Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,876 detections
Filters
Last updated
All Time
Detection languages
2,951
1,378
313
289
239
Contributors
1,807
1,529
1,304
180
173
Categories
20,456
11,839
5,876
5,155
4,865
Platforms
3,744
1,857
1,076
782
160
Products / Services
2,238
1,434
1,273
746
582
MITRE Techniques
2,448
2,148
1,129
937
787
CVEs
19
15
9
7
5
IDS Classtypes
834
334
94
23
20
IDS Protocols
689
276
235
117
23
Detects cloud service hijacking for cryptocurrency mining workloads
Detects anomalous activity originating from AutoGen Studio AI agents, specifically identifying attempts to abuse loopback trust boundaries via MCP (Model Context Protocol) WebSocket requests to localhost (ports 8080/8081) or the execution of suspicious child processes commonly used for command-line interference, indicative of AI agent compromise or attacker-controlled MCP command injection.
Detects outbound network connections to port 8084 initiated by processes originating from suspicious directories such as AppData, Temp, or ProgramData. This behavior is indicative of VSHELL RAT leveraging WebSocket-based C2 communication, a technique observed in UNC5221 SNOWLIGHT campaigns.
Detects the APT36 Ghazwa spyware (GPSSERV component) performing periodic, continuous exfiltration of GPS coordinates to a specific command-and-control port (18585). The rule identifies suspicious network traffic from non-navigation applications that have requested location permissions, filtering out known legitimate mapping services.
This rule detects activities associated with the VILE ransomware, specifically the creation of file staging artifacts (vile_user_files.zip), execution of associated binaries, and network communication with Gofile.io infrastructure used for exfiltration.
Detects the execution of a malicious file disguised as 'wusvc.exe' originating from the user Downloads folder. The rule also monitors for suspicious network connections from this process to a known C2 IP address and detects potential defensive evasion techniques such as memory protection changes (PAGE_EXECUTE_READWRITE) used for syscall stub patching or AMSI bypass in non-Microsoft signed versions of this process.
This rule detects outbound network connections made by the RustDesk process to non-corporate relay server IP addresses on the default RustDesk relay ports (21115, 21116, 21117). This behavior may indicate an unauthorized remote control session establishment, bypassing expected organizational proxy or relay controls.
Detects network activity associated with Cobalt Strike Beacon behavior by identifying specific file extensions (.bin, .stager, .update, .task, .post) commonly used in Beacon staging and communication profiles within network inspection events.
Detects non-browser processes that load 'clr.dll' (indicating in-process .NET/CLR usage) and are sending large volumes of outbound data to Google API domains (sheets.googleapis.com, oauth2.googleapis.com, googleapis.com). This behavior is consistent with the SHEETCREEP threat actor's use of Google Sheets API for command and control (C2) and data exfiltration.
This rule detects the use of 'sshpass' in conjunction with specific command-line arguments that indicate automated SSH logins. It specifically looks for the presence of '/sshpass/' and '/StrictHostKeyChecking=no/' in the command line, combined with common administrative account names like 'psoft', 'oracle', or 'linuxadm'. This activity is often associated with lateral movement techniques, as observed in attacks like those by ShinyHunters targeting Oracle/PeopleSoft environments.
Detects outbound network connections from devices to known FortiBleed command and control (C2) servers and sniffer infrastructure IP addresses. This rule helps identify potential compromises involving the FortiBleed vulnerability exploitation.
Detects instances where the Squid proxy application is used to establish network connections over ports 21 (FTP) or 22 (SSH) to specific external IP ranges. This behavior may indicate an attacker using the internal proxy server to anonymize command-and-control (C2) traffic or perform unauthorized external reconnaissance.
This rule detects potential command and control (C2) beaconing activity by identifying devices communicating with known suspicious remote IP addresses at regular, repeating intervals. It calculates the time difference between consecutive connections to specific suspicious IPs and identifies devices that establish at least three connections within one-hour bins, adhering to a 1 to 15-minute heartbeat interval.
This rule detects outbound POST requests to the Telegram Bot API (api.telegram.org) originating from internal network hosts. The detection specifically looks for requests containing the 'sendMessage' path, which is characteristic of bots transmitting stolen data (such as credentials) or command-and-control communication. It focuses on traffic initiated by common command-line tools like 'python-requests' or 'curl', which are frequently abused by automated malware scripts.
This rule detects potential Business Email Compromise (BEC) attempts by identifying emails containing financial keywords sent to sensitive finance/accounting roles from domains that have not been observed in the last 180 days. It then correlates this email event with subsequent device-level network activity involving banking or financial URLs initiated by the recipient user, which may indicate follow-up reconnaissance or unauthorized access.
This rule detects the Python-based CastleLoader malware establishing persistent WebSocket (wss:// or ws://) command-and-control channels to randomized attacker endpoints. It specifically looks for network connections initiated by python.exe or pythonw.exe to URLs matching a WebSocket pattern, with at least 3 connections within a 5-minute window.
Detects anomalous behavior associated with msiexec.exe that aligns with activity patterns of infostealer malwares like Lumma Stealer and Amadey Bot. This includes cross-process injection from unsigned processes, spawning of msiexec.exe by LOLBins or script interpreters, suspicious outbound network connectivity, and unauthorized access to browser credential storage files.
Detects DNS queries for known StegoAd command-and-control infrastructure domains, which are used as proxy relays and exfiltration endpoints.
Detects the installation of specific browser extensions in Microsoft Edge followed by network connection activity to external IP addresses. This behavior is indicative of potential malicious browser extensions, such as those used for browser session hijacking, credential theft, or command and control (C2).
This rule detects network connections from internal hosts to a list of known malicious IP addresses associated with the Payroll Pirate campaign (attributed to Storm-2755 and Storm-2657). Identifying these connections indicates potential communication with adversary-controlled infrastructure.
Detects malicious browser extension activity related to the StegoAd infostealer. The rule identifies a dual-indicator pattern consisting of outbound network connections to 'mitarchive.info' combined with concurrent read access to browser-specific credential store files (Google Chrome, Microsoft Edge, Mozilla Firefox) on the same host.
Page 194 of 280