Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,876 detections
Filters
Last updated
All Time
Detection languages
2,951
1,378
313
289
239
Contributors
1,807
1,529
1,304
180
173
Categories
20,456
11,839
5,876
5,155
4,865
Platforms
3,744
1,857
1,076
782
160
Products / Services
2,238
1,434
1,273
746
582
MITRE Techniques
2,448
2,148
1,129
937
787
CVEs
19
15
9
7
5
IDS Classtypes
834
334
94
23
20
IDS Protocols
689
276
235
117
23
This rule detects potential data exfiltration attempts by monitoring for network connections to URLs containing suspicious substrings (bit, onion, .cc, .su) over common web and DNS ports (53, 80, 443, 8080). It flags high-frequency unique connection attempts from a single device, which may indicate command-and-control (C2) traffic or data exfiltration over covert channels.
Correlates an AI/LLM process executing high-volume network scanning against the internal subnet. This rule detects when processes named 'python.exe' or 'node.exe' initiate a high volume of network connections (more than 20 unique IPs within a minute) to internal IP ranges (10.0.0.0/8 or 192.168.0.0/16).
Correlates the reading of sensitive local files (id_rsa, .env, config.json) followed by an immediate POST request to an LLM API (specifically api.openai.com), indicating data theft via prompt injection or automated analysis.
This rule detects activities associated with a specific malicious browser extension, including the presence of its files on disk, execution of browsers with the extension ID in the command line, and network connections to known malicious or typosquatted domains (perplexity-ai.online, extension.tilda.ws) used for C2 or exfiltration.
Detects DNS queries to known StegoAd command-and-control domains 'liveupdt.com' and 'dealctr.com'. These domains are used by the StegoAd campaign to deliver steganographic payloads and push malicious JavaScript to compromised browser extensions.
Detects anomalous automated enumeration of Microsoft Graph API user objects followed by keyword-based searches for sensitive HR, finance, and payroll-related information. This pattern is characteristic of post-compromise reconnaissance activities where an attacker leverages an existing session token to identify targets for further data exfiltration.
Detects network connections originating from standard web browsers (Chrome, Edge, Brave, Chromium, Opera) to the domain 'perplexity-ai.online', which is indicative of potential command and control or unauthorized data exfiltration activity.
This rule detects DNS requests initiated by common web browsers (chrome, msedge, brave, chromium) to a known malicious domain 'perplexity-ai.online', which is often indicative of C2 callback activity.
Detects the silent activation of the 'Smart Window' feature in Mozilla Firefox. The rule monitors for a two-stage sequence where Firefox modifies its 'prefs.js' configuration file to enable the feature, followed shortly by a network connection to the local Smart Window AI API on localhost port 8765.
This rule detects outbound network connections to the typosquatted domain 'perplexity-ai.online'. This domain is associated with a malicious Chromium extension masquerading as a 'Search for Perplexity AI' tool, which uses this domain for search-traffic interception and command-and-control (C2) exfiltration.
Detects outbound SSH connections from common applications using libssh2 to external, non-standard or untrusted servers, followed by an anomalously large inbound TCP data transfer before authentication completes. This behavior is indicative of exploitation attempts targeting CVE-2026-55200, where a malicious SSH server triggers a heap overflow in the client via a malformed packet.
Detects indicators of potential exploitation of CVE-2026-46331 in RustDesk, which involves a session permission bypass. The rule identifies suspicious post-exploitation behavior, specifically when rustdesk.exe spawns common command-line or reconnaissance utilities, and when it initiates outbound network connections on non-standard relay ports.
This rule detects potential exploitation of the PHP StreamBucket SOAP RCE vulnerability (CVE-2026-55199). It monitors for characteristic post-exploitation behaviors, including the spawning of unexpected shell or system utility processes, access to sensitive memory mapping files (/proc/self/maps or /proc/self/mem) for ASLR defeat, creation of specific RCE marker files (e.g., /tmp/php857_rce_*.txt), and anomalous outbound network connections following SOAP request activity.
This rule detects successful outbound SSH (port 22) connections originating from a private IP address on a device to a public IP address. This could indicate unauthorized remote access, data exfiltration, or command and control activity.
This rule detects an unusually high number of outbound network connections originating from the Local Security Authority Subsystem Service (LSASS) process on a Windows machine. LSASS is a critical system process responsible for enforcing security policy on the system, including user authentication, and typically does not initiate a large number of outbound connections. A high count of outbound connections from LSASS could indicate credential dumping activity, where an attacker is exfiltrating harvested credentials, or other malicious activity compromising the LSASS process.
Detects network connections to known command and control (C2) infrastructure associated with malicious NPM packages acting as Remote Access Trojans (RATs). The rule identifies specific outbound connections to a hardcoded malicious IP and port, as well as traffic involving a suspicious domain string.
Detects network connections to known command and control (C2) infrastructure associated with malicious NPM packages acting as Remote Access Trojans (RATs). The rule identifies specific outbound connections to a hardcoded malicious IP and port, as well as traffic involving a suspicious domain string.
Detects macOS Terminal (bash/zsh) retrieving loader.sh or payload.applescript directly from the ClickFix attacker infrastructure.
Detects activity associated with the StegoAd browser extension campaign. This rule monitors for the registration of new browser extensions in Chrome or Edge, followed by suspicious browser-based network activity including DNS queries to known C2 infrastructure or the loading of specific WebP files used for steganographic payload delivery.
This rule detects outbound network traffic from internal hosts to a known malicious IP address (193.242.184.150) over port 22 (SSH). This behavior is indicative of a reverse SSH tunnel established for C2 communication and the potential exposure of internal RDP services to the attacker.
Detects network connections initiated by 'Browser_Updater.exe' to a known malicious IP address (45.251.243.210) or a specific domain containing 'iis.jpg'. This activity is indicative of initial access or command and control related to a specific campaign.
Page 209 of 280