Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,876 detections
Filters
Last updated
All Time
Detection languages
2,951
1,378
313
289
239
Contributors
1,807
1,529
1,304
180
173
Categories
20,456
11,839
5,876
5,155
4,865
Platforms
3,744
1,857
1,076
782
160
Products / Services
2,238
1,434
1,273
746
582
MITRE Techniques
2,448
2,148
1,129
937
787
CVEs
19
15
9
7
5
IDS Classtypes
834
334
94
23
20
IDS Protocols
689
276
235
117
23
Detects network traffic on port 443 originating from non-browser processes destined for known DNS-over-HTTPS (DoH) providers (Cloudflare, Google, Quad9). This behavior can indicate an attempt to bypass standard network DNS filtering or to establish Command and Control (C2) communication channels using the DoH protocol.
Detects unauthorized or anomalous modifications to local vector database files by non-standard processes.
Detects unauthorized or anomalous modifications to local vector database files (e.g., ChromaDB, FAISS SQLite) by non-standard processes, indicating an attacker attempting to poison the AI's retrieval context directly. The rule specifically looks for file modifications or renames of common vector database files (chroma.sqlite3, faiss_index.index, index.faiss) where the initiating process is not a standard AI/ML runtime (python.exe, node.exe, docker.exe) and there is an outbound network connection from that process to a non-localhost IP.
Detects network traffic on port 443 originating from non-browser processes destined for known DNS-over-HTTPS (DoH) providers (Cloudflare, Google, Quad9). This behavior can indicate an attempt to bypass standard network DNS filtering or to establish Command and Control (C2) communication channels using the DoH protocol.
Detects outbound network connections from the aspnet_compiler.exe process. This process is often abused by malware like LokiBot as a host for malicious payloads through process injection to establish C2 communication, as it has no legitimate need for external network connectivity.
This rule detects secondary Command and Control (C2) communication associated with the Remcos RAT loader. It identifies suspicious network connections to specific IP addresses, domains (including those often used by malicious actors like .bit, .onion, .su, .cc), and remote ports commonly utilized by Remcos.
Detects network connections over SMB (port 445) targeting internal IP ranges initiated by common penetration testing or scripting tools (e.g., Python, msfconsole), or attempts containing known exploit strings such as 'eternalblue', 'ms17-010', or 'WinboxExploit'. This behavior is indicative of lateral movement, reconnaissance, or exploitation attempts within the network.
This rule detects network connections to common IP geolocation services such as ip-api.com, ipinfo.io, ipgeolocation.io, and bgpview.io. Adversaries may use these services to gather information about the victim's network, including IP addresses, geographical location, and network topology, which can aid in further targeting or reconnaissance efforts.
Detects outbound network connection from a host to a known malicious IP and port associated with the exploitation of the GeoServer WFS vulnerability CVE-2024-36401. This rule identifies the potential post-exploitation callback, such as a curl command, following successful remote code execution.
Detects evidence of LCRYX ransomware activity, specifically identifying beaconing behavior via a 'ping.exe' loop targeting the 'ragebot.fun' domain, and the execution of suspicious Visual Basic scripts (systemconfig.exe.vbs) via wscript or cscript, which are often used for stage-loading malicious payloads.
Detects WinRAR executing with archiving flags (create, add, move) on sensitive paths, followed by an outbound network connection to a non-private IP address within a 10-minute window, which is characteristic of data staging and exfiltration.
This rule detects the staging of data using WinRAR, followed by potential exfiltration to known public file-sharing services (easyupload.io, anonfiles.com, gofile.io, transfer.sh) within a 2-hour window. It monitors for either DNS requests to these domains or the execution of web browsers or common command-line tools (curl, wget, PowerShell) with these domains in the command line arguments following WinRAR usage.
Detects Microsoft Teams processes (teams.exe or ms-teams.exe) making multiple network connections to domains or IP addresses that are not part of the expected Microsoft Teams infrastructure. This rule specifically looks for connections to non-Microsoft domains (excluding .microsoft.com, .office.com, .office365.com, .skype.com, .azure.com, .cdn.office.net) and non-private IP addresses, indicating potential C2 activity by the Backdoor.Turn malware.
Identifies execution of the Windows PowerShell cradle used by GLASSWORM's WASM loader. It looks for 'irm' (Invoke-RestMethod) fetching a URL containing the specific '/win32/i/_' path structure, piped to 'iex' (Invoke-Expression). This pattern is indicative of the GLASSWORM malware's initial payload delivery mechanism.
Detects a non-cloud client process issuing API-style requests associated with object listing, content upload, or content download to a cloud storage service. The rule specifically targets processes with names matching patterns like 'bird', 'rok', 'game', or 'update' followed by '.exe', and command lines containing API-related keywords ('files/list', 'files/upload', 'files/download', 'oauth', 'bearer', 'api') in conjunction with cloud storage service names ('dropbox', 'pcloud', 'cloud'). This behavior is indicative of malware using legitimate cloud services for command and control or data exfiltration.
This rule detects network connections on port 443 made to common public DNS resolvers (1.1.1.1, 8.8.8.8, 8.8.4.4, 9.9.9.9, 149.112.112.112) by processes other than known web browsers. This behavior is atypical for standard endpoint processes and may indicate the use of DNS-over-HTTPS (DoH) for command and control or data exfiltration to bypass network filtering.
Detects DNS resolution of known Bluekit PhaaS (Phishing-as-a-Service) operator domains. These domains are associated with phishing lures that leverage LLMs for localized content and voice cloning, and this detection identifies when a host attempts to resolve these specific malicious domains, indicating a likely interaction with a phishing lure.
This rule monitors and alerts on network connections originating from hosts to known command-and-control (C2) or infrastructure domains associated with malicious browser extensions, specifically those identified in the BadBlocker campaign. These extensions often masquerade as legitimate ad-blocking tools to perform lifecycle beaconing or redirect users to promotional/malicious content.
Detects instances of Bluekit Phishing-as-a-Service (PaaS) where the browser utilizes WebRTC RTCPeerConnection to initiate a UDP STUN request on port 3478 while concurrently accessing a suspicious web page. This behavior is used by attackers to discover the visitor's real IP address, effectively bypassing proxies or VPNs to identify security researchers or analysts.
Detects outbound HTTP/HTTPS requests to api.adblock-for-youtube.com to fetch scriptlet rules. This activity is consistent with the Adblock for YouTube extension (cmedhionkhpnakcndndgjjdbohmhepckk) periodically polling for updates.
Detects anomalous, high-frequency bidirectional WebSocket connections (wss/ws) originating from an endpoint that match patterns associated with Bluekit BitM. These connections typically carry DOM serialization events (rrweb-style) and session handshake data, indicative of a victim's keystrokes and mouse movements being relayed to an attacker-controlled browser session.
Page 224 of 280