Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,876 detections
Filters
Last updated
All Time
Detection languages
2,951
1,378
313
289
239
Contributors
1,807
1,529
1,304
180
173
Categories
20,456
11,839
5,876
5,155
4,865
Platforms
3,744
1,857
1,076
782
160
Products / Services
2,238
1,434
1,273
746
582
MITRE Techniques
2,448
2,148
1,129
937
787
CVEs
19
15
9
7
5
IDS Classtypes
834
334
94
23
20
IDS Protocols
689
276
235
117
23
Detects network connection attempts or DNS queries to a set of specific domains ('holabrief.com', 'loopedin.io') that are known to be associated with suspicious activity or potential command and control infrastructure.
Detects potential phishing activity involving a two-hop open-redirect chain. The rule monitors for an initial navigation to known SaaS platforms (HolaBrief or LoopedIn), followed within one minute by an outbound request to an external destination where the SaaS domain is present in the HTTP referrer header, indicating a redirect-based phishing mechanism.
This rule detects outbound network connections to the specific IP address 38.60.253.35 on port 8084. Such traffic is highly suspicious and indicative of potential communication with a Command and Control (C2) server.
Detects the SNOWLIGHT dropper (disguised as the Windows Update Service 'wusvc.exe') attempting to establish an outbound network connection to a known malicious C2 infrastructure (38.60.253.35) on port 8084. The rule also accounts for the use of non-standard port communication and monitors for suspicious process masquerading outside of protected system directories.
Detects the execution of unauthorized network scanning tools (e.g., netscan.exe, n.exe), usage of reconnaissance PowerShell scripts like Invoke-ShareFinder, or the creation of common reconnaissance artifacts such as 'delete.me' or 'shares.txt'. The rule monitors Sysmon process creation, network connection events, and file creation events to identify activities consistent with internal network discovery and lateral movement preparation.
Detects DNS resolution and network connections to known infrastructure associated with the StegoAd campaign, including exfiltration (mitarchive.info) and C2 (liveupdt.com, dealctr.com, ipaglov.com) domains. The rule monitors activity from common browser and scripting engine processes.
This rule detects abnormal, high-frequency network connection patterns originating from common web browser processes (msedge.exe, chrome.exe, brave.exe). It identifies scenarios where a browser process makes repetitive connections to a very small set of non-standard external domains, excluding common legitimate browser-related traffic. This behavior is indicative of background polling or C2 activity, such as that observed in malicious browser extensions (e.g., StegoAd) following an activation period.
Detects post-exploitation activities related to the PHP 8.5.7 CVE-2025-15661 StreamBucket SOAP vulnerability. This rule monitors for PHP worker processes spawning shells, writing executable files to suspicious directories, executing system binaries on Windows, or initiating outbound network connections on non-standard ports, including specific proof-of-concept markers.
This rule detects outbound network connections to URLs associated with common file sharing services (e.g., Dropbox, Mega, Gofile) or temporary email providers (e.g., Temp-Mail). Such connections can indicate data exfiltration attempts, use of unsanctioned services, or communication with command and control infrastructure.
This rule detects network connections from devices to a predefined list of known malicious domains. It identifies attempts by internal systems to communicate with command and control servers, phishing sites, or other infrastructure associated with threat actors.
This rule detects potentially malicious data exfiltration activity. It identifies sequences of events where a process performs file enumeration (directory listing), followed by the creation of a ZIP or RAR archive in temporary or local application data directories with randomized filenames. Finally, it correlates this behavior with subsequent outbound network connections from the same process to known cloud storage and file-sharing providers, flagging anomalous archive creation rates.
This rule detects network connections and email URLs that match known typosquatted patterns of Microsoft domains. It aims to identify potential phishing attempts or traffic directed to infrastructure used by the 'Bulletproof Redirect Engine' masquerading as legitimate Microsoft services. The logic filters out legitimate Microsoft-related URLs to minimize false positives.
Detects network connections from suspicious or unexpected processes to common public webhook and automation services, which may indicate data exfiltration or automated C2 communication.
This rule detects network activity associated with the easy-day-js Mastra npm supply chain attack. Specifically, it identifies data exfiltration over TLS to a secondary C2 server (23.254.164.123:443) and the download of a stage-2 payload from a primary C2 server (23.254.164.92:8000) via HTTP, looking for the URI '/update/49890878'.
This rule detects network connections made to specific non-standard ports (7777, 8080, 8443) where the remote URL contains substrings associated with proxy or tunneling activities ('proxy', 'tunnel', 'hide'). This behavior is commonly associated with malware attempting to evade security controls by routing traffic through unauthorized intermediaries or obfuscated tunnels.
Detects network traffic associated with known Cobalt Strike Beacon request URI patterns. This rule utilizes network signature inspection to flag outbound connections containing URI fragments commonly used by Cobalt Strike default profiles.
This rule detects anomalous network connections or DNS queries to known Ethereum RPC infrastructure providers (Infura, Alchemy, Cloudflare-eth) or ports/domains associated with Ethereum mainnet activity. It specifically targets processes other than common browsers or known blockchain clients, as well as Java-based processes performing DNS lookups for these domains. This behavior is indicative of potential 'EtherHiding' techniques where malicious code or data is hidden within blockchain transactions or distributed via blockchain infrastructure.
Detects anomalous outbound network connections initiated by powershell.exe occurring within 5 minutes of an inbound network connection on TCP port 1313, a pattern indicative of the exploitation of the Remote Mouse unauthenticated remote code execution (RCE) vulnerability and subsequent establishment of a reverse shell.
Detects outbound network connections over standard SSH ports (22, 2222) initiated by process names typically associated with web requests or package management (curl, git, php), potentially indicating unauthorized remote access, lateral movement, or data exfiltration from a compromised host to an external, non-private network address.
This rule detects anomalous activities associated with RustDesk, such as spawning suspicious child processes, dropping files related to known session permission bypass proof-of-concepts, communicating with non-standard relay servers, or performing file write operations in sensitive system temporary directories, which indicates potential session hijacking or unauthorized remote access.
Detects network activity associated with the Grandoreiro banking trojan, specifically identifying C2 communication tunneled over WebRTC/STUN (port 3478) or MQTT (Azure/Google Cloud services) originating from processes executing out of the AppData\Local directory. This behavior aligns with Grandoreiro's known DLL side-loading mechanism where legitimate but vulnerable binaries are used to load malicious libraries.
Page 186 of 280