP and port. Custom apps and admin tools also use these ports, so triage by process, destination reputation and how rare the destination is.
Command-and-control tools and tunnels often use uncommon ports to avoid web-focused filtering. Private, loopback, link-local, multicast and documentation ranges are excluded, and repeated connections are grouped by endpoint, process, remote IP and port. Custom apps and admin tools also use these ports, so triage by process, destination reputation and how rare the destination is.
Sweeps endpoint telemetry for known IOCs from the trojanized anthropic.claude-code (Open-VSX v2.1.313) SSH backdoor: C2 IP 134.209.82.225, beacon URL, extension.js and tunnel key SHA-256 hashes, and ifconfig.me lookups from VS Code-family/extension-host processes. Results are summarized per device and IOC.
Detects potential remote code execution, web shell activity, and post-exploitation behaviors originating from PHP worker processes on internet-facing hosts, referencing patterns associated with php2shell vulnerabilities. PHP-UP-2026
Detects inbound exploitation sources and outbound callback destinations associated with PHP2Shell infrastructure (CVE-2026-109618), correlating both directions per device while filtering out standard browser traffic.
Detects the Tensorlake npm compromise (tensorlake@0.5.144, Shai-Hulud) through the two payload hashes, gh-token-monitor persistence, node or bun running lib/setup.mjs or Math_Symbol.js and node or bun connections to iseekaigogo.com or public Ethereum RPC hosts. It needs Defender for Endpoint events from developer machines and does not see lockfile or package cache contents. The query ran without errors in a live tenant
Correlates devices touched by known IoC IP scan waves with PHP software inventory, vulnerability management data for PHP CVEs, and active PHP process execution telemetry to identify vulnerable exposed web servers.
Detects malicious file hashes, suspicious process executions involving Node.js/Bun running setup scripts, schtasks/powershell persistence monitoring tasks, and connections to known domains/RPC endpoints associated with threat activity. The query ran without errors in a live tenant.
Detects non-browser clients or runtimes (such as curl, python, node, or Electron-based apps) successfully connecting to or referencing compromised eMudhra certificate status checker hosts, indicating systems that still trust compromised intermediate certificates.
This detection identifies potentially algorithmically generated domains (DGA) observed in Trend IA XDR telemetry. DGA domains are commonly used by malware families for Command and Control (C2) communications because they generate large numbers of pseudo-random domain names, making blocking and takedown efforts more difficult.
The detection focuses on domains that:
Have a moderate length (8-20 characters)
Contain numbers, which are common in many DGAs
Use frequently abused TLDs
Have low occurrence volume across the environment
Follow a simplified lexical pattern often associated with generated domains
The detection focuses on domains that:
Have a moderate length (8-20 characters)
Contain numbers, which are common in many DGAs
Use frequently abused TLDs
Have low occurrence volume across the environment
Follow a simplified lexical pattern often associated with generated domains
Detects a sequence where an Apache HTTP server spawns a shell (sh, bash, dash) followed within a 6-hour window by network connections to internal ports (LDAP, SMB, Kerberos) from the same device, indicative of web shell activity and potential internal reconnaissance or relay attempts.
Detects inbound network connections from known IP addresses associated with PHP2Shell exploitation attempts and malicious tooling infrastructure.
Detects PowerShell processes combining local loopback listener terms (such as HttpListener or TcpListener) and authentication or web request cmdlets referencing 127.0.0.1 or localhost, correlated with local network loopback connections.
Detects instances where an AOMEI-related process initiates an outbound WebDAV-style connection to a public host, followed closely by a Windows WebClient service (svchost.exe) connection to the same remote IP address.
Detects the execution of OpenConnect VPN clients on non-sanctioned devices followed within a 4-hour window by high-volume internal network connections across multiple ports indicative of network service discovery or pivoting activity.
Detects Microsoft Edge (msedge.exe) spawned by command shells or script hosts with hidden or headless window parameters, or communicating with webhook.site, which is commonly indicative of malicious browser automation or exfiltration.
Detects outbound network connections from Python processes associated with known indicators of compromise or specific suspicious command line arguments such as cook.py, cook.pth, or privcollect.
Detects network connections to the npm registry (registry.npmjs.org) initiated by AI coding agent processes (such as Claude, Cursor, Copilot, Windsurf, Codeium, Aider) or by unexpected processes that are not standard package managers or browsers.
Detects endpoint network connections and correlates multi-stage communications associated with the ClickFix browser cache smuggling campaign, including initial payload retrieval and secondary stage/C2 communication across devices.
Detects potential C2 beaconing activity associated with Potassium by correlating a DNS query for a known C2 domain with a subsequent TCP connection to port 50792 from the same device within a short time window.
Detects script-driven (curl, wget, python) outbound connections to
AI/LLM API endpoints. The campaign uses legitimate AI platform APIs as covert
command, control, and exfiltration channels, blending malicious traffic with
approved web services to evade network-based detection.
AI/LLM API endpoints. The campaign uses legitimate AI platform APIs as covert
command, control, and exfiltration channels, blending malicious traffic with
approved web services to evade network-based detection.
Detects malicious behaviors involving the Chisel tunneling tool, including reverse SOCKS proxy connections with TLS verification skipped, cron-based persistence referencing watchdog scripts in hidden /var/tmp directories, and associated tool staging activities.
Page 1 of 246