Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,876 detections
Filters
Last updated
All Time
Detection languages
2,951
1,378
313
289
239
Contributors
1,807
1,529
1,304
180
173
Categories
20,456
11,839
5,876
5,155
4,865
Platforms
3,744
1,857
1,076
782
160
Products / Services
2,238
1,434
1,273
746
582
MITRE Techniques
2,448
2,148
1,129
937
787
CVEs
19
15
9
7
5
IDS Classtypes
834
334
94
23
20
IDS Protocols
689
276
235
117
23
Detects suspicious interactions with Google Cloud Pub/Sub APIs occurring shortly after an OAuth2 token request, specifically when the activity is performed by processes other than standard Google Cloud SDK tools (gcloud, gsutil, etc.). This behavior may indicate an attempt to utilize stolen OAuth tokens to exfiltrate or manipulate data within a GCP environment.
This rule detects when a command-line shell (bash, sh, cmd, powershell) is spawned by a parent process (curl, git, php, ssh) that has recently established an outbound network connection on port 22 (SSH). It also flags instances where the child shell process subsequently opens a network listener, often indicating a potential reverse shell or unauthorized remote access attempt.
Detects suspicious PowerShell processes executing common system reconnaissance commands (e.g., whoami, net group, ipconfig) combined with network communication indicators, specifically HTTP method or body flags, or connections to known suspicious IP addresses.
This rule monitors DeviceNetworkEvents for connections to domains that match naming patterns and TLDs frequently associated with the Ghostwriter/UNC1151 threat group. The rule specifically looks for URLs containing common credential-harvesting keywords (e.g., login, verify, account) combined with specific TLDs (e.g., .digital, .icu, .cc.cd). Connections to known common public DNS providers are excluded.
Detects DNS queries and network connection attempts to a set of known malicious domains associated with the threat actor UNC1151 (Ghostwriter). This rule monitors both DNS resolutions and direct network connection attempts to these indicators of compromise (IOCs), which are commonly used in spearphishing campaigns.
Detects browser-based network connections to URLs containing Google or Gmail branding where the resolved IP address does not match the expected Google IP address prefixes. This behavior is indicative of an Adversary-in-the-Middle (AiTM) phishing attack, where a user is being redirected to a malicious proxy server that mimics the legitimate Google login service to intercept credentials and MFA tokens.
This rule monitors DeviceNetworkEvents for connections to domains that match naming patterns and TLDs frequently associated with the Ghostwriter/UNC1151 threat group. The rule specifically looks for URLs containing common credential-harvesting keywords (e.g., login, verify, account) combined with specific TLDs (e.g., .digital, .icu, .cc.cd). Connections to known common public DNS providers are excluded.
Detects outbound network connections to common Mythic C2 ports initiated by processes identified as compiler-related binaries (Go, Zig, Rust) or binaries running from suspicious, user-writable directories (Temp, AppData, etc.). This behavior is consistent with the execution of staging or initial implants associated with the Mythic post-exploitation framework.
Detects unauthorized HTTPS POST requests to sensitive GitHub API endpoints (gists, repository contents, user emails) originating from standard command-line tools like curl, node, and PowerShell. Additionally, it identifies suspicious git push operations initiated from within node-based installation scripts, which is indicative of credential harvesting and exfiltration behaviors exhibited by the Miasma worm.
Detects outbound HTTP POST beaconing to known malicious C2 infrastructure (83.142.209.214) associated with the lambsys cryptominer campaign. The rule specifically looks for HTTP requests to /status.php or /setup_status.php utilizing the default Go HTTP client User-Agent, a common indicator of this specific malware.
Detects outbound network connections initiated by common AI agent runtime processes (Python, Node.js, OpenClaw) to external destinations that are not identified as known AI service providers, specifically focusing on non-standard ports or the use of WebSocket protocols. This behavior may indicate an AI agent being used for unauthorized data exfiltration, command-and-control communication, or interaction with an unverified external service.
Detects instances where the Excel process (excel.exe) initiates outbound network connections to non-private IP addresses on specific ports often associated with command and control or data exfiltration. This rule specifically excludes known Microsoft-owned CDN and update infrastructure, aiming to identify potential exploitation activity, such as that potentially associated with CVE-2025-60727.
USB worm and loader leveraging living-off-the-land binaries
Phishing-as-a-Service kit abusing OAuth device code flow against Microsoft 365
This rule detects potential internal network reconnaissance activities by monitoring for either mass execution of network discovery commands (such as 'net view' or 'net share') targeting multiple unique hosts within a 5-minute window, or by monitoring for mass outbound network connections to port 445 (SMB) across multiple unique destination hosts within the same timeframe. This behavior is indicative of an attacker attempting to map available network shares or identify reachable systems for lateral movement.
Detects network traffic associated with known Cobalt Strike Beacon request URI patterns. This rule utilizes network signature inspection to flag outbound connections containing URI fragments commonly used by Cobalt Strike default profiles.
Detects potential Command and Control (C2) infrastructure rotation and DNS exfiltration by correlating DNS-over-HTTPS (DoH) traffic to Google Public DNS (8.8.8.8) with concurrent outbound connections to a high count (>=5) of distinct external IP addresses within a one-hour window. This behavior is consistent with the Nightmare Eclipse/VerdantBamboo post-disclosure tactical shifts to obfuscate DNS queries and rotate C2 endpoints.
Detects network activity initiated by qemu-system-x86_64.exe to internal subnets using common lateral movement ports (21, 88, 389, 445, 636) or the execution of known tools netbird.exe or cookie_exporter.exe. This rule flags potential virtualization-based lateral movement or unauthorized tool usage.
Open-source derived remote access trojan with plugin architecture
Detects network connection activity originating from QEMU virtualization processes (qemu-system-x86_64, qemu-system-i386, qemu-system-aarch64) to external (non-private/non-local) IP ranges. This could indicate the use of virtualization tools to facilitate tunneling, proxying, or lateral movement within an environment.
Detects suspicious activities related to the execution of qemu-system-x86_64, including scheduled task creation referencing 'TPMProfiler', execution under the SYSTEM account, and outbound network communication to known malicious IP addresses on specific ports (22, 32567, 22022).
Page 187 of 280