Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,876 detections
Filters
Last updated
All Time
Detection languages
2,951
1,378
313
289
239
Contributors
1,807
1,529
1,304
180
173
Categories
20,456
11,839
5,876
5,155
4,865
Platforms
3,744
1,857
1,076
782
160
Products / Services
2,238
1,434
1,273
746
582
MITRE Techniques
2,448
2,148
1,129
937
787
CVEs
19
15
9
7
5
IDS Classtypes
834
334
94
23
20
IDS Protocols
689
276
235
117
23
Detects network beaconing activity attributed to the OceanLotus (APT32) threat group, specifically the SPECTRALVIPER C2 mechanism. The rule identifies the 'OneDrive.Sync.Services.exe' process performing HTTP GET requests to known attacker-controlled infrastructure or using specific malicious cookie headers (zd_cs_pm, euconsent-v2) for command-and-control communication.
Detects outbound network connections initiated by ConfigurationRemotingServer.exe on port 443, which may indicate a reverse shell connection established via DSC (Desired State Configuration) resources.
Detects two distinct suspicious activities on Linux systems: masquerading by processes named 'uptime' making outbound network connections to non-local IP ranges, and the execution of binaries associated with AtlasRAT.
This rule detects potentially malicious activity involving the Linux 'uptime' utility, including abnormal network connections to non-private IP addresses, execution with command-line flags often associated with non-standard utility behavior, and the creation of systemd service files, which may indicate a persistence mechanism.
Identifies python-requests User-Agent authenticating into Office/Graph applications, indicative of Kali365 backend egress.
Detects outbound network connections to common Large Language Model (LLM) APIs (OpenAI, Anthropic, Google) or local LLM instances (Ollama) from processes that are not standard web browsers, common IDEs, or typical development/scripting tools. This behavior may indicate an attempt to exfiltrate sensitive data or interact with LLM services using unauthorized or hidden processes.
Detects instances where a Perl interpreter attempts to mask itself as a Samba (smbd) service process, or where smbd/perl processes initiate network connections on port 5000, and identifies smbd processes spawned by non-standard parent processes like sh, bash, or perl, which is indicative of potential unauthorized service manipulation or backdoor activity.
Detects instances where common web application processes (such as Flask, Django, Gunicorn) execute system utilities (curl, wget, etc.) to query the cloud metadata service URL (169.254.169.254) or domain names associated with instance metadata. This behavior is indicative of potential SSRF exploitation to retrieve cloud environment secrets or instance identity credentials.
Detects the use of Gsocket or gs-netcat utilities for outbound network connections on non-standard ports, as well as the execution of masqueraded 'uptime' binaries making network connections. It also monitors for DNS resolutions associated with Gsocket relay infrastructure to identify potential command and control or unauthorized tunneling attempts.
Detects fltMC.exe initiating outbound network connections, which is anomalous behavior indicative of potential JFMBackdoor activity (associated with Red Lamassu/Calypso) utilizing DLL sideloading or reverse shell execution.
This rule detects web browser processes (Chrome, Edge, Brave, Electron) making network requests to 'raw.githubusercontent.com' that contain keywords indicative of sensitive data, such as 'credential', 'secret', 'password', 'token', 'api_key', or '.env'. This behavior may indicate an adversary attempting to download configuration files or sensitive credentials hosted on GitHub.
Detects outbound network connections to major Large Language Model (LLM) API endpoints (OpenAI, Google, Anthropic) initiated by processes not explicitly identified as standard web browsers or command-line utilities. This pattern may indicate automated data exfiltration ('prompt stealing' or unauthorized access to corporate data) using custom or malicious tools executing from suspicious directories like temp, appdata, or public folders.
This rule detects suspicious outbound network connections to specific Fastly CDN IP addresses associated with the Kimsuky threat group's NUKESPED backdoor. The rule identifies processes attempting to communicate with these infrastructure IPs that are not part of a predefined list of trusted or common legitimate applications, indicating potential command and control (C2) activity.
Detects network connection attempts or successes from critical Windows processes (System, svchost.exe, lsass.exe) targeting the localhost interface (127.0.0.1 or ::1) on non-standard ports (above 1024, excluding SMB ports 445/139). This behavior is often indicative of local process injection, credential dumping activity, or unauthorized inter-process communication used by malware to bypass network security controls.
This rule detects web browser processes (Chrome, Edge, Brave, Electron) making network requests to 'raw.githubusercontent.com' that contain keywords indicative of sensitive data, such as 'credential', 'secret', 'password', 'token', 'api_key', or '.env'. This behavior may indicate an adversary attempting to download configuration files or sensitive credentials hosted on GitHub.
Detects network connections from common web browser processes (Chrome, Edge, Brave, Electron) to loopback addresses (127.0.0.1 or Localhost) where the URL path contains sensitive keywords like /code, /textbox, /credentials, or /secrets. This behavior is often associated with browser-based exploitation attempts, such as targeting local development servers or internal browser automation interfaces to extract sensitive information.
Detects network beaconing activity associated with the MYRA RAT. The rule identifies TCP connections to the hardcoded C2 IP address 192.168.54.1 on port 4444, where multiple connections are observed from the same host over a 10-minute window, suggesting automated heartbeat/beaconing behavior.
Detects the RemotePC RMM component (rpccmdhost.exe) being used to spawn PowerShell processes with suspicious command-line arguments. The rule specifically looks for evidence of hidden PowerShell execution designed to bypass TLS certificate validation and download external scripts or stagers from a known C2 IP address associated with ROOTBOY activity.
Detects unexpected network connections initiated by the Local Security Authority Subsystem Service (lsass.exe) to the localhost (127.0.0.1) on ports other than standard SMB ports (445 or 139). LSASS should typically only communicate locally via RPC or LPC for authentication services, and anomalous network activity from this process may indicate credential theft attempts, process injection, or unauthorized memory access activities.
Detects network connections initiated by Windows Nearby Sharing processes (quick_share.exe, nearby_sharing.exe, or NearbyShare.exe) to non-standard ports, potentially indicating unauthorized file transfers or exfiltration over unusual network channels.
Detects communication between a macOS host and the Telegram Bot API using the 'getUpdates' method. This behavior is indicative of the 'Gaslight' malware family using Telegram as a command-and-control (C2) channel via polling, typically characterized by repeated HTTP requests to 'api.telegram.org'.
Page 220 of 280