Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,876 detections
Filters
Last updated
All Time
Detection languages
2,951
1,378
313
289
239
Contributors
1,807
1,529
1,304
180
173
Categories
20,456
11,839
5,876
5,155
4,865
Platforms
3,744
1,857
1,076
782
160
Products / Services
2,238
1,434
1,273
746
582
MITRE Techniques
2,448
2,148
1,129
937
787
CVEs
19
15
9
7
5
IDS Classtypes
834
334
94
23
20
IDS Protocols
689
276
235
117
23
This rule identifies indicators of compromise associated with the DragonReturn malware and DcRAT, including malicious file names, suspicious process execution, DNS resolution of known malicious phishing domains, and network communication with documented C2 infrastructure.
Detects suspicious PowerShell activity characterized by command-line obfuscation (including BigInteger patterns) or network connections to suspicious 'photo-*.cfd' domains often associated with malicious file downloads.
This rule detects command and control (C2) communication patterns associated with the Millenium RAT malware. It identifies suspicious traffic to 'api.telegram.org' utilizing the 'getUpdates' method initiated by processes that do not identify as standard web browsers, as well as traffic directed to the known proxy relay domain '75877.mcdir.me'.
Detects network activity associated with the DcRAT trojan as identified in Operation DragonReturn. This includes outbound network connections to hardcoded C2 port 2671, connections to known malicious IP addresses, and DNS resolutions of identified attacker-controlled C2 domains.
Detects network activity and DNS resolutions related to the tonapi.io domain initiated by unexpected processes. This pattern is indicative of the TONResolver RAT, which abuses TON smart contracts as a mechanism for command and control (C2).
This rule detects potentially malicious behavior associated with the DragonReturn malware, including the loading of a specific DLL (nvdaHelperRemote.dll) by system processes or Mixed Reality tools, the execution of suspicious binary names, and network connectivity indicators related to C2 domains.
Detects anomalous network traffic patterns communicating with the Telegram Bot API (api.telegram.org) from non-official Telegram processes. The rule identifies potential command and control (C2) activity by analyzing request frequency, specific API method usage (e.g., getUpdates, sendMessage), and beaconing-like behavior.
Detects potential DcRAT activity characterized by a process spawning under a svchost.exe parent, subsequent loading of GDI display libraries for screen capturing, and outbound network communication on non-standard ports, which indicates data exfiltration.
Detects network traffic using the Generic Routing Encapsulation (GRE) protocol originating from or destined to external (non-private) IP addresses. GRE is often used for tunneling and can be abused to bypass network security controls.
This rule monitors for suspicious activity associated with LegionLoader malware, specifically tracking files and processes interacting with the 'Traiolx Custom Utils' directory. It triggers on the staging of '_socket.pyd', execution of Python interpreters from this directory, and associated C2 communication attempts with the domain 'birdeemusic.com'.
Detects Python scripts or interpreters executing network connections while residing in or interacting with non-standard, potentially suspicious directories or domains. This rule specifically monitors for Python processes (python.exe, pythonw.exe) associated with 'Traiolx Custom Utils', paths within 'AppData\Roaming\python', or network interactions with 'birdeemusic.com' and a specific hardcoded IP address, which are indicative of potential beaconing or command and control activity.
Detects network requests to Google image search containing an 'imgurl' parameter, which can be used by an attacker to exfiltrate data by forcing an external service to crawl a controlled URL containing sensitive information.
This rule detects potential command and control (C2) activity by identifying specific DNS queries to known malicious domains or suspicious network-related processes executing on an endpoint. It flags DNS requests for 'birdeemusic.com' and network connections initiated by processes with names indicative of custom or potentially malicious payloads like '_socket.pyd' or 'Traiolx Custom Utils'.
Detects Node.js processes initiating network connections to remote destination port 2222. This specific port and behavior pattern are known to be used by the Miasma botnet as a fallback C2 channel or for SSH-based remote access when standard communication ports are blocked or monitored.
This rule detects instances of the Python interpreter (python.exe) executing from the AppData\Roaming directory, which is a common persistence location for malware. It further correlates these process events with outbound network connections to external (non-private/non-RFC1918) IP addresses, identifying potential Command and Control (C2) or data exfiltration activity.
Detects instances where the Windows Service Host process (svchost.exe) initiates more than five network connections to external (non-private/non-local) IP addresses within a short timeframe. This behavior is often characteristic of command-and-control (C2) activity or beaconing by malicious code masquerading as or injecting into system services.
Detects bash processes executing commands that combine AWS identity verification with outbound exfiltration using curl. The pattern specifically monitors for the use of 'aws sts get-caller-identity' followed by an immediate HTTP POST transmission of data (indicated by '-d @-'), which is characteristic of attackers exfiltrating captured cloud environment metadata or temporary credentials.
This rule detects processes running from suspicious temporary directories (AppData, Temp, LocalAppData, TCC) initiating frequent outbound network connections to a specific non-standard destination port (18848). This behavior is often indicative of automated Command and Control (C2) heartbeats or beacons, particularly when associated with binaries executing from untrusted or user-writeable locations.
Detects the presence or activity of a known malicious Chromium-based browser extension (Perplexity AI imposter, ID: flkebkiofojicogddingbdmcmkpbplcd) through monitoring file system changes in browser directories, registry modifications, or network communication with identified command-and-control infrastructure.
Identifies outbound C2 connections to domains generated by MLTBackdoor DGA.
This rule detects activities associated with the TaskWeaver JavaScript loader and its potential second-stage payload, Djinn Stealer. It monitors for JavaScript files (like jquery.js) being executed by Windows scripting hosts (wscript.exe, cscript.exe) or Node.js, identifies suspicious child process spawning behavior (e.g., cmd.exe, powershell.exe, system reconnaissance tools) from these scripting engines, and flags outbound network connections by these processes to common web ports that may indicate command-and-control (C2) communication.
Page 206 of 280