Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,876 detections
Filters
Last updated
All Time
Detection languages
2,951
1,378
313
289
239
Contributors
1,807
1,529
1,304
180
173
Categories
20,456
11,839
5,876
5,155
4,865
Platforms
3,744
1,857
1,076
782
160
Products / Services
2,238
1,434
1,273
746
582
MITRE Techniques
2,448
2,148
1,129
937
787
CVEs
19
15
9
7
5
IDS Classtypes
834
334
94
23
20
IDS Protocols
689
276
235
117
23
This rule detects a process identified as a Go-compiled binary (via command-line arguments like 'goroutine' or 'runtime.main') that exhibits rapid, high-volume file interactions (more than 100 files accessed or created in a 60-second window) alongside outbound network connectivity. This behavior is indicative of malicious automated activity such as file encryption for ransomware or rapid data staging and exfiltration.
Detects potential supply chain attacks where a suspicious Python package is installed via 'pip' followed by execution of suspicious commands or network activity from 'python.exe' within a short timeframe. This rule correlates process creation events involving pip installations with subsequent suspicious command-line activity or external network connections from Python processes.
Detects network connections to Filen.io cloud storage initiated by processes other than common web browsers. This behavior is often associated with the use of command-line tools or scripts for unauthorized file exfiltration or data staging.
This rule monitors for outbound network connections to 'graph.microsoft.com' initiated by processes that are either unsigned or not digitally signed by Microsoft. It further correlates these connections with proxy logs to identify processes utilizing non-standard or unexpected User-Agents. This behavior is indicative of potentially malicious activity attempting to masquerade as legitimate Microsoft services or using the Microsoft Graph API for command and control or data exfiltration.
Detects the execution of known debugger/disassembler tools (Ghidra, dnSpy, x64dbg) that exhibit suspicious network behavior. The rule specifically looks for these tools initiating network connections to destinations outside of their official update or project domains shortly after execution, and filters out known good hash signatures.
This rule detects a process identified as a Go-compiled binary (via command-line arguments like 'goroutine' or 'runtime.main') that exhibits rapid, high-volume file interactions (more than 100 files accessed or created in a 60-second window) alongside outbound network connectivity. This behavior is indicative of malicious automated activity such as file encryption for ransomware or rapid data staging and exfiltration.
This rule detects processes other than standard web browsers performing network connections that coincide with OAuth token acquisition activities (POST requests containing 'access_token' in the response body). This behavior is indicative of potential token theft or unauthorized programmatic access to OAuth-protected resources.
This rule identifies potential Command and Control (C2) beaconing activity by detecting recurring, consistent HTTP(S) requests from internal hosts to unknown or newly seen external destinations, characterized by stable time intervals and low variance in response sizes. The detection logic filters out common User-Agents, indicating non-browser or automated traffic often associated with malware communication.
This rule detects the execution of QEMU binaries from non-standard locations on Windows endpoints, or the use of port-forwarding command-line flags. Adversaries, including Payouts King and BlackBasta affiliates, leverage QEMU to establish hidden virtual machines for persistent access, credential theft, and to create covert reverse SSH tunnels to bypass network security controls.
Detects Microsoft Outlook spawning a command-line interpreter (cmd.exe or powershell.exe) followed by a network connection originating from that interpreter within a 5-minute window. This behavior is highly suspicious and often indicative of malicious macro execution or exploit delivery via email attachments leading to command-and-control activity.
This rule identifies instances where python.exe or python3.exe executes from non-standard system paths and establishes an outbound network connection to external (non-private/non-loopback) IP addresses. This behavior is indicative of potential malicious activity, as legitimate applications typically execute from protected program file directories, while adversaries often execute unauthorized binaries from temporary or user-writable locations to initiate command and control (C2) communication.
This rule monitors for indicators of unauthorized Tor usage or anonymization activity, including non-standard Tor executable paths, suspicious library loads, the creation of Tor configuration files (torrc), non-browser processes communicating over known Tor ports, and DNS queries for .onion domains. It also specifically monitors for potential data exfiltration via the temp.sh file-sharing service from non-browser applications. The rule aggregates these suspicious signals over a 24-hour period to calculate a risk severity score based on the frequency and variety of indicators detected.
Detects repeated outbound network connections (HTTPS or HTTP) originating from QEMU emulator processes (qemu-system-x86_64 or qemu-system-i386). This activity is indicative of C2 beaconing or post-exploitation traffic originating from a virtualized guest hidden on a host system.
Detects high volume HTTPS outbound traffic (greater than 50MB within a 5-minute window) from a host that does not show evidence of preceding file encryption or volume shadow copy deletion activity. This rule is designed to identify potential unauthorized data exfiltration that deviates from typical ransomware-associated behavior patterns.
Detects malicious node.js processes spawned from npm lifecycle hooks (e.g., install, postinstall) that exhibit suspicious command-line arguments, environment variables, or connections to known malicious domains associated with supply chain compromise campaigns.
This rule monitors for DNS queries, network connections, and HTTP proxy requests originating from node/npm processes or targeting known infrastructure associated with the Trum3it campaign. It covers common malicious domains and specific Vercel subdomains identified as command-and-control (C2) endpoints.
Detects instances where a process not associated with standard SSH operations (e.g., ssh, scp, git) accesses SSH private key files, followed by an outbound network connection to a non-private IP address within a 5-minute window. This behavior is indicative of credential theft and subsequent exfiltration of sensitive SSH keys, often associated with infostealer malware.
Detects instances where a process not associated with standard SSH operations (e.g., ssh, scp, git) accesses SSH private key files, followed by an outbound network connection to a non-private IP address within a 5-minute window. This behavior is indicative of credential theft and subsequent exfiltration of sensitive SSH keys, often associated with infostealer malware.
This rule detects a process initiated by Node.js or NPM performing a DNS lookup for known malicious domains while simultaneously accessing sensitive local files such as SSH keys, AWS credentials, browser cookies, browser login data, or bash history. This pattern is indicative of a post-compromise activity where an adversary leverages a JavaScript runtime to perform credential theft and communicate with C2 infrastructure.
This rule detects the execution of obfuscated PowerShell commands (encoded) that subsequently establish an external network connection and perform process injection within a short timeframe (120 seconds). This behavior is characteristic of malicious staged execution, where a PowerShell script acts as a dropper or loader to fetch secondary payloads and inject them into other processes for evasion.
This rule detects potential supply chain compromise involving typosquatted npm packages. It monitors for the execution of npm packages with names closely resembling legitimate libraries (e.g., 'thirdweb', 'rainbownkit'), followed by suspicious post-install scripts that attempt to initiate network connections to known malicious domains or modify sensitive files.
Page 218 of 280