Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,155 detections
Filters
Last updated
All Time
Detection languages
2,301
1,070
640
289
288
Contributors
918
814
769
696
224
Categories
20,456
11,839
5,876
5,155
4,865
Platforms
2,858
2,017
816
524
213
Products / Services
1,336
1,144
831
576
366
MITRE Techniques
1,822
1,307
787
747
577
CVEs
9
7
7
6
6
IDS Classtypes
538
151
101
57
48
IDS Protocols
375
373
132
64
42
Detects an anomalously high rate of network connections to a MongoDB server from a single source IP, a pattern associated with the exploitation of MongoBleed (CVE-2025-14847).
This rule detects common chromium browser processes establishing outbound network connections to known C2 domains associated with malicious 'ChatGPTStealer' infostealer extension. Detections by this rule indicates a high likelihood that a malicious chromium infostealer extension is currently or had been installed on an endpoint.
This rule detects outbound network connections initiated by 'chrome.exe' to a predefined list of known Command and Control (C2) domains over HTTPS (port 443). This indicates potential communication with malicious infrastructure.
This rule detects network connections and DNS queries to command-and-control (C2) domains associated with malicious Chrome extensions. These extensions are known to steal sensitive data such as ChatGPT and DeepSeek conversations, as well as other browsing data. The rule specifically targets known malicious domains to identify C2 communication and potential data exfiltration.
Detects execution of BADAUDIO malware downloader used by APT24
Detects a PowerShell process that makes an outbound network connection and contains command-line arguments associated with reflectively loading a .NET assembly from a Base64 encoded string. This is a common fileless technique used by malware like Remcos to execute payloads in memory.
This rule detects common chromium browser processes establishing outbound network connections to known C2 domains associated with malicious 'ChatGPTStealer' infostealer extension. Detections by this rule indicates a high likelihood that a malicious chromium infostealer extension is currently or had been installed on an endpoint.
Detects data exfiltration activity by Turla's Kazuar v3 loader. After performing system reconnaissance, the VBScript loader sends collected information to the C2 server via HTTP POST requests. The exfiltration process collects system information including OS version, boot time, processor architecture, computer name, username, domain, running processes, and file listings, formats the data as plain text, and sends it via HTTP POST to the requestor.php endpoint on the C2 server. The loader uses WinHttp.WinHttpRequest.5.1 with SSL certificate validation disabled and sets User-Agent to "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E)" to appear as legitimate browser traffic. The requestor.php endpoint is a specific indicator of Kazuar v3 C2 communication. This rule detects POST requests to this endpoint targeting any internet-routable IPv4 address, as Turla may use different C2 servers across campaigns. The combination of the specific endpoint name and POST method is a strong indicator of Kazuar v3 data exfiltration.
Detects network connections to Kazuar v3 command and control servers. The malware communicates with C2 infrastructure using HTTP/HTTPS protocols (ports 80/443) to any internet-routable IPv4 address. The loader uses WinHttp.WinHttpRequest.5.1 COM object for HTTP requests and ignores SSL certificate validation errors (SXH_SERVER_CERT_IGNORE_ALL_SERVER_ERRORS = 13056). File downloads are performed using ADODB.Stream, and User-Agent strings typically contain "WinHttp" or "ADODB" indicators. This rule matches any valid IPv4 address to account for the fact that Turla may use different C2 IPs across campaigns. The rule focuses on HTTP/HTTPS traffic which is the primary communication method used by the loader to download components and exfiltrate data.
This rule detects indicators associated with the 'Office Assistant' supply chain attack. It identifies malicious browser extensions by their IDs in file paths or names, and also detects known malicious file MD5s and C2 communication domains. The rule correlates file events and network events to provide a comprehensive view of the attack.
Detects indicators of React2shell exploitation originating from 'node' or 'next' processes on web-facing or internet-facing assets. This rule identifies suspicious network connections to common web ports (3000, 8080, 443, 80) or process executions containing command-line arguments indicative of prototype pollution exploitation (e.g., '__proto__', 'constructor:constructor', 'process.mainModule.require', 'execSync', 'vm.runInThisContext', 'fs.readFileSync') or common post-exploitation commands ('whoami', '/etc/passwd', 'id', 'env', 'hostname').
SleepyDuck Malware Etherhiding
Cortex XDR
This rule detects network connections to specific RPC addresses and a contract address associated with the SleepyDuck malware's Etherhiding technique. It filters for DNS queries containing known RPC domains and HTTP/network activity containing a specific Ethereum contract address. This indicates potential communication with the malware's command and control infrastructure for persistence.
Detects a multi-stage process execution chain characteristic of the 'ClickFix' technique. This involves 'explorer.exe' spawning a headless 'conhost.exe', which subsequently executes a Living Off the Land Binary (LOLBin) such as 'curl', 'pwsh', 'powershell', or 'mshta' to download a payload from an HTTP/HTTPS source. This chain indicates an attempt to bypass traditional security controls and execute malicious code.
Detects a URL containing common redirection or proxy parameters where the value appears to be a ROT13 obfuscated URL, indicated by the presence of 'uggcf' ('https') and common ROT13'd TLDs. This is an evolution of a TTP observed in Kimsuky campaigns.
Detects network communication patterns
Detects HTTP C2 beaconing patterns based on burst request counts with small response bodies (1-499 bytes). This rule correlates multiple HTTP requests to the same destination within a short timespan, where each response has a small body size. This pattern is indicative of command and control (C2) communication.
Detects PowerShell processes using base64-encoded commands that establish outbound network connections within 5 minutes, indicating potential tool transfer or C2 activity. This rule correlates two base rules: one for base64-encoded PowerShell process creation and another for PowerShell network connections.
Detects a ClickFix attack chain involving an email client opening a browser to a suspicious domain, followed by a file download, and subsequent execution via cmd.exe from explorer within a short timeframe. This chain of events is indicative of a social engineering attack designed to trick users into executing malicious files.
The current AI ecosystem has significant security gaps that can be weaponized for corporate espionage, supply-chain compromise, data harvesting, and even nation-state operations.
This KQL query identifies endpoints that are accessing, installing, or executing AI-related services or applications. The primary objective is to detect :
- Unauthorized AI usage (Policy Violation)
- Potential data exfiltration via AI platforms
- Shadow IT activity involving local or cloud-based LLMs
- High-risk AI deployments that bypass corporate policy
This KQL query identifies endpoints that are accessing, installing, or executing AI-related services or applications. The primary objective is to detect :
- Unauthorized AI usage (Policy Violation)
- Potential data exfiltration via AI platforms
- Shadow IT activity involving local or cloud-based LLMs
- High-risk AI deployments that bypass corporate policy
This rule detects network connections or URL click events to a list of domains known to be associated with phishing or malware distribution. The rule specifically looks for connections to these domains that also contain certain path segments like '/wlc/', '/load/', or '/success/', which are often indicative of malicious activity or payload delivery. It also broadly checks for any URL click events containing these suspicious domains.
This rule detects network connections to the Telegram API endpoint (api.telegram.org) from processes other than common web browsers like Chrome or Edge. This activity could indicate the use of Telegram for command and control, data exfiltration, or other malicious purposes by malware or threat actors.
Page 198 of 246