Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,876 detections
Filters
Last updated
All Time
Detection languages
2,951
1,378
313
289
239
Contributors
1,807
1,529
1,304
180
173
Categories
20,456
11,839
5,876
5,155
4,865
Platforms
3,744
1,857
1,076
782
160
Products / Services
2,238
1,434
1,273
746
582
MITRE Techniques
2,448
2,148
1,129
937
787
CVEs
19
15
9
7
5
IDS Classtypes
834
334
94
23
20
IDS Protocols
689
276
235
117
23
Detects anomalous network communication patterns and file system changes indicative of SoftEther VPN usage, particularly when linked to processes masquerading as VMware or communicating with known malicious C2 infrastructure. The rule monitors for network connections on common SoftEther ports, connections to specific command-and-control IP addresses, and the creation of SoftEther configuration files like 'hamcore.se2' or 'vpn_bridge.config'.
This rule monitors for network connections that occur over non-standard ports (STUN, MQTT) or to specific suspicious IP addresses and domains, while excluding known legitimate user-facing applications. The detection aims to identify potentially malicious command and control (C2) communication or unauthorized network activity performed by non-standard processes.
Detects outbound network communication and DNS queries to cloud service endpoints (Google Cloud Pub/Sub, Azure MQTT, AWS IoT) originated by non-browser and non-cloud processes, which is a technique used by Grandoreiro banking trojan variants that side-load modules to tunnel command-and-control traffic.
Detects outbound network connections over port 8883 (MQTT/IoT) indicative of the Grandoreiro banking trojan. The rule identifies suspicious, unsigned, or non-whitelisted processes attempting to initiate multiple connections to external endpoints, masquerading as legitimate IoT telemetry traffic using MQTT client configurations.
Detects behavior patterns associated with the Grandoreiro banking trojan, specifically the use of wscript.exe or cscript.exe to execute VBScript files that perform geolocation checks against ip-api.com, followed by the dropping of an executable file in the user's AppData\Local directory.
This rule detects network connections from internal hosts to identified C2 or phishing infrastructure associated with the threat actor group UNC1151 (also known as Ghostwriter). It monitors both host-based network events (via DeviceNetworkEvents) and centralized network security logs (via CommonSecurityLog) for traffic targeting a curated list of known malicious IP addresses.
Detects network connections to Bunny CDN infrastructure that contain common URL path indicators associated with phishing, a technique observed in activity attributed to UNC1151 (Ghostwriter).
This rule detects network connections from internal hosts to identified C2 or phishing infrastructure associated with the threat actor group UNC1151 (also known as Ghostwriter). It monitors both host-based network events (via DeviceNetworkEvents) and centralized network security logs (via CommonSecurityLog) for traffic targeting a curated list of known malicious IP addresses.
Identifies cross-platform binaries (e.g., compiled Node.js or PyInstaller payloads) extracting dependencies into Temp and launching secondary network listeners.
Detects the execution of Nishang's Invoke-PowerShellTcp reverse shell payload. This rule monitors for PowerShell processes (powershell.exe or pwsh.exe) that execute suspicious command-line strings associated with the payload, or common obfuscation/execution patterns like iex/Invoke-Expression, accompanied by an outbound network connection to a non-standard port and non-internal IP address.
This rule detects outbound TLS connections to identified C2 infrastructure associated with the UAC-0226 threat actor and the GIFTEDCROOK malware, specifically by monitoring the certificate subject name 'NextGen Fusion'.
Detects suspicious DNS TXT record queries originating from common script interpreters (e.g., PowerShell, Python, Node.js) that are not recognized legitimate resolvers. The rule further correlates these DNS queries with subsequent process execution or network connection activity within a 60-second window, which is indicative of potential command and control (C2) communication or stager activity.
This rule detects potentially suspicious network connections originating from processes residing in common Git development directories (e.g., node_modules, temp, workspace) shortly after a Git clone, pull, or fetch operation. The detection logic filters for successful connections to non-private, non-whitelisted remote endpoints, which may indicate an adversary leveraging legitimate developer tools and environments for command-and-control (C2) or payload exfiltration.
This rule detects potentially malicious PowerShell activity involving memory injection techniques (e.g., NtAllocateVirtualMemory, NtWriteVirtualMemory, NtCreateThreadEx) occurring in conjunction with outbound network connections within a 5-minute window, which is indicative of command-and-control behavior.
Detects instances where PowerShell scripts execute code patterns indicative of AMSI (Antimalware Scan Interface) bypass techniques, followed closely (within 5 minutes) by a non-standard network connection (excluding ports 80/443) from the same process. This behavior is strongly associated with the execution of obfuscated payloads, such as reverse shells, attempting to evade security detection.
This rule detects network connections initiated by common Windows command-line utilities (powershell.exe, pwsh.exe, cmd.exe) to suspicious remote IP addresses or non-standard ports. It specifically flags known Command and Control (C2) IPs and atypical network ports to identify potential adversary activity like staging or communication.
Detects Python processes that combine potentially dangerous pickle deserialization (pickle.loads) with network-fetching libraries (urllib, requests, socket) and decoding methods (b64decode, fromhex). This pattern is consistent with backdoors or remote access tools (RATs) that fetch encoded payloads over the network and execute them directly in memory via deserialization.
Detects outbound network connections initiated by common AI agent runtime processes (Python, Node.js, OpenClaw) to external destinations that are not identified as known AI service providers, specifically focusing on non-standard ports or the use of WebSocket protocols. This behavior may indicate an AI agent being used for unauthorized data exfiltration, command-and-control communication, or interaction with an unverified external service.
Detects network communication behavior consistent with the TinyRCT backdoor. The rule identifies instances where a process named 'PerfWatson2.exe' attempts to establish HTTP GET or POST connections to a known malicious IP address (45.32.113.172), signaling potential C2 beaconing activity using an encrypted channel.
Detects outbound network connections initiated by the Windows Installer utility (msiexec.exe) to non-private (external) IP addresses over standard web ports (80/443). Msiexec.exe can be abused to download and execute malicious payloads or packages from remote locations.
Detects network communication to well-known public DNS resolvers (1.1.1.1, 8.8.8.8, 9.9.9.9) or DNS queries for their domains, initiated by processes other than standard web browsers. This behavior is often associated with non-browser applications, potential C2 channels, or hidden network activity bypassing system DNS configurations.
Page 229 of 280