Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,873 detections
Filters
Last updated
All Time
Detection languages
2,949
1,378
313
289
239
Contributors
1,807
1,529
1,304
180
173
Categories
20,439
11,829
5,873
5,151
4,864
Platforms
3,743
1,857
1,075
781
160
Products / Services
2,237
1,434
1,273
746
582
MITRE Techniques
2,448
2,145
1,128
937
787
CVEs
19
15
9
7
5
IDS Classtypes
834
334
94
23
20
IDS Protocols
689
276
235
117
23
Detects indicators of compromise including Bash-based reverse shells communicating with a C2 domain on port 7070, outbound network connections from web server and shell processes to the same C2 infrastructure, and the dropping of known suspicious plugin archive files (akismetv4-plugin.zip, Hlx.zip, template.zip).
Detects potential C2 beaconing activity associated with Potassium by correlating a DNS query for a known C2 domain with a subsequent TCP connection to port 50792 from the same device within a short time window.
Detects script-driven (curl, wget, python) outbound connections to
AI/LLM API endpoints. The campaign uses legitimate AI platform APIs as covert
command, control, and exfiltration channels, blending malicious traffic with
approved web services to evade network-based detection.
AI/LLM API endpoints. The campaign uses legitimate AI platform APIs as covert
command, control, and exfiltration channels, blending malicious traffic with
approved web services to evade network-based detection.
Detects outbound IPv4 and IPv6 connections from endpoints to public IP addresses on high-numbered ports (1023 and above), excluding private, reserved IP ranges and known noisy processes. Command-and-control tools, malware and tunneling activities may use uncommon ports to evade network monitoring.
Connections are aggregated by endpoint, process, remote IP and port to identify suspicious communication patterns.
Legitimate applications, custom services and administrative tools may also use these ports, so triage based on process context, destination reputation and connection frequency.
Connections are aggregated by endpoint, process, remote IP and port to identify suspicious communication patterns.
Legitimate applications, custom services and administrative tools may also use these ports, so triage based on process context, destination reputation and connection frequency.
Detects execution and network activity associated with the cache_base operator toolkit, including JuicyPotatoNG (kitanai.exe), RegPwn (nandemo.exe), ufw.exe reverse shell, and upd-ms.bat launching these tools with connections to *.strangled.net on port 7070.
Detects sandbox or training hosts performing DNS resolution followed shortly by outbound connections to public IP addresses on ports 80 or 443, which may indicate a firewall misconfiguration or unauthorized egress from isolated environments.
Detects the execution of unapproved Remote Monitoring and Management (RMM) software tools followed by subsequent outbound public IP network activity from the same process on the same device, indicating an active remote session.
Exposure-assessment hunt for endpoints running OpenCode and contacting OpenCode Console or AI provider APIs, to prioritise API key rotation after the October 2026 OpenCode breach.
Detects web server worker processes (such as php-fpm, apache2, nginx, w3wp.exe) spawning download utilities like curl or wget, certutil with transfer flags, or initiating /dev/tcp network connections, which may indicate web application exploitation or webshell activity.
Detects a sequence where a device exhibits Remote Monitoring and Management (RMM) tool execution followed by high-volume outbound network connections to consumer cloud storage services (such as OneDrive or Google Drive) from the same device, potentially indicating data exfiltration via RMM.
Detects outbound network connections from processes targeting a known hard-coded Potassium campaign C2 IP address (134.199.154.64), followed by fallback DNS resolver queries using standard public DNS servers by the same process.
Detects non-browser processes contacting multiple distinct cloud storage APIs within a one-hour timeframe, a pattern indicative of potential multi-service command and control or data exfiltration.
Detects endpoint, network, and security log activity matching known indicators of compromise (IOCs) associated with PEERSTITCH / CL-STA-0954, including specific file hashes, IP addresses, and URLs.
Correlates an inbound connection to a Python/Xoscar/Xinference pool process with an outbound connection from a shell spawned by that same pool process shortly afterward, potentially indicating exploitation and reverse shell activity.
Detects a process with no prior AI API activity in the past 14 days suddenly generating a high volume (200+ calls) of network connections to public AI inference endpoints (OpenAI, Anthropic, Grok, OpenRouter). This behavior is consistent with stolen API keys being used to drain resources or exfiltrate data from a newly compromised host.
Detects newly seen devices (no Tailscale process activity in the prior 30 days) executing Tailscale enrollment or login commands followed by outbound network connections to Tailscale control infrastructure within 10 minutes, potentially indicating unauthorized VPN tunneling.
Detects Tailscale (tailscaled) reaching out to cloud instance metadata endpoints or Kubernetes internal service APIs, which may indicate unauthorized access or abuse of app connectors.
Detects outbound network connections to known ClickFix campaign domains or the execution of the finger utility connecting to public IP addresses.
Detects host-side telemetry indicating Cairn agent worker artifacts, including specific process command line terms, tsec skill files and environment variables, combined with network connections to OpenRouter from the same host.
This analytic detects outbound network connections from a Python process running from suspicious or non-standard directories to social media related domains.
It leverages Sysmon Event ID 3 to surface this anomalous behavior.
Legitimate Python applications rarely originate from paths such as "C:\Users\Public\", Windows font or debug folders, or the Recycle Bin, making direct outbound calls to social media infrastructure from these locations a strong indicator of compromise.
For example the Braodo Stealer, a Python-based credential-harvesting malware, abuses authenticated browser sessions to query the Meta Graph API and enumerate the victim's Facebook and Meta advertising infrastructure.
It leverages Sysmon Event ID 3 to surface this anomalous behavior.
Legitimate Python applications rarely originate from paths such as "C:\Users\Public\", Windows font or debug folders, or the Recycle Bin, making direct outbound calls to social media infrastructure from these locations a strong indicator of compromise.
For example the Braodo Stealer, a Python-based credential-harvesting malware, abuses authenticated browser sessions to query the Meta Graph API and enumerate the victim's Facebook and Meta advertising infrastructure.
Detects endpoint network connections made to known staging IP addresses often associated with data exfiltration or staging activities.
Page 2 of 280