Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,154 detections
Filters
Last updated
All Time
Detection languages
2,300
1,070
640
289
288
Contributors
918
814
769
696
224
Categories
20,453
11,838
5,876
5,154
4,865
Platforms
2,857
2,017
816
524
213
Products / Services
1,335
1,144
831
576
366
MITRE Techniques
1,822
1,307
787
746
577
CVEs
9
7
7
6
6
IDS Classtypes
538
151
101
57
48
IDS Protocols
375
373
132
64
42
Detects the Kimsuky TTP of using legitimate cloud services like GitHub and Google Drive to download and subsequently execute malicious payloads, often using interpreters like mshta.exe or rundll32.exe.
This query identifies an anomalous pattern associated with behavior performed using the PhaaS platform with adversary-in-the-middle (AiTM) capabilities, Tycoon2FA.
This query identifies an anomalous pattern associated with behavior performed using the PhaaS platform with adversary-in-the-middle (AiTM) capabilities, DadSec.
Detects network traffic to a known Command and Control (C2) server (136.243.146.46:8898) associated with the YiBackdoor malware.
Detects a potential ToddyCat APT technique where a single source remotely accesses sensitive browser or DPAPI credential files on multiple hosts via SMB. This behavior is consistent with the group's TomBerBil PowerShell script used for widespread credential harvesting.
Detects activity associated with the Hannibal Stealer, a .NET info-stealer known for targeting cryptocurrency wallets, VPN configurations, and browser data.
Detects network traffic to Solana RPC endpoints containing the wallet address associated with the GlassWorm malware. GlassWorm uses the Solana blockchain as a resilient C2 mechanism by querying for transactions from an attacker-controlled wallet.
Detects behaviors associated with the LCRYX VBScript ransomware, including modification of the hosts file to block security sites and the download of additional malicious payloads from known malicious URLs.
This rule detects Command and Control (C2) beaconing activity associated with the UNC1549 threat group and the LIGHTRAIL malware. It specifically looks for HTTP traffic with a URI containing '/news', an 'Upgrade: websocket' header, and a distinct User-Agent string 'Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Safari/537.36 Edge/12.10136'. This combination of indicators suggests an attempt to tunnel C2 communications over HTTP, potentially masquerading as legitimate WebSocket traffic.
Detects the Visual Basic Compiler (vbc.exe) initiating DNS queries. This is highly anomalous behavior, as vbc.exe is a compiler and should not be making network connections. This technique is used by malware like Lokibot for defense evasion after process injection.
Detects when multiple distinct domains, where at least one is known malicious, share the same HTTP body SHA1 hash or favicon MD5 hash. This pattern is indicative of threat actor infrastructure reuse and templating, as described in analysis of campaigns like LaundryBear and FreeDrain.
This rule detects TLS connections to domains associated with Gh0st RAT impersonation campaigns, specifically 'Campaign Trio' and 'Campaign Chorus'. It looks for specific strings ('i4tools', 'youdao', 'deepseek') in the TLS Server Name Indication (SNI) field, combined with top-level domains like '.top' or '.vip'. This pattern indicates potential command and control (C2) communication from Gh0st RAT malware.
IOCs and behavior from Danabot version 669
Detects network connections to Pastebin.com from a Python process. This behavior is associated with the InvisibleFerret malware, as part of the 'Contagious Interview' campaign, which retrieves additional payloads from Pastebin.
Detects network connections from Node.js to specific JSON storage services known to be abused by the 'Contagious Interview' campaign. Threat actors host malicious code on these services, which is then fetched and executed by trojanized applications as part of a social engineering scheme.
DOS Sustained ICMP Flood Attempt
Suricata
This rule detects a sustained ICMP flood attempt, which is a type of Denial of Service (DoS) attack. It triggers an alert if more than 100 ICMP packets (type 8, echo request) are observed from an external network to the home network within a 10-second window, tracked per source IP. This indicates an adversary is attempting to overwhelm the target system or network with ICMP traffic.
Detects outbound network connections to a specific .onion domain associated with the 'Tsunami Payload' component of the 'Contagious Interview' campaign, which uses the Tor network for command and control (C2) communications.
This rule detects a high rate of ICMP echo requests from a single source to a server within the home network, indicating a potential Denial of Service (DoS) attack. It triggers an alert if more than 50 ICMP echo requests are observed from the same source within a 1-second interval.
Detects the execution of Cloudflared with command-line arguments associated with creating a persistent tunnel or installing it as a service. This technique is used by the Kraken ransomware group for persistence and command and control.
This rule detects emails or URL click events containing a specific pattern associated with 'quantum.php' within the URL. This pattern is often indicative of phishing attempts, particularly those designed to harvest credentials or deliver malware.
This rule detects network traffic indicative of Kraken Ransomware activity, specifically looking for connections to Cloudflared tunnels. It identifies TLS SNI (Server Name Indication) containing '.trycloudflare.com', which is a domain used by Cloudflare for its tunnel services. This behavior is often leveraged by adversaries for command and control or data exfiltration, as it can help bypass traditional firewall rules and obscure the true destination of the traffic.
Page 201 of 246