Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,155 detections
Filters
Last updated
All Time
Detection languages
2,301
1,070
640
289
288
Contributors
918
814
769
696
224
Categories
20,456
11,839
5,876
5,155
4,865
Platforms
2,858
2,017
816
524
213
Products / Services
1,336
1,144
831
576
366
MITRE Techniques
1,822
1,307
787
747
577
CVEs
9
7
7
6
6
IDS Classtypes
538
151
101
57
48
IDS Protocols
375
373
132
64
42
This rule detects DNS Command and Control (C2) activity associated with the Linux/BPFDoor malware. It specifically looks for DNS queries containing a magic value "X:" followed by a dot "." at the beginning of the query, indicating a potential C2 communication channel used by BPFDoor. The rule also includes a byte test to ensure the query length is greater than 20 bytes and a threshold to limit alerts to 3 occurrences within 300 seconds from the same source.
This rule detects network connections to or DNS requests for known malicious IP addresses and domains associated with phishing campaigns. The domains often mimic legitimate services like Zoom, Microsoft, and Google, indicating potential credential harvesting or malware distribution attempts.
This detection looks for browser network traffic to URLs containing common social engineering keywords and common web page file extensions, while excluding trusted domains. This activity is associated with the Matrix Push C2 framework, which uses malicious browser notifications to lure users to phishing pages.
Detects network connections to a specific webhook.site URL known to be used by the Shai-Hulud worm for data exfiltration. The rule specifically looks for the URI path 'bb8ca5f6-4175-45d2-b042-fc9ebb8170b7' on webhook.site, which is a strong indicator of this particular threat.
This rule detects when a domain or URL observed in Teams Messages matches a known threat intelligence indicator from Microsoft Defender Threat Intelligence. It specifically looks for hits against 'Domain' and 'URL' type indicators.
Detects network connections to domains known to be used as infrastructure for an ongoing, highly evasive Evilginx phishing campaign targeting SSO portals.
Detects the unique User-Agent string "A WinHTTP Example Program/1.0" used by the MuddyViper backdoor for C2 communications, as reported in the MuddyWater campaign.
Detects network traffic to domains associated with Intellexa front companies, such as Pulse Advertise and MorningStar TEC, which are linked to the 'Aladdin' zero-click infection vector. This vector abuses the digital advertising ecosystem to deliver Predator spyware.
This rule set detects several indicators of compromise related to the Shai-Hulud threat activity. It identifies specific malicious file hashes (SHA256) for 'bundle.js' files, the execution of the 'trufflehog' tool which is often abused for secrets discovery, the presence of a malicious YAML file named 'shai-hulud-workflow.yml', and network connections to 'webhook.site' domains, optionally with a specific URI, which are used for data exfiltration or command and control.
Detects network traffic consistent with RomCom's Mythic C2 framework. This includes connections to known C2 domains or requests for specific URI paths that return a 403 Forbidden status with an Nginx server header, a known fingerprint of this infrastructure.
KQL Query from file: ConvertMate - suspicious PDF editor
This rule detects the use of common file transfer and remote access protocols (SSH, FTP, SMB, TELNET, FTPS, SMB.v3) communicating over non-standard ports. Adversaries often use non-standard ports to bypass firewall rules, evade detection, or obscure their command and control (C2) traffic. The rule specifically excludes the standard ports for these protocols to focus on anomalous behavior.
This detection rule identifies hosts where data archiving using 7-Zip is closely followed by network traffic to the temp.sh file-sharing service. This correlation suggests a potential data staging and exfiltration sequence, a TTP observed in the Lynx Ransomware campaign.
Detects the download of a Java Archive (JAR) file initiated by a PDF reader or web browser, specifically from devices located in Uzbekistan. This behavior is characteristic of the Bloody Wolf threat actor's geofenced attacks.
Detects a network connection to an external SMB or WebDAV server immediately following the launch of a .url file. This behavior is associated with CVE-2024-43451, where threat actors use malicious .url files to leak NTLM hashes.
Detects the download of a Java Archive (JAR) file initiated by a document reader, browser, or email client. This behavior is consistent with the Bloody Wolf threat actor, which uses spear-phishing to trick users into downloading malicious JAR loaders for the NetSupport RAT.
Detects Remote Procedure Call (RPC) attempts targeting critical assets, such as Domain Controllers, where the call includes a UNC path pointing to an external IP address. This is a strong indicator of an authentication coercion attack (e.g., PetitPotam, DFSCoerce) where an attacker is attempting to force the critical asset to authenticate to a listener they control to capture credentials.
Detects Remote Procedure Call (RPC) authentication coercion attempts where a machine is forced to authenticate to an external IP address. Attackers use this technique to capture credentials by tricking a server into connecting to a listener they control. This rule identifies known vulnerable RPC interfaces and functions (including rare ones like MS-EVEN/ElfrOpenBELW) being used with a UNC path parameter that points to a public IP address.
Detects Remote Procedure Call (RPC) authentication coercion attempts where a machine is forced to authenticate to an external IP address. Attackers use this technique to capture credentials by tricking a server into connecting to a listener they control. This rule identifies known vulnerable RPC interfaces and functions (including rare ones like MS-EVEN/ElfrOpenBELW) being used with a UNC path parameter that points to a public IP address.
Detects HTTP requests attempting to exploit several IoT device vulnerabilities leveraged by the ShadowV2 botnet to spread. This rule looks for specific URI paths and command injection payloads associated with known CVEs.
Detects network connections from Samsung Android devices that match the Command and Control (C2) patterns of the LANDFALL spyware. The rule identifies high-fidelity connections to known LANDFALL C2 IPs and domains, as well as lower-fidelity behavioral patterns, such as connections over HTTPS to non-standard ports.
Page 200 of 246