Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,876 detections
Filters
Last updated
All Time
Detection languages
2,951
1,378
313
289
239
Contributors
1,807
1,529
1,304
180
173
Categories
20,456
11,839
5,876
5,155
4,865
Platforms
3,744
1,857
1,076
782
160
Products / Services
2,238
1,434
1,273
746
582
MITRE Techniques
2,448
2,148
1,129
937
787
CVEs
19
15
9
7
5
IDS Classtypes
834
334
94
23
20
IDS Protocols
689
276
235
117
23
This rule monitors DeviceNetworkEvents to identify processes that are not typically associated with cloud storage and synchronization software initiating network connections on port 443 to popular cloud providers (OneDrive, SharePoint, Dropbox). This behavior is often indicative of data exfiltration to cloud storage services or potential command and control communication disguised as web traffic.
Detects instances where the Outlook process (OUTLOOK.EXE) initiates a network connection via port 445 (SMB) to an IP address that is not part of the internal private network ranges. This activity is highly anomalous for an email client and may indicate exploitation, data exfiltration, or attempts to relay NTLM credentials to a remote malicious SMB server.
This rule monitors DeviceNetworkEvents to identify processes that are not typically associated with cloud storage and synchronization software initiating network connections on port 443 to popular cloud providers (OneDrive, SharePoint, Dropbox). This behavior is often indicative of data exfiltration to cloud storage services or potential command and control communication disguised as web traffic.
Detects Server-Side Request Forgery (SSRF) attempts exploiting URL parser inconsistencies. Attackers use a 'github.com@' prefix within a URL parameter to trick backend fetchers into connecting to unintended, potentially internal, hosts like 'metadata.google.internal', bypassing validation logic that incorrectly parses the URL authority.
This rule detects when an Nginx web server proxies HTTP POST requests to FastCGI backends located on internal network subnets (RFC1918) or local unix sockets. Such behavior often indicates exploitation attempts targeting internal FastCGI interfaces, which should typically not be reachable directly from the internet-facing web server.
This rule detects network connections to known cloud storage, file hosting, and webhook services (Discord, Pastebin, Dropbox, Telegram, AnonFiles) initiated by processes other than standard web browsers. Such behavior is often indicative of data exfiltration or C2 activity using legitimate web services to blend in with normal traffic.
Detects attempts by processes to access the Google Cloud Platform Instance Metadata Service (IMS) at 169.254.169.254 or via the 'metadata.google.internal' DNS entry. This is often an indicator of reconnaissance, SSRF exploitation, or credential theft attempts by an adversary on a compromised cloud instance.
This rule detects activities associated with the NotDoor malware used by APT28 for email-based exfiltration. It specifically monitors for the creation of staging files in temporary directories, the use of Outlook.exe to establish external SMTP connections on common mail ports, and the transmission of emails to known adversary-controlled addresses.
Detects network connections from internal endpoints to Filen.io cloud storage domains and subdomains. The rule specifically flags interactions involving common API endpoints for file operations (upload, download, directory listing) as 'Critical' risk, while generic traffic to the domain is classified as 'High' risk.
This rule detects network connections from internal devices to identified APT Command and Control (C2) IP address ranges over common ports (8080, 443, 21, 22, 23, 25, 445). This traffic pattern is indicative of unauthorized external communication commonly associated with malware or adversary activity.
Detects anomalous high-rate outbound network scanning activity (targeting numerous distinct destination IPs and ports) originating from internal SOHO or edge devices (e.g., Cisco, Ubiquiti, Draytek hardware). This pattern is consistent with compromised devices acting as nodes within a botnet, such as the JDY cluster, conducting reconnaissance.
Detects browser processes connecting to internal IP addresses followed by a connection to an external (non-whitelisted) destination within a 2-minute window. This behavior is indicative of potential data staging or exfiltration, where a web browser is used to access internal resources before transferring data to an external site.
Detects instances of the legitimate Windows system utility fltMC.exe running from a temporary directory (Temp or tmp) that initiates network connections. This behavior is indicative of the JFMBackdoor malware masquerading as a system tool to perform network enumeration by leveraging APIs like GetExtendedTcpTable or GetExtendedUdpTable.
Detects outbound TCP traffic destined for known Tor relay ports (9001 and 9030) originating from internal RFC 1918 address space. This behavior is indicative of compromised edge devices or IoT hardware attempting to establish command and control (C2) communication via the Tor network, a tactic commonly used by threat actors to obfuscate their infrastructure and C2 traffic.
This rule detects potential deployment of the 'gs-netcat' utility by identifying specific suspicious command-line patterns or file masquerading (where a file's original name doesn't match its current filename while residing outside standard system paths). It correlates these process execution events with subsequent outbound network connections on high ports (>10000) within a 5-minute window to identify potential reverse shell activity.
Detects Server-Side Request Forgery (SSRF) attempts targeting the Google Cloud Platform (GCP) metadata server (169.254.169.254). The rule inspects RequestURL and RequestContext fields for indicators of metadata API access, URL parameter manipulation, authority confusion payloads, and encoding bypass techniques often used to access cloud instance metadata for unauthorized credential or information harvesting.
Detects unauthorized network connection enumeration using netstat or direct socket connections originating from fltMC.exe, which is indicative of JFMBackdoor activity. The rule monitors for netstat execution by fltMC.exe, netstat spawned from executables within temporary directories, and suspicious outbound network connections originating directly from fltMC.exe.
Detects browser processes connecting to internal IP addresses followed by a connection to an external (non-whitelisted) destination within a 2-minute window. This behavior is indicative of potential data staging or exfiltration, where a web browser is used to access internal resources before transferring data to an external site.
Detects high-frequency access to sensitive web paths (e.g., /admin, /vault, /credentials) from common web browsers on a device. This activity may indicate malicious credential harvesting, administrative panel enumeration, or sensitive data exfiltration performed by an adversary or malicious browser extension.
Detects browser processes connecting to internal IP addresses followed by a connection to an external (non-whitelisted) destination within a 2-minute window. This behavior is indicative of potential data staging or exfiltration, where a web browser is used to access internal resources before transferring data to an external site.
This rule detects potential JDY botnet activity characterized by host fingerprinting and data exfiltration patterns. It looks for repeated POST requests to specific URI patterns ('/gate', '/report', '/scan') accompanied by a significant volume of outbound data, indicative of automated C2 communication or data staging. The rule aggregates metrics per host to identify high-volume exfiltration patterns and calculates a risk score based on the frequency of requests and the diversity of destination IPs.
Page 189 of 280