Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,876 detections
Filters
Last updated
All Time
Detection languages
2,951
1,378
313
289
239
Contributors
1,807
1,529
1,304
180
173
Categories
20,456
11,839
5,876
5,155
4,865
Platforms
3,744
1,857
1,076
782
160
Products / Services
2,238
1,434
1,273
746
582
MITRE Techniques
2,448
2,148
1,129
937
787
CVEs
19
15
9
7
5
IDS Classtypes
834
334
94
23
20
IDS Protocols
689
276
235
117
23
Detects outbound HTTP POST requests where the Content-Length header indicates a data transfer of 5MB or greater. This pattern is indicative of potential unauthorized data exfiltration over the web protocol.
This rule detects HTTP POST requests containing a Content-Length header value indicating a body size exceeding 10MB. Large POST requests may indicate data exfiltration, large file uploads, or misuse of HTTP channels for data transfer to external destinations.
Detects anomalous browser activity where an endpoint retrieves configuration or scriptlets from the BadBlocker-related API, followed shortly by outbound network connections to suspicious domains or the exfiltration of sensitive browser-based session data like document.cookie, localStorage, or sessionStorage.
This rule detects instances where AutoGen Studio or related AI agents initiate potentially suspicious child processes such as command interpreters (cmd, powershell, bash) or known Living-off-the-Land Binaries (LOLBins) while simultaneously establishing outbound WebSocket connections to Model Context Protocol (MCP) endpoints. This behavior is indicative of an attacker attempting to leverage AI agent automation capabilities for code execution or remote system interaction.
This rule detects potential command and control (C2) beaconing activity by identifying devices communicating with known suspicious remote IP addresses at regular, repeating intervals. It calculates the time difference between consecutive connections to specific suspicious IPs and identifies devices that establish at least three connections within one-hour bins, adhering to a 1 to 15-minute heartbeat interval.
This rule detects multiple outbound network connections to a specific set of known malicious C2 IP addresses on specific ports within a one-hour window. This behavior is indicative of a multi-payload delivery pattern associated with malware families such as Remcos, Agent Tesla, and RedLine.
Detects network outbound connections to known CDN domains over port 8084. This activity is often associated with the use of specific C2 frameworks (e.g., SNOWLIGHT or VSHELL) that leverage legitimate cloud infrastructure to blend malicious traffic within common CDN communication patterns.
Detects network traffic associated with TrymeLocker malware, specifically targeting Telegram API communications containing hardcoded identifiers and geolocation lookups via ipinfo.io.
Detects anomalous network communication patterns and file system changes indicative of SoftEther VPN usage, particularly when linked to processes masquerading as VMware or communicating with known malicious C2 infrastructure. The rule monitors for network connections on common SoftEther ports, connections to specific command-and-control IP addresses, and the creation of SoftEther configuration files like 'hamcore.se2' or 'vpn_bridge.config'.
This rule detects potential command and control (C2) activity associated with the SNOWLIGHT framework by identifying outbound WebSocket connections over HTTP to a specific known C2 IP (38.60.253.35) and port (8084). It correlates network flow logs (CommonSecurityLog) containing specific HTTP URL parameters (a=w64, t=ws_, p=8084) with EDR process network events (DeviceNetworkEvents) where the Windows Update Service process (wusvc.exe) is the initiator, indicating potential process masquerading or injection.
This rule detects network connections to known IP addresses associated with the FortiBleed vulnerability exploitation. These IP addresses have been categorized based on their observed roles in FortiBleed attacks, including C2, pentest lab, credential validation, and sniffer nodes. Monitoring these connections can help identify compromised systems communicating with FortiBleed infrastructure.
Detects evidence of RustDesk session permission bypass exploitation. The rule monitors for the presence of known Proof-of-Concept (PoC) file artifacts, suspicious child processes spawned by RustDesk, use of elevated tokens by RustDesk-initiated processes, compilation of PoC tools using cargo, and outbound network connections from RustDesk to known relay ports.
This rule detects anomalous network connections or DNS queries to known Ethereum RPC infrastructure providers (Infura, Alchemy, Cloudflare-eth) or ports/domains associated with Ethereum mainnet activity. It specifically targets processes other than common browsers or known blockchain clients, as well as Java-based processes performing DNS lookups for these domains. This behavior is indicative of potential 'EtherHiding' techniques where malicious code or data is hidden within blockchain transactions or distributed via blockchain infrastructure.
This rule detects outbound network connections to common webhook and temporary storage services (e.g., discord.com webhooks, webhook.site, pipedream.net) initiated by processes other than standard web browsers. Such behavior is often indicative of automated data exfiltration, command-and-control (C2) communication, or malicious script activity using these services to bypass traditional network defenses.
This rule detects successful outbound network connections from an endpoint to a known Tor directory authority IP address. Establishing a connection to these authorities is a strong indicator that the system is attempting to join the Tor network or is interacting with Tor infrastructure, which may be unauthorized in enterprise environments.
Detects outbound network connections from workstations or servers to common message broker ports (MQTT 1883/8883, AMQP 5672). These protocols are sometimes abused for command-and-control (C2) communication, as they allow for pub/sub messaging patterns that can blend into legitimate network traffic.
This rule detects network connections to known IP addresses associated with the FortiBleed vulnerability exploitation. The rule categorizes the threat based on the specific IP address, indicating potential C2, pentest lab activity, credential validation, or sniffer nodes.
This rule detects outbound network connections to common webhook and temporary storage services (e.g., discord.com webhooks, webhook.site, pipedream.net) initiated by processes other than standard web browsers. Such behavior is often indicative of automated data exfiltration, command-and-control (C2) communication, or malicious script activity using these services to bypass traditional network defenses.
This rule detects network connections on TCP ports 7000, 7001, 8770, and 5353 (commonly associated with Apple services like AirPlay, AirPrint, and Bonjour) initiated by processes other than standard Apple binaries such as iTunes, AppleMobileDeviceService, Bonjour, or mDNSResponder. This behavior may indicate an attempt to blend into expected network traffic by masquerading as legitimate Apple service communication.
This rule detects network communication to a known command and control (C2) server (23.254.164.123:443) associated with the 'protocal.cjs' backdoor, which is part of the 'easy-day-js' npm supply chain compromise. The detection specifically looks for TLS traffic with a Server Name Indication (SNI) and general IP traffic to this C2 address.
Detects suspicious activities associated with malicious npm package installations, including Node.js spawning shells during lifecycle hooks (preinstall, postinstall), connections to known command-and-control (C2) domains used in software supply chain campaigns, and the creation of artifacts within the node_modules directory.
Page 204 of 280