Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,876 detections
Filters
Last updated
All Time
Detection languages
2,951
1,378
313
289
239
Contributors
1,807
1,529
1,304
180
173
Categories
20,456
11,839
5,876
5,155
4,865
Platforms
3,744
1,857
1,076
782
160
Products / Services
2,238
1,434
1,273
746
582
MITRE Techniques
2,448
2,148
1,129
937
787
CVEs
19
15
9
7
5
IDS Classtypes
834
334
94
23
20
IDS Protocols
689
276
235
117
23
This rule detects network communication targeting specific external IP addresses associated with known SD-WAN infrastructure and common management endpoints (e.g., /dataservice/). This behavior may indicate an attempt to interact with, enumerate, or compromise SD-WAN controllers or managed edge devices.
This rule detects activity associated with malicious or intrusive browser extensions, specifically identifying network connections to a known malicious command-and-control (C2) endpoint, execution of specific scriptlet keywords related to MAIN-world injection in browser processes, and the presence of known 'BadBlocker' extension IDs on endpoints.
This rule detects potentially malicious activity associated with the exploitation of Ray framework dashboards. It identifies three distinct indicators: inbound network connections to the Ray dashboard port (8265), the execution of common file download tools (e.g., curl, wget) by Ray worker processes, and outbound connections from Ray processes to known C2 infrastructure.
This rule detects the installation or update of known malicious browser extensions followed by network communication to identified command-and-control or malicious infrastructure domains. It also monitors for direct network beaconing to these malicious domains, providing defense-in-depth even if installation telemetry is absent.
Detects HTTP 3xx redirect chains where a browser is redirected to a cloud-native staging domain (such as azurewebsites.net, pages.dev, or web.app) that has not been previously observed in the organization's network traffic history over the last 37 days. This pattern is commonly used by adversaries to redirect traffic to staging infrastructure hosting malicious payloads or C2 content while leveraging reputable cloud services to bypass filters.
Detects FTP data connections initiated by 'squid.exe' on high port ranges (1024-65535). This could indicate an attempt to exfiltrate data using an alternative protocol, potentially related to the 'Squidbleed' vulnerability or other malicious activity.
A master aggregation capturing processes generating connections to multiple known malicious ports tied to specific campaigns, indicating potential C2 beaconing activity.
Identifies processes executing Base64 decoded commands where the parent script recently communicated with an AI endpoint, representing prompt-injected or AI-generated payloads.
Hunts for the stealer exfiltrating compressed host profiling information (sw_vers, system_profiler) via HTTP POST using curl.
This rule detects an unsigned process executing from the AppData or Temp directories that loads user32.dll, a required step for installing keyboard hooks (SetWindowsHookEx). This activity is correlated with network connections from the same process to the Telegram Bot API, a common technique for exfiltrating captured keystrokes or other sensitive data.
This rule detects network connections made over FTP (port 21) where the remote URL contains keywords often associated with legacy or specific network services like 'NetWare', 'NFS', or 'Novell', combined with the presence of multiple spaces or specific 'whitespace' keywords. This combination could indicate unusual or potentially malicious activity, such as attempts to interact with outdated systems or obfuscate URLs.
This rule detects HTTP POST connections initiated by 'AutoIt3.exe' which is indicative of Vidar Stealer attempting to exfiltrate data to its C2 server. The rule specifically looks for network events where the HTTP method is POST and joins them with process events where the initiating process is 'AutoIt3.exe'.
Detects indicators of the DragonReturn malware campaign, specifically the download and deployment of malicious payloads hidden within image files. The rule monitors for network connections to known malicious infrastructure, the creation of specific steganographic staging files in sensitive directories, and the use of the URLDownloadToFile API to retrieve these payloads.
This rule monitors network logs (DNS, Proxy, or general network traffic) for communication with TON (The Open Network) blockchain-related infrastructure, including known C2 domains associated with TONResolver and specific blockchain API queries. It flags connections made by suspicious processes such as node.exe, powershell, wscript, cscript, or mshta, which are often used by malware to execute scripts or facilitate C2 communication.
This rule detects potential DcRAT initial beaconing by correlating WMI 'AntiVirusProduct' enumeration with subsequent outbound network connections to known DcRAT C2 infrastructure within a short time window. This behavior is indicative of a post-exploitation reconnaissance phase followed by initial callback.
This rule detects malicious activity associated with the TONResolver RAT, which leverages node.exe to execute JavaScript payloads stored in AppData\Local\Nodejs. The rule monitors for multiple suspicious behaviors, including outbound C2 beaconing to known malicious domains, spawning of suspicious child processes (powershell.exe, cmd.exe, wscript.exe, cscript.exe), unauthorized access to browser-based credential stores (Login Data and Cookies), and establishment of persistence via Windows Registry Run keys.
This rule detects network connections to specific domains known to be associated with malicious activity or to URLs matching a common Command and Control (C2) communication pattern. The domains 'openanyworddocument.com', 'kittyfreespace.com', 'searchdocumentsfree.com', 'autoupdatet.com', 'autoupdaters.com', and 'autoupdatethis.com' are explicitly listed as indicators. Additionally, the rule identifies C2 communication attempts via a regex pattern '/api/(init|cl)/[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}' which often signifies communication with a C2 server using a specific API endpoint and a GUID-like identifier.
Detects network requests to the BadBlocker (AdBlock for YouTube) infrastructure that fetch malicious scriptlet rules. These rules are designed to leverage Chrome's scripting API to execute arbitrary JavaScript in the 'MAIN' world of web pages, effectively bypassing Content Security Policy (CSP) protections to inject unauthorized content.
Detects network communication to known Command and Control (C2) IP addresses used by the Medusa ransomware group.
This rule detects outbound network connections from a device to a specific remote IP address (62.102.148.212) on a set of suspicious ports (37393, 45839, 38471, 12345, 4444, 5555). This pattern is indicative of potential command and control (C2) communication or data exfiltration to a known malicious endpoint.
Detects Python-based command and control activity associated with LegionLoader by monitoring for network connections, DNS queries to specific malicious domains, and file modifications involving '_socket.pyd' within the 'Traiolx Custom Utils' directory path.
Page 225 of 280