Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,876 detections
Filters
Last updated
All Time
Detection languages
2,951
1,378
313
289
239
Contributors
1,807
1,529
1,304
180
173
Categories
20,456
11,839
5,876
5,155
4,865
Platforms
3,744
1,857
1,076
782
160
Products / Services
2,238
1,434
1,273
746
582
MITRE Techniques
2,448
2,148
1,129
937
787
CVEs
19
15
9
7
5
IDS Classtypes
834
334
94
23
20
IDS Protocols
689
276
235
117
23
Detects the ClickFix infection chain where a web browser process spawns PowerShell to execute obfuscated ScriptBlock content. This activity is correlated with network connections to identified ErrTraffic C2 infrastructure (/api/index.php?a=ctx) used for distributing various malware payloads including Vidar, Stealc, and others.
Detects the 'procq' process establishing network connections to common Monero (XMR) mining pool ports. This behavior is indicative of a cryptominer deployment, specifically associated with the Langflow cryptominer campaign related to CVE-2026-33017.
Detects the presence of Remcos RAT by correlating a specific mutex (Remcos_Mutex_Inj) indicative of active malicious processes with an outbound network connection to a known command-and-control (C2) IP address (62.102.148.212) on port 37393. This combination is characteristic of Remcos RAT operations used for unauthorized audio and webcam surveillance.
This rule detects the creation of a '_vault.zip' archive, which is characteristic of the VVS Stealer malware, followed by network activity to Discord from the same process within a 15-minute window. VVS Stealer uses these archives to store stolen browser data (passwords, cookies, history, autofill) before exfiltrating it, often via Discord webhooks.
Detects the execution of a Nuitka-compiled Python RAT (chost.exe) associated with the PostCSS typosquatting campaign. The rule identifies this malicious binary when spawned by wscript.exe, powershell.exe, or node.exe from a location outside of C:\Windows\, followed by network communication to known campaign-associated C2 infrastructure.
This rule identifies network connections (DNS queries, HTTPS/WebSocket traffic) directed toward known suspicious domains associated with potentially malicious C2 infrastructure.
This rule detects instances where Microsoft Excel (excel.exe) initiates an external network connection within 60 seconds of process startup. This behavior is often associated with the execution of malicious macros or embedded objects designed to reach out to attacker-controlled infrastructure for downloading secondary payloads or establishing command-and-control (C2) communication.
Detects Python processes that establish network connections to web ports (80 or 443) followed by the execution of deserialization functions (pickle.load or pickle.loads) within the same process context. This pattern is commonly associated with downloading and executing malicious payloads or remote code execution via insecure deserialization.
This rule detects network traffic patterns associated with the Turla group's STOCKSTAY malware, specifically identifying WebSocket upgrade requests directed at the external domain 'canal1zac1a.onrender.com'. This pattern is indicative of a Command and Control (C2) channel initiation.
Correlates JS payload execution with immediate network requests to high-reputation but compromised shadowed domains used for traffic proxying. Specifically, this rule detects network connections initiated by 'wscript.exe' to known SocGholish domain shadowing infrastructure.
Detects outbound web traffic directed towards common password management services (e.g., 1Password, LastPass, Bitwarden) originating from user agents associated with AI and LLM tools (e.g., OpenAI, Claude, Copilot). This combination of destinations and user agents is highly anomalous and may indicate potential credential exfiltration or interaction with automated agents acting on behalf of a user to access sensitive vault data.
Detects instances where the Local Security Authority Subsystem Service (lsass.exe) initiates a network connection to the loopback address (127.0.0.1 or ::1), excluding standard SMB traffic (Port 445). Such behavior by LSASS is highly anomalous and may indicate exploitation attempts, such as memory dumping or credential harvesting techniques involving inter-process communication.
Detects execution of Python interpreters used as an SMB server, specifically where the implementation is not using the standard SMB port (445). This behavior is often associated with the use of tools like Impacket's smbserver.py for lateral movement, staging, or data exfiltration, attempting to blend in by using non-standard ports.
This rule detects network activity involving known suspicious domains and the download of specific, potentially malicious files (archives and installers). The monitoring focuses on HTTP/proxy/DNS traffic where hostnames, URLs, or query parameters match indicators of malicious activity.
This rule detects instances where Microsoft Excel (excel.exe) initiates an external network connection within 60 seconds of process startup. This behavior is often associated with the execution of malicious macros or embedded objects designed to reach out to attacker-controlled infrastructure for downloading secondary payloads or establishing command-and-control (C2) communication.
This rule detects processes that load .NET-related modules (clr.dll or dotnet.exe) and maintain a network connection (port 80 or 443) for more than one hour during standard business hours. This behavior is indicative of potentially persistent, long-running .NET-based applications or potentially malicious tools maintaining persistence and C2 communication.
Detects Python processes that establish network connections to web ports (80 or 443) followed by the execution of deserialization functions (pickle.load or pickle.loads) within the same process context. This pattern is commonly associated with downloading and executing malicious payloads or remote code execution via insecure deserialization.
Detects network traffic associated with the Turla group's STOCKSTAY malware, specifically identifying outbound WebSocket upgrade requests directed to the known command-and-control domain weatherdataai.theworkpc.com.
This rule detects network traffic patterns associated with the Turla group's STOCKSTAY malware, specifically identifying WebSocket upgrade requests directed at the external domain 'canal1zac1a.onrender.com'. This pattern is indicative of a Command and Control (C2) channel initiation.
Detects network connections to Bunny CDN infrastructure that contain common URL path indicators associated with phishing, a technique observed in activity attributed to UNC1151 (Ghostwriter).
Detects suspicious network activity originating from the InstallUtil.exe process. InstallUtil is a legitimate Windows .NET utility that can be abused as a LOLBin (Living-off-the-Land Binary) to proxy the execution of malicious payloads, potentially bypassing application control mechanisms.
Page 221 of 280