Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,876 detections
Filters
Last updated
All Time
Detection languages
2,951
1,378
313
289
239
Contributors
1,807
1,529
1,304
180
173
Categories
20,456
11,839
5,876
5,155
4,865
Platforms
3,744
1,857
1,076
782
160
Products / Services
2,238
1,434
1,273
746
582
MITRE Techniques
2,448
2,148
1,129
937
787
CVEs
19
15
9
7
5
IDS Classtypes
834
334
94
23
20
IDS Protocols
689
276
235
117
23
Detects outbound network connections to a known Djinn Stealer C2 IP address (96.126.130.126) on port 58942, utilizing the specific User-Agent 'telemetry-client/1.0' and 'application/octet-stream' content type. This behavior is indicative of data exfiltration of encrypted/compressed archives.
Detects outbound network connections to TCP port 4001, which is the hardcoded default C2 port for SystemBC (Coroxy) malware. The rule identifies suspicious proxy tunnel establishment from Windows workstations, often used by threat actors like Wizard Spider and FIN7 for pre-deployment staging.
Detects the installation of a malicious Chromium extension masquerading as 'Search for perplexity ai'. The rule monitors for file creation events in the Chrome extensions directory matching the specific malicious extension ID, modification of the Chrome Preferences file, and outbound network connections from the browser to the identified C2 domain.
This rule detects network connections to Discord's API webhooks endpoint, specifically looking for POST requests. This activity can indicate data exfiltration, command and control communications, or other malicious use of Discord webhooks by adversaries.
Detects network activity associated with Djinn Stealer malware, identifying either direct connections to a known command-and-control (C2) server or HTTP exfiltration attempts using a characteristic User-Agent string and binary content type.
Detects network activity and process behavior consistent with the use of the Tor network for command and control (C2), specifically targeting patterns associated with The Gentlemen ransomware-as-a-service (RaaS). The rule identifies direct execution of Tor processes, unauthorized connections to common Tor SOCKS proxy ports, and specific network communication with known malicious infrastructure linked to The Gentlemen Go-based backdoor.
Detects suspicious network-related activity initiated by common command-line utilities when spawned as child processes of Visual Studio Code (Code.exe). This pattern is often indicative of automated script execution, malware staging, or adversary activity following code repository manipulation, particularly when preceded by a git clone operation within a 15-minute window.
Detects Python or Node.js processes reading sensitive SSH private key files (id_rsa, id_ed25519) followed by an outbound network connection within a one-minute window. This behavior is indicative of credential theft and exfiltration, such as that observed in the InvisibleFerret campaign.
This rule monitors for known malicious activities associated with a specific Go-based backdoor. It detects network connections to a known command-and-control IP (81.177.215.15) on port 9443, as well as host-based behaviors including suspicious WMI-based system information discovery and the execution of cmd.exe spawned by a specific suspicious process named MediumInstStart.exe.
Detects Python scripts, launched by code.exe or node.exe (common IDE-related processes), accessing SSH private key files (id_rsa, id_ed25519, id_ecdsa) followed by an outbound network connection within 60 seconds. This behavior is indicative of credential theft and potential exfiltration or lateral movement.
Detects instances where scripting processes (Python, Node.js) accessed SSH key files or configuration files and subsequently initiated an outbound network connection within 60 seconds, which may indicate potential exfiltration of credentials or unauthorized access.
Detects queries to internet scan databases used for target reconnaissance
Detects network traffic associated with the EvilTokens phishing kit's 'killed' gate check mechanism. The kit GETs /api/device/gate/<PAGE_ID> with the ngrok-skip-browser-warning header. When the backend returns a killed flag, the phishing page wipes the DOM and renders a fake 'Page Not Found - Microsoft' error to evade analysis or block specific victims.
Detects indicators of the Meow RAT malware staging collected data in the /tmp/shub_ directory, compressing it into shub_log.zip using 'ditto', and subsequently exfiltrating it to a hardcoded command and control (C2) domain 'qwqerrqwr2145qw[.]com/gate'. The rule correlates process events, network events, and file events to identify the full attack chain.
Identifies PowerShell using Invoke-RestMethod or Invoke-WebRequest to exfiltrate archives via HTTP POST, specifically looking for multipart/form-data boundaries in the command line.
This rule detects network connections initiated by scripting engines (wscript.exe, cscript.exe) or PowerShell (powershell.exe) to common Remote Desktop Protocol (RDP) ports (3389, 3390, 3391). This activity can be indicative of an adversary attempting to establish or pivot RDP sessions using unexpected processes, potentially for lateral movement or persistence.
This rule detects network connections to known IP addresses associated with the FortiBleed vulnerability exploitation. These IP addresses have been categorized based on their observed roles in FortiBleed attacks, including aggregator/C2, pentest lab, credential validation, and sniffer nodes. Monitoring these connections can help identify compromised systems or active exploitation attempts related to FortiBleed.
This rule detects unauthorized configuration of GRE tunnels on Cisco IOS-XE network devices, potentially indicating persistent command and control (C2) channel establishment via TCL injection or illicit configuration changes involving known attacker infrastructure (62.171.185.97). It correlates network traffic to the attacker IP with process-level activity involving suspicious configuration files, scripts, or device-specific command-line arguments.
Detects host-level evidence of DRAYN malware activity by correlating outbound network connections using a specific websocket-sharp User-Agent to a known command-and-control (C2) IP address with the execution of PowerShell commands performing system UUID fingerprinting (Win32_ComputerSystem).
Detects non-browser processes accessing sensitive browser data files (such as Login Data, Cookies, or key stores) followed by network activity to known suspicious, cryptocurrency, or potential malware-hosting domains. This behavior is indicative of credential theft and exfiltration by information-stealing malware.
Detects malicious network connections initiated by wscript.exe or cscript.exe, or file creation events involving known LCRYX malware payloads in the C:\Windows\ directory. It also includes network-level detection using DNS and firewall/proxy logs for known LCRYX malicious domains and IP addresses.
Page 207 of 280