Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,876 detections
Filters
Last updated
All Time
Detection languages
2,951
1,378
313
289
239
Contributors
1,807
1,529
1,304
180
173
Categories
20,456
11,839
5,876
5,155
4,865
Platforms
3,744
1,857
1,076
782
160
Products / Services
2,238
1,434
1,273
746
582
MITRE Techniques
2,448
2,148
1,129
937
787
CVEs
19
15
9
7
5
IDS Classtypes
834
334
94
23
20
IDS Protocols
689
276
235
117
23
Detects network communication to the malicious domain 'mitarchive.info' from common web browsers (Chrome, Edge, Firefox, Brave). This domain is associated with the StegoAd browser extension, which intercepts Google and WordPress login flows to exfiltrate stolen credentials and 2FA codes.
Detects execution of the AdaptixC2 agent (AdgNsy.exe), anomalous WMI lateral movement (WmiPrvSE.exe spawning processes from AppData\Local), and suspicious outbound network connections from AppData\Local processes to non-standard ports.
Detects potential exploitation of ImageMagick vulnerabilities where Ghostscript delegates are used to achieve arbitrary code execution. The rule monitors for suspicious Ghostscript command-line arguments (e.g., missing or disabled -dSAFER), child process creation (spawning shells or interpreters), execution of network tools, unauthorized file modifications with script/binary extensions, and outbound network connections initiated by Ghostscript processes.
Detects execution of potentially malicious processes masquerading as 'pythonw.exe' or 'userscreen.exe', specifically when they exhibit behavior associated with the APT37 NarwhalRAT. The rule identifies processes loading critical system DLLs (kernel32.dll, ntdll.dll) while simultaneously initiating network connections to known C2 infrastructure within a 10-minute window.
Detects the execution of the AdaptixC2 agent (AdgNsy.exe) from AppData\Local directories and its subsequent internal network scanning activity against sensitive ports (445, 3389, 5985). The rule also monitors for potential dropper patterns associated with the Bumblebee loader, specifically involving processes like consent.exe or msiexec.exe dropping the binary.
Detects a sequence of events indicative of LSASS memory dumping followed by lateral movement via SMB administrative shares. The rule monitors for suspicious OpenProcess calls targeting lsass.exe, the subsequent creation of dump files in temporary directories, and concurrent access to admin shares (ADMIN$ or C$) from the same host, which is a common pattern for credential harvesting and lateral movement tools like 'lsassy'.
This rule detects the deployment and execution of the RustDesk remote access tool in conjunction with potential staging of installation artifacts and observed prior activity related to BumbleBee/Adaptix C2. It correlates process execution, file creation, and network connectivity to the RustDesk relay infrastructure to assign a risk score, helping identify potential unauthorized remote access or malicious persistence.
Detects network and process execution activity involving Google or Microsoft OAuth2 token endpoints from non-browser and non-trusted processes. This behavior is indicative of potential token theft or session hijacking attempts, where malicious tools (e.g., curl, python) are used to access authentication endpoints to bypass standard user interaction.
Detects the execution of 'AdgNsy.exe', a known malicious masquerading process associated with the AdaptixC2 beacon, attempting to scan internal network infrastructure by initiating outbound connections to sensitive ports including SMB (445), RDP (3389), LDAP (389/636), and 9401. This behavior indicates internal reconnaissance for lateral movement.
Detects HTTP GET requests to known malicious infrastructure used in SEO poisoning campaigns to distribute the Bumblebee malware loader. The rule monitors for specific URL paths and hostnames associated with lookalike domains delivering trojanized MSI files.
Detects exploitation attempts against CVE-2026-33017 in Langflow by monitoring for unauthenticated POST requests to the /api/v1/build_public_tmp/ endpoint, specifically using the identified exploit User-Agent, followed by outbound connections from the victim host to known attacker-controlled infrastructure.
This rule detects network connections to known IP addresses associated with the FortiBleed vulnerability exploitation. The rule categorizes the threat based on the specific IP address, indicating potential C2, pentest lab activity, credential validation, or sniffer nodes.
Detects outbound network traffic to api.telegram.org. This pattern is commonly observed in malware such as Sauron ransomware to establish command and control (C2) channels and perform data exfiltration by abusing the legitimate Telegram Bot API.
Detects potential Command and Control (C2) communication associated with Emotet malware by monitoring for successful network connections to suspicious remote ports frequently used by the malware. The rule flags endpoints that establish connections to at least three of these high-risk ports within a one-hour window, which is indicative of automated C2 beaconing behavior.
This rule monitors Cisco Unified Communications Manager (UCM) environments for multiple stages of an attack chain, including potential Server-Side Request Forgery (SSRF) attempts against administrative interfaces, suspicious file modifications by service accounts, indicators of privilege escalation, and anomalous outbound network connections from core Cisco processes.
Detects suspected malicious activity associated with the Dropping Elephant threat group. The rule monitors for two behaviors: 1) IP address geolocation fingerprinting by identifying non-browser processes communicating with ipify.org and ip2c.org within a 60-second window, and 2) Direct network connections to known Dropping Elephant C2 domains, specifically gcl-power.org and chinagreenenergy.org.
This rule detects anomalous network connections or DNS queries to known Ethereum RPC infrastructure providers (Infura, Alchemy, Cloudflare-eth) or ports/domains associated with Ethereum mainnet activity. It specifically targets processes other than common browsers or known blockchain clients, as well as Java-based processes performing DNS lookups for these domains. This behavior is indicative of potential 'EtherHiding' techniques where malicious code or data is hidden within blockchain transactions or distributed via blockchain infrastructure.
Detects anomalous network communication patterns and file system changes indicative of SoftEther VPN usage, particularly when linked to processes masquerading as VMware or communicating with known malicious C2 infrastructure. The rule monitors for network connections on common SoftEther ports, connections to specific command-and-control IP addresses, and the creation of SoftEther configuration files like 'hamcore.se2' or 'vpn_bridge.config'.
This rule detects processes that are not common browsers (chrome, msedge, firefox, etc.) initiating a network connection over the STUN protocol (UDP port 3478) while simultaneously running with a command-line argument containing '--kiosk'. This pattern often indicates potential command-and-control (C2) communication or unauthorized network traversal disguised as normal traffic from kiosk-mode applications.
Detects indicators of exploitation attempts targeting the c-ares asynchronous DNS library, specifically focusing on Use-After-Free (UAF) vulnerabilities. The rule monitors for the presence of known proof-of-concept (PoC) file artifacts, execution of processes using specific command-line flags associated with c-ares exploit research, suspicious shell/calculator spawning from common network-enabled applications (curl, node, python), and anomalous high-frequency DNS-over-TCP traffic patterns.
Detects the execution of VBScript processes (wscript.exe/cscript.exe) that interact with WMI to enumerate installed antivirus products or perform external IP geolocation lookups via services like ip-api.com. This behavior is indicative of the Grandoreiro banking trojan performing environment reconnaissance and victim-targeted execution.
Page 195 of 280