Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,876 detections
Filters
Last updated
All Time
Detection languages
2,951
1,378
313
289
239
Contributors
1,807
1,529
1,304
180
173
Categories
20,456
11,839
5,876
5,155
4,865
Platforms
3,744
1,857
1,076
782
160
Products / Services
2,238
1,434
1,273
746
582
MITRE Techniques
2,448
2,148
1,129
937
787
CVEs
19
15
9
7
5
IDS Classtypes
834
334
94
23
20
IDS Protocols
689
276
235
117
23
Detects processes attempting to connect to the Cloud Instance Metadata Service (IMDS) IP address (169.254.169.254) or referencing it in the command line. This behavior is often associated with credential theft or reconnaissance on cloud instances.
Detects potential lateral movement activity where PowerShell or the Windows Remote Management (WinRM) host process (wsmprovhost.exe) initiates network connections to multiple distinct destination IP addresses over the WinRM default ports (5985/5986). This behavior is characteristic of an adversary using legitimate remote administration tools to pivot or spread across a network.
Detects anomalous network activity originating from 'NearShareReceive.exe' (Windows Near Share) to public IP addresses on non-standard ports, potentially indicating unauthorized use of the Near Share feature for data staging or exfiltration.
This rule detects the execution of python.exe or python3.exe using the '-m init' command line flag while attempting to establish a network connection over specific, often non-standard, ports (4444, 1337, 9001, 9002, 5555, 6666, 7777, 8888). This pattern is commonly associated with reverse shells or C2 agent check-ins initiated via Python scripts.
Detects suspicious behaviors during npm package lifecycle events, specifically node.exe spawning command-line interpreters (cmd.exe, powershell.exe, etc.) or initiating network connections to known malicious or suspicious domains typically associated with npm supply chain attacks.
Detects potential command and control (C2) activity from node.exe to known malicious domains associated with the Polymarket Trap / wshu.net campaign. Additionally, it monitors for suspicious child process spawning by node.exe, including usage of downloader utilities (curl, wget, PowerShell) or execution of downloaded scripts/archives (npm, .tgz files) indicative of malicious post-exploitation activity.
Detects network activity and process execution patterns associated with the Amadey loader and Operation FlutterBridge. The rule monitors for unauthorized file downloads from self-hosted GitLab repositories using raw paths, delivery of malicious archives like 'protected.zip', and the execution of common downloaders (PowerShell, cmd, curl, wget) triggered by known Amadey process artifacts (Yfgfwb.exe).
This rule detects suspicious network connections originating from internal IP addresses to common service ports (DNS, SMB, RDP, WinRM) on remote, non-internal IP addresses. It flags instances where a single process on a device makes 10 or more such connections within an hour, which could indicate reconnaissance, lateral movement, or data exfiltration attempts.
This rule detects devices making a high volume of successful network connections to GitHub's API endpoints (api.github.com or api.releases). A count of 5 or more successful connections within an hour from a single device is considered suspicious and could indicate data exfiltration, automated tooling, or unusual development activity.
This rule detects successful network connections to known paste sites like Pastebin or Gist. Adversaries often use these services to host malicious code, exfiltrate data, or for command and control (C2) communications. Monitoring such connections can help identify potential data exfiltration attempts or the download of malicious content.
Detects the execution of ServiceModelReg.exe followed by suspicious network or file system activity. ServiceModelReg.exe is a legitimate Windows utility that may be abused by adversaries for process hollowing or masquerading to evade defenses.
Detects high-volume, rapid outbound network requests from Opera or Opera GX browser processes, characteristic of CSS attribute-selector trigram enumeration used in XS-Leak attacks to exfiltrate sensitive information from loaded web pages.
Detects network activity associated with the EKZ Stealer malware, specifically an HTTP POST request used to exfiltrate base64-encoded credentials to a known malicious destination at 83.138.53.110/service/save.php.
Detects instances where the Outlook process (OUTLOOK.EXE) initiates a network connection over SMB (port 445) to an external, non-private IP address. This behavior is highly suspicious as Microsoft Outlook should typically not be performing direct SMB connections to external systems, and this is often indicative of an adversary attempting to leverage malicious documents or templates to perform credential harvesting via NTLM relay or SMB authentication captures.
This rule detects activities associated with the NotDoor malware used by APT28 for email-based exfiltration. It specifically monitors for the creation of staging files in temporary directories, the use of Outlook.exe to establish external SMTP connections on common mail ports, and the transmission of emails to known adversary-controlled addresses.
Detects suspicious OpenProcess calls initiated by common user applications (explorer.exe, winword.exe, outlook.exe) targeting svchost.exe, followed by an outbound network connection from the target svchost.exe to the file sharing service filen.io within a 30-minute window. This behavior is indicative of process injection used to facilitate network communication or data exfiltration under the guise of a system process.
Detects instances where the Windows script hosts wscript.exe or cscript.exe establish outbound network connections to common web ports (HTTP/HTTPS) on external IP addresses. This behavior is frequently associated with script-based malware, droppers, or C2 beacons.
Detects outbound HTTP requests to a known phishing infrastructure panel associated with the Montana Empire malware campaign, specifically targeting the /mentalite.php endpoint on pttvm.com.
This rule detects network connections or process command lines referencing 'easyupload.io' and 'limewire.com', as well as searches for 'eayupload'. These indicators are often associated with unauthorized file transfers or potentially malicious activity involving known file sharing platforms.
Detects DNS queries for domains that are visually or phonetically similar to popular software package registry domains (such as PyPI or npm). These are often used in typosquatting campaigns to trick users or automated systems into downloading malicious packages.
This rule detects network connections to phishing pages hosted on the workers.dev domain that are attempting to interact with EvilTokens device code API endpoints. These pages are known to implement developer hotkey prevention (F12 blocked, context menu disabled) to hinder in-browser analysis, indicating malicious intent.
Page 184 of 280