Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,876 detections
Filters
Last updated
All Time
Detection languages
2,951
1,378
313
289
239
Contributors
1,807
1,529
1,304
180
173
Categories
20,456
11,839
5,876
5,155
4,865
Platforms
3,744
1,857
1,076
782
160
Products / Services
2,238
1,434
1,273
746
582
MITRE Techniques
2,448
2,148
1,129
937
787
CVEs
19
15
9
7
5
IDS Classtypes
834
334
94
23
20
IDS Protocols
689
276
235
117
23
Detects network communication associated with AsyncRAT command-and-control activity. The rule identifies established outbound connections on non-standard ports (6606, 7707, 8808) containing a specific 3-byte null sequence header, which is indicative of AsyncRAT's communication protocol.
Detects network traffic (DNS, TLS/HTTPS) communicating with the secondary hosting domain 'fileget.loseyourip.com' specifically attempting to retrieve potential payloads mimicking legitimate software (e.g., OBS Studio installer).
Detects outbound network connections (DNS queries or direct IP connections) to a set of known domains frequently associated with software cracking tools, unauthorized installers, or potentially unwanted programs (PUPs).
This rule detects network connections, specifically DNS queries or URL hits, to the domain 'facture-in.pages.dev'. It also looks for specific, indicative language within the RemoteUrl often associated with credential harvesting or phishing landing pages (e.g., 'no_mouse', 'wrong_timezone', 'A verificar o acesso').
Detects outbound HTTP requests to 'pastebin.com' retrieving raw content, a technique commonly used by Ousaban malware to fetch command-and-control (C2) configurations from legitimate paste sites.
Detects the execution or network communication involving python-build-standalone, a tool often used by developers to deploy portable Python environments. In an environment, the unauthorized use of this tool may indicate an adversary attempting to deploy their own Python interpreter to execute malicious scripts, effectively bypassing environment-specific restrictions or configurations.
This rule detects outbound FTP traffic containing the 'STOR' command, which is used in the FTP protocol to upload files to a remote server. This behavior is a common indicator of unauthorized data exfiltration.
Detects the transmission of a Metasploit Meterpreter stage over HTTP, identified by an application/octet-stream response containing the DOS MZ header signature.
Detects outbound UDP traffic over port 3478 (STUN) initiated by common web browsers. This pattern is commonly used by phishing-as-a-service (PaaS) platforms like Bluekit to perform WebRTC IP leak checks, potentially revealing a victim's real IP address behind a proxy or VPN. The rule excludes common communication platforms like Microsoft Teams, Zoom, and Webex to reduce false positives.
Detects network communication with known malicious domains associated with fraudulent or malicious 'Adblock for YouTube' browser extensions, as well as suspicious process command lines related to main world script injection performed by these extensions.
Detects suspicious network activity originating from the InstallUtil.exe process. InstallUtil is a legitimate Windows .NET utility that can be abused as a LOLBin (Living-off-the-Land Binary) to proxy the execution of malicious payloads, potentially bypassing application control mechanisms.
Detects HTTP traffic where the User-Agent header references Regasm or Regsvcs, which are trusted Windows utilities often abused by attackers to proxy execution of malicious code (Living-off-the-Land Binary technique).
Detects outbound network connections to well-known public DNS-over-HTTPS (DoH) providers (e.g., Google, Cloudflare, Quad9) from processes other than standard web browsers. This behavior is often associated with adversary attempts to bypass local DNS monitoring or security controls by tunnelled traffic over HTTPS.
Detects anomalous outbound network connections from node.exe processes initiated by developer tools like VS Code, npm, or installation binaries. The rule specifically monitors for patterns indicative of Command and Control (C2) communication, including high-frequency Socket.io polling, WebSocket upgrades, and long-duration connections to external, non-private IP addresses.
This rule detects the execution of common scripting interpreters (powershell.exe, wscript.exe, cscript.exe, mshta.exe) where the command line arguments contain domains associated with the Dropbox API. This behavior is indicative of potential data exfiltration or the downloading of malicious payloads via a legitimate cloud storage service, a common technique for bypassing network filters and security controls.
Detects network requests to Microsoft Graph API endpoints related to MFA method configuration. This pattern often indicates an adversary attempting to add, modify, or register new MFA authentication methods (such as phone-based methods) for an account to facilitate persistence or bypass security controls.
This rule detects network connections initiated by common Windows script interpreters (PowerShell, WScript, CScript, MSHTA) to known public paste or text sharing services. Adversaries often use these sites to host malicious payloads, C2 configurations, or to exfiltrate data, bypassing traditional network blocks by using reputable services. The rule excludes processes signed by Microsoft to reduce noise.
Detects Node.js process querying Ethereum blockchain for C2 address.
Detects high volumes of network connections initiated by common file sharing processes such as AirDrop, sharingd, NearShare, or QuickShare. This behavioral pattern, characterized by a large number of successful connections or numerous unique remote IP addresses, may indicate unauthorized mass data collection, reconnaissance, or potential lateral movement attempts.
This rule detects potential supply chain compromise in Node.js projects by monitoring for the execution of known malicious npm package install/preinstall/postinstall scripts. It identifies unauthorized access to sensitive developer credential files (such as .ssh, .git-credentials, and .npmrc) and suspicious network outbound connections associated with identified malicious package scopes.
Detects outbound network connections from internal hosts to domains associated with the Polymarket Trap / Miasma infostealer campaign, including dedicated servers (stitch-production.org, log-taker.store) and vercel.app serverless endpoints used for credential exfiltration.
Page 191 of 280