Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,151 detections
Filters
Last updated
All Time
Detection languages
2,297
1,070
640
289
288
Contributors
918
814
769
696
224
Categories
20,439
11,829
5,873
5,151
4,864
Platforms
2,854
2,017
813
521
213
Products / Services
1,334
1,144
831
576
366
MITRE Techniques
1,820
1,307
787
746
577
CVEs
9
7
7
6
6
IDS Classtypes
538
151
101
57
48
IDS Protocols
375
373
132
64
42
Detects potential SSH agent hijacking where process command line activities reference SSH authentication sockets or environment variables, followed closely by a successful SSH connection to a remote host from the same device.
The following analytic detects SSH connections presenting client banners that do not match known, common SSH client software by leveraging Zeek ssh logs.
Unusual or unknown SSH client banners may indicate custom tooling, offensive frameworks, tunneling utilities, or malware using SSH for command-and-control or lateral movement.
Unusual or unknown SSH client banners may indicate custom tooling, offensive frameworks, tunneling utilities, or malware using SSH for command-and-control or lateral movement.
Sweeps network, process command-line and URL-click telemetry for the Kimsuky payload C2 domain and its subdomains using an anchored match, which avoids lookalike or suffix-matching domains.
Detects network connections, process command-line executions, and email URL info matching known APT28 (Swallowtail, HOOKEDGE, LegionRelay) indicators of compromise, including specific IP addresses and GUIDs.
Detects network connections, process command-line executions, and email URL info matching known APT28 (Swallowtail, HOOKEDGE, LegionRelay) indicators of compromise, including specific IP addresses and GUIDs.
IOC sweep (SHA256, domains, URLs, IPs, sender emails) for the RedFlick-style VHDX/LNK/WebDAV campaign against Moldovan and Ukrainian civil society, with false-positive controls.
IOC sweep (SHA256, domains, URLs, IPs, sender emails) for the RedFlick-style VHDX/LNK/WebDAV campaign against Moldovan and Ukrainian civil society, with false-positive controls.
IOC sweep (SHA256, domains, URLs, IPs, sender emails) for the RedFlick-style VHDX/LNK/WebDAV campaign against Moldovan and Ukrainian civil society, with false-positive controls.
Detects network connections to known Indicators of Compromise (IOCs) associated with the TraderTraitor campaign, including trojanized Terraform providers (FLATROOF/ROOFDECK malware families) using specific domains and URL paths.
Detects network connections to known Indicators of Compromise (IOCs) associated with the TraderTraitor campaign, including trojanized Terraform providers (FLATROOF/ROOFDECK malware families) using specific domains and URL paths.
Sweeps endpoint and firewall telemetry for connections to the two high-confidence BraZetsu infrastructure IPs. Review hits against the IP's first-seen date before blocking because the Njalla host has changed service.
Sweeps proxy, firewall and endpoint network telemetry for requests to the three published BraZetsu Pastebin dead-drop raw URLs used to retrieve the XOR-encrypted C2 config.
Sweeps endpoint and firewall telemetry for connections to the two high-confidence BraZetsu infrastructure IPs. Review hits against the IP's first-seen date before blocking because the Njalla host has changed service.
Detects network, file, process, and email interactions associated with known IOCs related to Power BI phishing and rogue ScreenConnect campaigns over a 30-day lookback period.
Sweeps Defender XDR telemetry for known NEBULA / KNTRAT indicators (SHA256 hashes, C2 IP, decoy domain and URLs, burner publisher emails). Hash matching is scoped per table (execution hash only in process events), noisy tooling is excluded from command-line matches, network hits are limited to connection events, and results are aggregated per device and IOC.
Detects when a device connects to a wireless network SSID that has not been observed in the baseline over the previous 14 days.
Detects the PatchAgent Stage 3 HTTP C2 protocol recovered from the decrypted shellcode: plain HTTP requests to /api/checkin, /api/cmd/, or /api/result/ combined with the hardcoded, truncated User-Agent "Mozilla/5.0 (Windows NT 10.0; Win64; x64)" (a real browser UA continues past this). Matching the API path plus the exact short UA keeps this durable across C2 IP rotation (observed on 46.30.188[.]99 and 185.228.83[.]217, port 8443).
Detects HTTP requests to a Cloudflare Workers subdomain
(*.workers.dev) targeting the /token/v1/{UID} signaling endpoint, originating
from a headless Chrome user agent. Chaos ransomware's msaRAT offloads all C2
signaling to the browser via CDP-injected JavaScript, performing WebRTC SDP
Offer/Answer exchange through this trusted developer platform to evade domain
reputation blocking.
(*.workers.dev) targeting the /token/v1/{UID} signaling endpoint, originating
from a headless Chrome user agent. Chaos ransomware's msaRAT offloads all C2
signaling to the browser via CDP-injected JavaScript, performing WebRTC SDP
Offer/Answer exchange through this trusted developer platform to evade domain
reputation blocking.
Detects script-driven (curl, wget, python) outbound connections to
AI/LLM API endpoints. The campaign uses legitimate AI platform APIs as covert
command, control, and exfiltration channels, blending malicious traffic with
approved web services to evade network-based detection.
AI/LLM API endpoints. The campaign uses legitimate AI platform APIs as covert
command, control, and exfiltration channels, blending malicious traffic with
approved web services to evade network-based detection.
Correlates ARTEX tool artifacts on a device with that device contacting the ARTEX host, xcai.pro, or the DeepSeek API within 24 hours.
Detects network connections, process executions, file creations, and image loads associated with the UNC7017 AOMEI supply chain campaign IOC sweep, including specific malicious URLs, domains, IPs, file paths, and hashes.
Page 6 of 246