Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,876 detections
Filters
Last updated
All Time
Detection languages
2,951
1,378
313
289
239
Contributors
1,807
1,529
1,304
180
173
Categories
20,456
11,839
5,876
5,155
4,865
Platforms
3,744
1,857
1,076
782
160
Products / Services
2,238
1,434
1,273
746
582
MITRE Techniques
2,448
2,148
1,129
937
787
CVEs
19
15
9
7
5
IDS Classtypes
834
334
94
23
20
IDS Protocols
689
276
235
117
23
Detects DcRAT (Operation DragonReturn) malware beaconing to a known C2 IP address (223.26.63.40) following the execution of suspicious sideloaded binaries, specifically 'Mixed Reality.exe' or 'COU_ITR-1_to_4_AY2026-27.exe', which then inject malicious code into svchost.exe.
Detects network connections to Google Cloud services (calendar.google.com, googleapis.com) over port 443 originating from processes other than known web browsers or standard Google background applications. This behavior may indicate unauthorized tools, custom scripts, or malware using Google services for command and control or data exfiltration.
This rule identifies outbound network connections from devices to public IP addresses using ports commonly associated with the Tor network (9001, 9030, 9050, 9051). These ports are frequently used for Tor relay, bridge, and control functionality, and connections to them from managed endpoints may indicate unauthorized use of the Tor network for anonymity or malicious command-and-control communication.
Detects wscript.exe executing VBScript that uses the MSXML2.XMLHTTP component to perform an HTTP GET request to a specific Kimsuky C2 URL (acnms.dmdoc.dynv6.net). This activity is associated with a multi-stage infection chain where a VBScript file retrieves and executes a subsequent stage from the specified remote endpoint.
This rule detects network activity indicating a potential modification or interaction with Microsoft Entra ID (Azure AD) multifactor authentication (MFA) settings. Specifically, it looks for POST requests to the Microsoft Graph API targeting authentication methods (e.g., phoneAuthenticationMethod), which may be indicative of an attacker modifying MFA settings to bypass security controls or register rogue authentication devices.
Detects Microsoft Office applications spawning suspicious child processes (e.g., cmd.exe, rundll32.exe) or initiating network connections to WebDAV paths, which may indicate exploitation of ActiveX OLE auto-execution vulnerabilities.
Detects network connections over port 3389 (RDP) initiated by processes other than standard Remote Desktop clients (mstsc.exe). This rule specifically looks for suspicious indicators such as execution from non-standard or temporary file paths, or the use of common living-off-the-land binaries (like powershell.exe, cmd.exe, rundll32.exe) that might be acting as a proxy for remote access or lateral movement.
Detects the Ghazwa spyware, attributed to APT36, querying sensitive Android system resources (CallLog and SMS Content Providers) from an application that is not a native dialer or messaging app. The rule further correlates this data access with subsequent outbound network activity, indicating potential data exfiltration.
Detects anomalous surveillance-like behavior on Android devices associated with the APT36 Ghazwa spyware. The rule identifies applications that check more than 8 distinct sensitive Android permissions within a 60-second window, followed immediately by an outbound HTTP/HTTPS POST request to an external IP, indicative of spyware pre-staging and data exfiltration.
Detects evidence of the 'smart_window' campaign, which exploits Firefox's SmartWindow feature to exfiltrate private browsing URLs. The rule identifies suspicious outbound network requests to attacker-controlled endpoints containing specific query parameters, the creation of known PoC artifact files, and the spawning of unexpected child processes by the Firefox browser.
Detects potential data exfiltration from Microsoft 365 Copilot sessions where the Bing 'Search by Image' functionality is abused as an SSRF proxy. The rule identifies network requests containing external URLs within the 'imgurl' parameter, occurring shortly after Copilot activity, suggesting that internal or sensitive data (such as emails, calendar items, or MFA context) is being transmitted to an unauthorized external endpoint.
Detects Distributed Component Object Model (DCOM) lateral movement activity by monitoring for mmc.exe and dllhost.exe network connections to non-local endpoints or when these processes are spawned by suspicious parent processes typically associated with command execution or malicious behavior.
Detects network communication associated with BeepRAT malware, specifically targeting hardcoded TCP connections to destination port 18848 and ICMP packets containing the string 'BEEP', which are used for C2 communication and keepalive signals.
Detects potentially malicious child process creation or unauthorized outbound network connections initiated by AI-assisted coding tools (e.g., Claude, Cursor, Windsurf) through their integrated Node.js or Python environments. This rule identifies common post-exploitation behaviors such as shell execution, command-line reconnaissance, and connections to external non-internal IP addresses.
Detects the suspicious creation of executable files in C:\ProgramData with randomized paths, typically associated with the SystemBC backdoor. The detection rule correlates this file creation event with co-occurring suspicious activities indicative of ransomware operations, such as the creation of known ransomware-related files (e.g., decryptor notes) or signs of lateral movement via non-standard network traffic and SMB activity.
Detects network requests to a typosquatted domain 'perplexity-ai.online' initiated by a malicious browser extension. The extension uses the 'suggest_url' feature to exfiltrate keystrokes typed into the browser omnibox in real-time, effectively performing browser-based keylogging.
This rule identifies suspicious outbound network beaconing by analyzing flow statistics for consistency in interval and payload size. It flags processes that demonstrate periodic communication (heartbeats) to external endpoints on non-standard ports. The detection logic calculates a 'beacon_score' based on the consistency of the communication interval, small average payload sizes, low variance in payload sizes, and the number of connections. Additional weighting is applied to connections made by typically non-network processes (e.g., svchost, explorer, wscript) or those connecting to ports associated with known malware like SystemBC.
Detects evidence of Djinn Stealer malware activity, including unauthorized access to web browser credential stores, suspicious child process creation by the SimpleHelp RMM daemon, and network communication with a known command-and-control server (96.126.130.126:58942) using a specific telemetry client user agent.
This rule detects potential persistence mechanisms by monitoring the creation of scheduled tasks using the 'schtasks' utility or modifications to Windows Registry 'Run' keys, specifically targeting suspicious paths (AppData, Temp, or ProgramData). The detection logic correlates these suspicious persistence artifacts with network activity by joining the events with Sysmon Event ID 3 (Network connection) to identify hosts communicating over common C2-associated ports (4000, 4001, 4002, 443) to non-private IP addresses. A risk score is calculated based on the presence of these persistence markers and outbound network connections.
Detects instances where AI coding assistants (e.g., Claude Code, Cursor, Windsurf) spawn shell interpreters or scripting runtimes that subsequently initiate outbound network connections to non-private IP addresses. This behavior is indicative of potential malicious activity, such as credential theft or workspace trust bypass exploits (e.g., CVE-2026-12957), where an attacker leverages an AI coding assistant to execute arbitrary code. The rule excludes common build and test runner processes to minimize false positives.
This rule detects activities associated with domain enumeration and discovery. It monitors for the execution of known offensive tools like SharpADWS, network scanners, and specific PowerShell/command-line operations that query Active Directory groups and computers. Additionally, it identifies unauthorized network connections to the Active Directory Web Services (ADWS) port 9389, which can indicate an attacker attempting to interact with the domain environment directly from a compromised host.
Page 180 of 280