Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,876 detections
Filters
Last updated
All Time
Detection languages
2,951
1,378
313
289
239
Contributors
1,807
1,529
1,304
180
173
Categories
20,456
11,839
5,876
5,155
4,865
Platforms
3,744
1,857
1,076
782
160
Products / Services
2,238
1,434
1,273
746
582
MITRE Techniques
2,448
2,148
1,129
937
787
CVEs
19
15
9
7
5
IDS Classtypes
834
334
94
23
20
IDS Protocols
689
276
235
117
23
Detects the creation of an interactive shell (e.g., bash -i, Python pty, socat) on a Linux host that simultaneously initiates an outbound network connection to an RFC-1918 private IP address. This pattern is characteristic of attackers using reverse shells for command and control or internal network reconnaissance, specifically matching behaviors associated with the MYRA RAT shell-pty plugin.
Detects the macOS.Gaslight Rust-based implant receiving and executing backdoor commands (e.g., shell, kill, upload, persistence) via the Telegram Bot API. The rule correlates outbound network connections to api.telegram.org with subsequent process execution patterns typical of command dispatch (such as execvp or posix_spawnp).
Detects suspicious processes (e.g., node.exe, chost.exe, python) accessing sensitive credential files and subsequently exfiltrating data to the Telegram Bot API via HTTPS POST requests within a 10-minute window. This behavior is indicative of infostealer malware, such as those observed in the Friday Harvest campaign, harvesting and exfiltrating system data.
Detects outbound HTTPS traffic from a web server to api.telegram.org. This pattern is indicative of the Montana Empire phishing kit using the Telegram Bot API for command and control (C2) communication, allowing the adversary to exfiltrate stolen data or receive instructions.
Detects network connections from a host to the api.adblock-for-youtube.com domain at the /api/v2/rules endpoint. This behavior is associated with the 'Adblock for YouTube' browser extension (cmedhionkhpnakcndndgjdbohmhepckk) as it retrieves remote JavaScript scriplets for rule updates, which can be a vector for unauthorized code execution if the domain is compromised or used maliciously.
Detects the 'BadBlocker' Adblock for YouTube browser extension communicating with its command-and-control infrastructure to fetch and execute arbitrary scriptlets in the MAIN JavaScript world. By injecting directly into the page context, the extension gains unauthorized access to the DOM, user browsing sessions, and sensitive form data.
This rule detects network connections or DNS queries originating from an endpoint towards domains or IP addresses associated with BlueKit command-and-control (C2) infrastructure, including TLDs (pk, ws, cc, su) and onion-based addresses. This activity is indicative of potential malware communication or C2 beacons.
Detects a suspicious sequence of events where a user initiates an outbound RDP connection using mstsc.exe on port 3389, followed shortly by the execution of a file named MicrosoftUpdateOneDrive.exe. This behavior is indicative of the Turla threat group deploying their STOCKSTAY.MARKETMAKER malware via an RDP-based phishing lure.
Detects Python scripts or processes accessing common browser credential and cookie storage files (such as Login Data, key4.db, or cookies.sqlite) and subsequently making outbound network connections, indicating potential theft and exfiltration of browser data.
This rule monitors network logs (proxy, web gateway, and DNS) to detect connections to a curated list of known malicious domains associated with phishing, credential harvesting, and malware delivery infrastructure.
This rule identifies suspicious outbound network traffic potentially related to data exfiltration or command-and-control (C2) communication. It monitors for connections to the Telegram Bot API utilizing 'sendMessage' methods, often used by malware for exfiltrating credentials or sensitive data, as well as connections to known 'Bluekit' PhaaS (Phishing-as-a-Service) operator domains.
This rule monitors network and email gateway logs to detect activity related to the Bluekit Phishing-as-a-Service (PhaaS) platform. It identifies traffic to known Bluekit command-and-control or phishing domains, detects the presence of rrweb scripts often associated with session recording on phishing pages, alerts on brand-impersonation phishing pages using specific keyword combinations, and flags the presence of FortiBleed campaign lures.
Detects potential fast-flux DNS behavior indicative of Bluekit PhaaS P2P infrastructure. The rule monitors for browser processes resolving a single domain to 5 or more distinct external IP addresses within a one-hour window, excluding known CDNs and cloud infrastructure.
This rule detects potentially malicious browser activity by monitoring for Google Chrome outbound network connections to known command-and-control (C2) domains associated with malicious browser extensions (e.g., BadBlocker). It also flags the installation or loading of specific, known-malicious browser extension IDs on endpoints.
Detects exploitation attempts against LB-LINK routers via parameter injection in the 'set_LimitClient_cfg' endpoint (CVE-2023-26801) and subsequent command-and-control behavior, including outbound connections to known RondoDox staging IPs and DNS queries for associated malicious domains.
Detects potential malicious browser extension activity by correlating internal browser process network connections to suspicious infrastructure (e.g., adblock-for-youtube.com) with subsequent network traffic from the same process PID to third-party domains within 60 seconds of visiting sensitive high-value websites (e.g., login portals, banking). The rule also alerts on any direct network connection to identified malicious exfiltration infrastructure.
This rule detects potentially malicious activity related to the npm ecosystem. It identifies Node.js processes accessing .npmrc files (which contain authentication tokens) followed by immediate outbound network communication. Additionally, it detects suspicious command-line patterns associated with automated npm publishing (indicative of worm-like propagation) and the presence of npm credentials in the environment or command lines of non-npm processes.
Detects suspicious usage of the 'curl' command-line tool to perform PUT or POST requests with binary data to specific paths, potentially indicating data exfiltration or command and control communication. The rule excludes common web browsers as initiating processes to reduce false positives.
Detects the Havoc Demon utilizing execute-assembly to load post-exploitation .NET tooling (like Seatbelt or SharpHound) directly into memory without touching disk. This rule identifies processes loading 'mscoree.dll' (a .NET runtime component) and subsequently making network connections to non-localhost IP addresses, indicating potential in-memory .NET execution with C2 communication.
This rule detects network connection events where the AutoGen Studio application (identified by its image filename) initiates connections to localhost (127.0.0.1 or ::1) on ports 8080 or 8081. This is typical behavior for the AutoGen Studio web interface or API server running locally.
Detects FTP protocol being used for covert C2 communications
Page 213 of 280