Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,876 detections
Filters
Last updated
All Time
Detection languages
2,951
1,378
313
289
239
Contributors
1,807
1,529
1,304
180
173
Categories
20,456
11,839
5,876
5,155
4,865
Platforms
3,744
1,857
1,076
782
160
Products / Services
2,238
1,434
1,273
746
582
MITRE Techniques
2,448
2,148
1,129
937
787
CVEs
19
15
9
7
5
IDS Classtypes
834
334
94
23
20
IDS Protocols
689
276
235
117
23
Detects the use of 'curl.exe' with specific command-line arguments indicating a SOCKS5 proxy connection to 'localhost:9050' and a request to '/recvf.php'. This pattern is often associated with malware or adversary activity attempting to exfiltrate data or establish C2 communications through a local SOCKS proxy, potentially part of a multi-hop proxy chain.
Detects potential data exfiltration attempts initiated by 'explorer.exe' over common third-party services or protocols such as Telegram, Discord webhooks, FTP, or SMTP. This rule specifically looks for network connections made by 'explorer.exe' to known exfiltration channels, which is unusual behavior for the Windows Explorer process.
This rule detects outbound network connections from the internal network to external hosts on specific ports (2404, 37393) that are known to be used by the Remcos Remote Access Trojan (RAT) for command and control (C2) communications. The rule is designed to identify established TCP connections to the server.
This rule detects network connections from internal hosts to identified C2 or phishing infrastructure associated with the threat actor group UNC1151 (also known as Ghostwriter). It monitors both host-based network events (via DeviceNetworkEvents) and centralized network security logs (via CommonSecurityLog) for traffic targeting a curated list of known malicious IP addresses.
Detects network connections to Bunny CDN infrastructure that contain common URL path indicators associated with phishing, a technique observed in activity attributed to UNC1151 (Ghostwriter).
Detects a network beacon triggered strictly during model initialization. If a Python process loads a model file and immediately establishes an outbound TCP connection to an unknown IP, it indicates an embedded payload phoning home.
Detects suspected malicious activity associated with the Dropping Elephant threat group. The rule monitors for two behaviors: 1) IP address geolocation fingerprinting by identifying non-browser processes communicating with ipify.org and ip2c.org within a 60-second window, and 2) Direct network connections to known Dropping Elephant C2 domains, specifically gcl-power.org and chinagreenenergy.org.
Detects phishing attempts leveraging legitimate service redirectors such as Calendly and Google share URLs to deliver malicious photo-themed ZIP archives. The rule identifies suspicious redirect chains to Cloudflare-hosted (.cfd) domains and monitors for specific ZIP filename patterns commonly used in these campaigns to target the hospitality sector.
This rule identifies endpoints making network connections to a set of known suspicious or malicious IP addresses. It aggregates the number of connections and the variety of processes initiating these connections, allowing analysts to identify potential command and control (C2) communication patterns from compromised hosts.
Detects network communication with known malicious IP addresses or URLs associated with the 'govtop.one' infrastructure, which is commonly indicative of command and control activity or malware beaconing.
Detects anomalous svchost.exe behavior involving the use of libjpeg-turbo compression function symbols in the command line, alongside potential C2 communication with a known suspicious domain (kkxqbh.top) or connection over non-standard ports, which may indicate malicious exfiltration or data staging.
Detects anomalous network activity originating from 'NearShareReceive.exe' (Windows Near Share) to public IP addresses on non-standard ports, potentially indicating unauthorized use of the Near Share feature for data staging or exfiltration.
This rule detects network connections on TCP ports 7000, 7001, 8770, and 5353 (commonly associated with Apple services like AirPlay, AirPrint, and Bonjour) initiated by processes other than standard Apple binaries such as iTunes, AppleMobileDeviceService, Bonjour, or mDNSResponder. This behavior may indicate an attempt to blend into expected network traffic by masquerading as legitimate Apple service communication.
Detects outbound network connections initiated by common CLI tools (curl, wget, python, node) when spawned as child processes of an IDE or extension host (e.g., VS Code). This pattern is indicative of potential AWS credential exfiltration where an adversary manipulates IDE configurations (like .amazonq/mcp.json) to execute unauthorized network requests containing AWS secrets.
This rule detects successful outbound network connections from an endpoint to a known Tor directory authority IP address. Establishing a connection to these authorities is a strong indicator that the system is attempting to join the Tor network or is interacting with Tor infrastructure, which may be unauthorized in enterprise environments.
Detects Node.js processes engaging in suspicious behaviors related to supply chain or second-stage attacks. This includes executing scripts from hidden .peer/ directories, accessing specific staging script filenames, and performing DNS requests or network connections to the known malicious domain data-stream.space.
This rule detects a high volume of successful network connections to common web ports (80, 443, 8080, 8443) where the remote URL contains keywords like 'version' or 'software'. This pattern could indicate an adversary performing reconnaissance to identify installed software and their versions, potentially looking for vulnerabilities or specific applications to target. The threshold of 10 such activities within an hour for a single device is set to flag anomalous behavior.
Detects devices making a high volume (5 or more per hour) of successful network connections to remote URLs containing 'update' or 'patch' on port 443 (HTTPS). This could indicate legitimate system updates, but also potentially malicious update checks or beaconing activity.
This rule detects an unusually high number of network connections made by common package managers (npm, nuget, pip) to their respective repositories. A high volume of connections within a short period (1 hour) could indicate automated activity, potential supply chain compromise, or an adversary attempting to download numerous packages for reconnaissance, staging, or malicious purposes.
This rule detects processes making a high volume of successful network connections (3 or more within an hour) to domains containing 'codeartifact' or 'artifactory'. This behavior could indicate an attempt to download tools, libraries, or other artifacts, potentially as part of an ingress tool transfer or supply chain attack.
This rule detects processes making a high volume of successful network connections to GitHub's raw content (raw.github.com). This behavior can be indicative of an adversary downloading tools, scripts, or other malicious content from GitHub, potentially as part of a command and control (C2) channel or for staging purposes. The rule counts connections per hour per initiating process filename and flags if the count exceeds 5.
Page 223 of 280