Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,876 detections
Filters
Last updated
All Time
Detection languages
2,951
1,378
313
289
239
Contributors
1,807
1,529
1,304
180
173
Categories
20,456
11,839
5,876
5,155
4,865
Platforms
3,744
1,857
1,076
782
160
Products / Services
2,238
1,434
1,273
746
582
MITRE Techniques
2,448
2,148
1,129
937
787
CVEs
19
15
9
7
5
IDS Classtypes
834
334
94
23
20
IDS Protocols
689
276
235
117
23
Detects network and DNS activity involving domains known to be used by the threat actor APT28 for command and control, specifically for hosting WebDAV payloads, malicious LNK files, and weaponized documents.
This rule detects network connections made to specific non-standard ports (7777, 8080, 8443) where the remote URL contains substrings associated with proxy or tunneling activities ('proxy', 'tunnel', 'hide'). This behavior is commonly associated with malware attempting to evade security controls by routing traffic through unauthorized intermediaries or obfuscated tunnels.
Detects network activity associated with Cobalt Strike Beacon behavior by identifying specific file extensions (.bin, .stager, .update, .task, .post) commonly used in Beacon staging and communication profiles within network inspection events.
Detects potential Command and Control (C2) communication associated with Emotet malware by monitoring for successful network connections to suspicious remote ports frequently used by the malware. The rule flags endpoints that establish connections to at least three of these high-risk ports within a one-hour window, which is indicative of automated C2 beaconing behavior.
This rule detects network connections using the GRE (Generic Routing Encapsulation) protocol to external IP addresses. GRE is often used for tunneling and can be leveraged by adversaries for command and control or data exfiltration, especially when communicating outside of internal network ranges.
Detects instances where the Windows script hosts wscript.exe or cscript.exe establish outbound network connections to common web ports (HTTP/HTTPS) on external IP addresses. This behavior is frequently associated with script-based malware, droppers, or C2 beacons.
Detects abnormally long DNS queries characterized by repetitive alphanumeric patterns, which may indicate potential DNS tunneling activity used for C2 communication or data exfiltration. The rule flags DNS requests exceeding 60 characters with repeating label structures.
Detects Distributed Component Object Model (DCOM) lateral movement activity by monitoring for mmc.exe and dllhost.exe network connections to non-local endpoints or when these processes are spawned by suspicious parent processes typically associated with command execution or malicious behavior.
This rule detects network connections to phishing pages hosted on the workers.dev domain that are attempting to interact with EvilTokens device code API endpoints. These pages are known to implement developer hotkey prevention (F12 blocked, context menu disabled) to hinder in-browser analysis, indicating malicious intent.
This rule monitors DNS queries and network connections for access to a set of known domain names associated with Adversary-in-the-Middle (AiTM) phishing infrastructure. It correlates data from DNS events, device network logs, and virtual machine network connections to identify potential interactions with malicious phishing sites typically used to capture user credentials or session tokens.
This rule monitors DNS queries and network connections for access to a set of known domain names associated with Adversary-in-the-Middle (AiTM) phishing infrastructure. It correlates data from DNS events, device network logs, and virtual machine network connections to identify potential interactions with malicious phishing sites typically used to capture user credentials or session tokens.
This rule detects known Living-off-the-Land Binaries (LOLBins) initiating outbound network connections to specific non-standard or commonly suspicious ports (8080, 8443, 4444, 1337, 1234). The rule excludes private/loopback network traffic and common Microsoft-related domains to reduce noise. Such behavior is often indicative of malicious activity, including C2 communication or unauthorized file downloads via trusted system processes.
This rule detects known Living-off-the-Land Binaries (LOLBins) initiating outbound network connections to specific non-standard or commonly suspicious ports (8080, 8443, 4444, 1337, 1234). The rule excludes private/loopback network traffic and common Microsoft-related domains to reduce noise. Such behavior is often indicative of malicious activity, including C2 communication or unauthorized file downloads via trusted system processes.
Detects C2 traffic obfuscated within HTTP request bodies
This rule detects multiple outbound network connections to a specific set of known malicious C2 IP addresses on specific ports within a one-hour window. This behavior is indicative of a multi-payload delivery pattern associated with malware families such as Remcos, Agent Tesla, and RedLine.
Detects remote enumeration of Windows services via SMB
Detects activity associated with the Lightlife RAT, which involves PowerShell scripts accessing cryptocurrency wallet browser extension directories, staging data using archive utilities, and exfiltrating collected data to external destinations like the Telegram Bot API.
Detects network connections to Microsoft OneDrive or SharePoint domains from processes that are not standard, known-good applications (e.g., browsers or standard sync clients). This behavior may indicate an adversary leveraging cloud storage for command-and-control (C2) operations or data exfiltration.
This rule detects a sequence of suspicious activities: the creation or modification of an executable file (.exe or .dll) within a directory path containing update-related keywords, followed by the execution of a file in that same location, and culminating in an outbound network connection from that process. This pattern is characteristic of a software supply chain compromise or an adversary deploying a malicious payload via a fake or compromised update mechanism.
This rule detects potential data exfiltration by identifying devices that make a high number of network connections (3 or more within an hour) to various remote IPs using common file transfer and email protocols (FTP, SFTP, SMB, SMTP) on their standard ports (21, 22, 445, 25, 587). This pattern can indicate an adversary attempting to exfiltrate collected data from a compromised system.
Tracks network connections from non-browser processes that transmit an abnormally large volume of outbound bytes, indicating active data exfiltration. This rule specifically excludes common browser processes (chrome.exe, msedge.exe, firefox.exe) and OneDrive (onedrive.exe) to reduce false positives. It aggregates outbound network activity over 10-minute intervals and flags any instance where the total outbound bytes exceed 100MB.
Page 197 of 280