Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,876 detections
Filters
Last updated
All Time
Detection languages
2,951
1,378
313
289
239
Contributors
1,807
1,529
1,304
180
173
Categories
20,456
11,839
5,876
5,155
4,865
Platforms
3,744
1,857
1,076
782
160
Products / Services
2,238
1,434
1,273
746
582
MITRE Techniques
2,448
2,148
1,129
937
787
CVEs
19
15
9
7
5
IDS Classtypes
834
334
94
23
20
IDS Protocols
689
276
235
117
23
Detection rule monitoring for indicators of compromise related to SolarWinds Serv-U, including anomalous Content-Encoding headers, unexpected child process execution, large file staging indicative of data exfiltration (Cl0p-style), outbound exfiltration, SQL injection artifacts, and unauthorized LDAP/Active Directory object enumeration by the Serv-U process.
This rule monitors Cisco Unified Communications Manager (UCM) environments for multiple stages of an attack chain, including potential Server-Side Request Forgery (SSRF) attempts against administrative interfaces, suspicious file modifications by service accounts, indicators of privilege escalation, and anomalous outbound network connections from core Cisco processes.
This rule detects potentially suspicious outbound network connections or DNS queries to known Generative AI service domains (OpenAI, Anthropic, Google, Mistral, Cohere) from non-browser and non-developer processes. It also triggers on suspicious Windows binaries (e.g., PowerShell, bitsadmin, mshta) initiating external connections to these domains or other destinations over port 443, helping identify potential data exfiltration or automated abuse of LLM APIs.
PlugX NetworkIOC
YARA
Modular remote access trojan associated with long-term espionage intrusions
Infostealer distributed via fake open-source tool impersonation sites
Loader used in click-hijacking traffic distribution scheme
Supply chain worm targeting npm packages and GitHub Actions, linked to Shai-Hulud/Hades lineage
IoT botnet malware family used for DDoS and proxy infrastructure
ClickFix style social engineering cluster delivering Mistic and ModeloRAT
Lumma NetworkIOC
YARA
Infostealer-as-a-service targeting browser credentials and crypto wallets
Rust-based macOS infostealer implant embedding prompt injection payloads
Fraud framework powering scam domains for crypto and gambling schemes
Fraud framework powering scam domains for crypto and gambling schemes
Form-grabbing and credential stealing malware-as-a-service
Credential and browser data stealer distributed via OXLOADER campaigns
Ransomware group exploiting edge devices and managed file transfer software
Credential and browser data stealer distributed via OXLOADER campaigns
Flags traffic targeting known rogue DNS infrastructure IPs associated with recent SOHO router hijacking campaigns. This rule specifically looks for outbound network connections to IP addresses starting with '5.' or '185.' on destination port 53 (DNS).
Identifies LLM API interaction followed shortly by the execution of Impacket tools (wmiexec.py, smbexec.py), simulating attackers using AI to formulate lateral movement commands.
This rule monitors build agent processes (e.g., Jenkins, Bamboo, Gradle, MSBuild) for suspicious DNS activity. It alerts when these processes resolve a high volume (3 or more) of unique external domains that are not associated with typical development, build, or dependency management platforms (e.g., Microsoft, Azure, GitHub, NPM, PyPI, Maven, Sonatype). This behavior may indicate an attempt by an adversary to reach command-and-control servers or exfiltrate data from a compromised build environment.
Detects a compiled Mach-O binary residing in a hidden directory (e.g., ~/.config/) making periodic TCP connections to known C2 subnets on common web ports (80, 443, 8080).
Page 216 of 280