Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,876 detections
Filters
Last updated
All Time
Detection languages
2,951
1,378
313
289
239
Contributors
1,807
1,529
1,304
180
173
Categories
20,456
11,839
5,876
5,155
4,865
Platforms
3,744
1,857
1,076
782
160
Products / Services
2,238
1,434
1,273
746
582
MITRE Techniques
2,448
2,148
1,129
937
787
CVEs
19
15
9
7
5
IDS Classtypes
834
334
94
23
20
IDS Protocols
689
276
235
117
23
This rule detects potential Business Email Compromise (BEC) attempts by identifying emails containing financial keywords sent to sensitive finance/accounting roles from domains that have not been observed in the last 180 days. It then correlates this email event with subsequent device-level network activity involving banking or financial URLs initiated by the recipient user, which may indicate follow-up reconnaissance or unauthorized access.
This rule detects potential Log4Shell (CVE-2021-44228) exploitation attempts by identifying JNDI injection patterns in web request headers, process command lines, and syslog messages. It further identifies suspicious outbound network callbacks to known malicious infrastructure associated with these exploitation attempts.
This rule detects activity associated with the malicious 'Search for perplexity ai' browser extension (ID: flkebkiofojicogddingbdmcmkpbplcd). It specifically identifies DNS queries and network connections to the malicious domain 'perplexity-ai.online' initiated by common web browser processes, as well as file system evidence of the extension's presence.
Detects potentially malicious child process creation or unauthorized outbound network connections initiated by AI-assisted coding tools (e.g., Claude, Cursor, Windsurf) through their integrated Node.js or Python environments. This rule identifies common post-exploitation behaviors such as shell execution, command-line reconnaissance, and connections to external non-internal IP addresses.
Detects suspicious network traffic potentially associated with BeePRAT malware, identified by specific process image paths in temporary or TCC-related directories, connections to known malicious C2 IP addresses/ports, or non-standard TCP communication patterns involving suspicious domain queries.
Detects exploitation attempts against Flowise by leveraging a case-sensitivity bypass in environment variable parsing. Attackers inject variants like 'node_options' into the environment, which bypasses security denylists, allowing the 'NODE_OPTIONS' variable to be set. This enables remote code execution (RCE) via the '--require' flag in child Node.js processes, alongside subsequent activities like marker file creation, registry-based persistence, or unauthorized outbound network connections from the Flowise service.
This rule detects outbound network connections to a specific typosquatted domain 'perplexity-ai.online'. This domain is associated with a malicious browser extension designed to intercept and exfiltrate search queries before forwarding them to legitimate search providers.
This rule detects network activity and email signals associated with a malicious campaign promoting a fraudulent 'Perplexity AI' Chrome extension. It monitors for connections to known malicious Tilda landing pages, correlates these visits with subsequent Google Chrome extension (CRX) downloads within a 10-minute window, and identifies phishing emails containing links to these malicious pages.
Detects network activity associated with the Djinn Stealer malware, including connections to a known C2 IP address/port, the use of a specific 'telemetry-client/1.0' user agent, or HTTP POST requests to 'application/octet-stream' endpoints originating from suspicious parent processes such as SimpleHelp or TaskWeaver.
Detects processes that exhibit signs of C2 communication (specifically on ports 4000-5000, associated with SystemBC) followed by the writing of executable or script files to SMB/UNC paths and subsequent remote lateral movement execution via WMI, Windows services, or scheduled tasks on the same host.
This rule detects a process injection event where a process running from a suspicious directory (e.g., Temp, AppData, ProgramData) injects code into a common system or browser process, followed by that same process initiating a network connection to non-internal IP ranges on specific ports within a 10-minute window. This behavior is indicative of malware establishing persistence or C2 communications.
Detects potentially malicious activity associated with the Ghidra reverse engineering framework, including the spawning of unexpected non-Java child processes, loading of suspicious project files (.gzf/.gar), loading of unsigned extensions from non-standard directories, and unexpected outbound network connections from decompiler or Java processes.
Detects anomalous activity associated with information stealing malware, including unauthorized access to browser credential files (Login Data, Cookies), remote thread injection into browser processes, outbound connections to the Telegram API by non-browser processes, and rapid bulk access to multiple sensitive credential or crypto wallet files.
Detects rapid post-exploitation activity where a developer's workstation, upon executing VS Code (Code.exe), initiates outbound network connections to major cloud service or CI/CD provider APIs (GitHub, AWS, Azure, GCP) within 60 minutes. This behavior is indicative of the Lazarus Group 'Contagious Interview' campaign, where stolen credentials from developer environments are used to pivot into cloud infrastructure or CI/CD pipelines.
Detects the use of 'netsh trace' to capture network traffic with specific suspicious flags, such as circular file mode, reporting disabled, or interaction with administrative shares. This behavior is often associated with network reconnaissance or the collection of sensitive data by adversaries.
Detects instances where scripting or development processes (e.g., node.exe, python.exe, code.exe) access sensitive SSH private key files or PEM files, followed by an immediate outbound network connection to a non-private IP address within 60 seconds. This activity is indicative of credential exfiltration or unauthorized use of stolen keys.
Detects a network-connected Linux process exhibiting beaconing behavior (high-frequency external connections) that is subsequently correlated with unauthorized file access to sensitive Linux configuration files (/etc/passwd, /etc/shadow, or authorized_keys). This rule filters out common system processes and standard management binaries, targeting suspicious command-and-control activity combined with credential theft.
Detects a network-connected Linux process exhibiting beaconing behavior (high-frequency external connections) that is subsequently correlated with unauthorized file access to sensitive Linux configuration files (/etc/passwd, /etc/shadow, or authorized_keys). This rule filters out common system processes and standard management binaries, targeting suspicious command-and-control activity combined with credential theft.
Detects Python or Node.js processes executing command-line interpreters (e.g., cmd.exe, bash) while simultaneously performing network connections. This behavior is indicative of a post-exploitation activity where an attacker leverages language-specific package paths to execute shell commands and establish command-and-control communication.
Detects unauthorized processes reading AI assistant configuration files (e.g., Claude, Cursor, Gemini, VS Code) followed by an outbound network connection from a common scripting or runtime environment (node, python, bun) within 60 seconds, potentially indicating credential or configuration exfiltration.
Detects network communication associated with DcRAT, specifically identifying DNS lookups for the known C2 domain kkxqbh.top or network connections to port 2671 originating from suspicious or specific host processes.
Page 193 of 280