Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,876 detections
Filters
Last updated
All Time
Detection languages
2,951
1,378
313
289
239
Contributors
1,807
1,529
1,304
180
173
Categories
20,456
11,839
5,876
5,155
4,865
Platforms
3,744
1,857
1,076
782
160
Products / Services
2,238
1,434
1,273
746
582
MITRE Techniques
2,448
2,148
1,129
937
787
CVEs
19
15
9
7
5
IDS Classtypes
834
334
94
23
20
IDS Protocols
689
276
235
117
23
Detects potential Command and Control (C2) communication associated with Emotet malware by monitoring for successful network connections to suspicious remote ports frequently used by the malware. The rule flags endpoints that establish connections to at least three of these high-risk ports within a one-hour window, which is indicative of automated C2 beaconing behavior.
This rule detects potential command and control (C2) beaconing activity by identifying devices communicating with known suspicious remote IP addresses at regular, repeating intervals. It calculates the time difference between consecutive connections to specific suspicious IPs and identifies devices that establish at least three connections within one-hour bins, adhering to a 1 to 15-minute heartbeat interval.
This rule monitors Cisco Unified Communications Manager (UCM) environments for multiple stages of an attack chain, including potential Server-Side Request Forgery (SSRF) attempts against administrative interfaces, suspicious file modifications by service accounts, indicators of privilege escalation, and anomalous outbound network connections from core Cisco processes.
This rule detects network connections made to specific non-standard ports (7777, 8080, 8443) where the remote URL contains substrings associated with proxy or tunneling activities ('proxy', 'tunnel', 'hide'). This behavior is commonly associated with malware attempting to evade security controls by routing traffic through unauthorized intermediaries or obfuscated tunnels.
This rule detects potential command and control (C2) activity associated with the BTMOB Remote Access Trojan (RAT). It monitors for suspicious network behavior by correlating DNS requests to ip-api.com (a common geolocation service used by malware to identify the victim's location/public IP) with subsequent C2 communication to cloud services (Google Pub/Sub, Azure MQTT) or non-standard network traffic on port 3478 (often used for STUN/NAT traversal, but excluded for known browsers and communication tools) within a 30-minute window.
Detects suspicious network activity using the STUN/TURN protocol on port 3478 initiated by non-browser and non-conferencing processes. The rule specifically targets unsigned processes or those located in user-writable directories (such as Temp or AppData), which are common indicators of Grandoreiro malware sideloading and establishing C2 communication tunnels.
Detects processes containing sensitive credential-related keywords (cookies, creds, password, token) in their command lines followed by a network connection to known suspicious remote IP addresses within a 60-minute window, suggesting potential credential exfiltration.
This rule detects potentially unauthorized processes establishing network connections over port 8883 (MQTT/MQTTS) to major cloud IoT platforms (AWS IoT, Azure IoT Hub, GCP PubSub). It flags processes that are not common web browsers and calculates a suspicious score based on data volume, execution path (e.g., Temp or AppData), and the process name not matching known legitimate IoT software.
Detects activity consistent with the Grandoreiro banking trojan, including DLL sideloading, screen capturing, keystroke hooking, unauthorized network connections to known banking infrastructure, and suspicious data exfiltration bursts.
Detects HTTP traffic involving redirect chains from known Gmail URL shorteners (goo.gl, g.co, short.gy) that terminate at the identified credential-harvesting domain chongdaotang.net. This behavior is indicative of a phishing campaign designed to harvest user credentials through a multi-stage redirect.
Detects anomalous network traffic patterns characteristic of the Grandoreiro banking trojan, which tunnels Command and Control (C2) communications over STUN/WebRTC (UDP port 3478). The rule identifies processes that are not known web browsers or conferencing applications initiating these STUN connections, a technique used by the malware to blend with legitimate collaboration traffic.
This rule detects potential command and control (C2) beaconing activity associated with Mythic implants. It monitors for high-frequency outbound connections (20 or more) from a single device to the same external IP address within a 30-minute window across common C2 listener ports (80, 443, 8080, 8443, 7443).
This rule detects when the node.exe process initiates an outbound network connection to a specific set of non-standard, often high-numbered ports (8443, 8445, 8453, 5555, 56001-56003) over the public internet. This behavior is often indicative of potential command and control (C2) communication, reverse shells, or malicious scripts executing within a Node.js runtime environment.
This rule detects indicators of compromise associated with the TinyRCT malware, including the loading of a malicious AppDomainManager DLL by chrome_setup.exe, network connections to a known TinyRCT staging server, and the dropping of second-stage payloads such as PerfWatson2.exe to the local application data directory.
Detects the execution of the fscan network scanner binary, its use with common scanning arguments, or any network communication with the known staging IP address associated with the fscan deployment.
Detects instances where the Excel process (excel.exe) initiates outbound network connections to non-private IP addresses on specific ports often associated with command and control or data exfiltration. This rule specifically excludes known Microsoft-owned CDN and update infrastructure, aiming to identify potential exploitation activity, such as that potentially associated with CVE-2025-60727.
Detects Python processes that combine potentially dangerous pickle deserialization (pickle.loads) with network-fetching libraries (urllib, requests, socket) and decoding methods (b64decode, fromhex). This pattern is consistent with backdoors or remote access tools (RATs) that fetch encoded payloads over the network and execute them directly in memory via deserialization.
Detects download, execution, and network activity associated with the 'isp.sh' dropper script. This includes the use of common utilities like curl or wget to fetch the script from a specific C2 IP address (83.142.209.214), piping the script directly to a shell, and signs of secondary payload execution such as 'lambsys'.
This rule detects network connections or DNS queries to known public tunneling services (e.g., Cloudflare Tunnel, localtunnel, bore, devtunnels) made by processes other than common web browsers. Attackers frequently use these services to bypass firewalls and establish unauthorized reverse shells or persistent C2 channels.
Detects potential lateral movement activity where PowerShell or the Windows Remote Management (WinRM) host process (wsmprovhost.exe) initiates network connections to multiple distinct destination IP addresses over the WinRM default ports (5985/5986). This behavior is characteristic of an adversary using legitimate remote administration tools to pivot or spread across a network.
Correlates a user passing a CAPTCHA gate (Cloudflare Turnstile, reCAPTCHA) with an immediate subsequent connection to an unknown, low-prevalence domain hosting the actual phishing landing page.
Page 210 of 280