Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,876 detections
Filters
Last updated
All Time
Detection languages
2,951
1,378
313
289
239
Contributors
1,807
1,529
1,304
180
173
Categories
20,456
11,839
5,876
5,155
4,865
Platforms
3,744
1,857
1,076
782
160
Products / Services
2,238
1,434
1,273
746
582
MITRE Techniques
2,448
2,148
1,129
937
787
CVEs
19
15
9
7
5
IDS Classtypes
834
334
94
23
20
IDS Protocols
689
276
235
117
23
This rule detects anomalous network communication patterns that might indicate Command and Control (C2) activity. It identifies devices making at least 5 connections within a 10-minute window to common web/HTTPS ports (443, 8443, 8080) where the initiating process is not a standard web browser (chrome.exe, firefox.exe, iexplore.exe, msedge.exe). This pattern can suggest non-browser applications establishing frequent connections to C2 servers.
Detects network connection activity originating from the Windows Update service process (wusvc.exe) to a known C2 IP address (38.60.253.35) on port 8084. This pattern is indicative of VSHELL RAT communication, potentially using masquerading to hide its network activity.
This rule detects the targeted extraction of NPM authentication tokens by monitoring process command lines for the string 'npm_' and correlating it with network connections to a specific IP address (216.126.225.129). This behavior is associated with the Megalodon CI/CD malware.
This rule detects outbound network requests to the Filemail API (specifically '2117.filemail.com/api/file/get') followed by the dropping of a ZIP archive within a 10-minute window by the same initiating process on the same device. This behavior is indicative of the 'Screening Serpens' threat activity, where adversaries use legitimate web services like Filemail to deliver malicious payloads.
Detects mshta executing a remote HTA, JavaScript, or HTML resource from a browser-driven installation chain. This rule specifically looks for mshta.exe being executed with a command line containing a URL (http/https) or script protocol (javascript/vbscript) followed by file extensions or keywords commonly associated with malicious scripts or payloads (.hta, .js, .html, payload, install).
Detects anomalous network connections to HTTP/S ports (80, 443, 8080) by suspicious processes (e.g., Python, Netcat, Socat) or those executing known tunneling/web shell scripts (Neo-reGeorg, Chisel). This rule identifies potential egress-blocked environment bypass attempts by monitoring for high-frequency outbound connections that deviate from standard browser or signed-application behavior.
Detects HTTP requests directed at known MexicanMafia Operation Escaneo phishing infrastructure, specifically targeting tax authority and SeedDMS document management users. The rule alerts on access to identified artifact filenames used in the campaign, such as phishing poc and spoofed document management pages.
Detects outbound network connections to specific known malicious egress IP addresses associated with Operation Escaneo, utilizing the Wget user agent to request the '/pwned' resource over port 8888, indicative of SOCKS5-tunneled data exfiltration.
Identifies dfsvc.exe bypassing DNS to check for manifest updates directly from raw external IP addresses. This behavior can indicate an attempt to evade network monitoring or connect to a hardcoded malicious update server.
Detects SMTP connections originating from the persistent Gamaredon operator subnet (194.58.66.0/24) on port 25.
Detects potential S3 bucket exfiltration attempts originating from command-line interface (CLI) tools or Node.js applications. The rule specifically looks for network connections to AWS S3 regional endpoints (us-west or us-east) initiated by processes named 'node.exe', 'python.exe', or 'aws.exe'.
Monitors dfsvc.exe making outbound connections to non-standard, external URLs, representing malicious auto-update polling.
Detects the SOCKS5 proxy server module multiplexing connections to support internal network pivoting. This rule specifically looks for network connections originating from 'setup.exe' to internal IP ranges (10.0.0.0/8, 192.168.0.0/16, 172.16.0.0/12) with a high connection count (over 50) to indicate potential SOCKS5 proxy activity.
Detects suspicious network activity where processes like wscript.exe or rundll32.exe initiate HTTPS (port 443) connections directly to raw IP addresses, bypassing DNS. This behavior is often associated with malware like SocGholish for rapid command and control check-ins.
Detects HTTPS POST requests to known attacker-controlled infrastructure associated with the BadBlocker campaign (e.g., Unistream SDK, adblock-for-youtube domains). These requests often originate from browser extensions via injected scripts, facilitating the potential exfiltration of sensitive browser session data or credentials.
Detects the 'Adblock for YouTube' browser extension (cmedhionkhpnakcndndgjdbohmhepckk) initiating network connections to api.adblock-for-youtube.com to fetch scriptlets. This behavior is associated with bypassing URL validation to enable script injection on non-YouTube domains.
Detects behavior indicative of Bluekit Browser-in-the-Middle (AiTM) phishing, where a client system fetches the rrweb DOM-serialization library followed by the establishment of a WebSocket connection within a 5-minute window. This sequence is consistent with live session recording or interactive DOM streaming from an attacker-controlled infrastructure.
Detects behavior indicative of the 'Adblock for YouTube' browser extension (or associated malicious variants) fetching rule configuration files from 'api.adblock-for-youtube.com', followed by suspicious outbound network traffic to non-Google/YouTube domains. This pattern suggests the extension is performing unauthorized data exfiltration, such as harvesting session cookies or credentials via injected scripts.
Identifies outbound traffic to specific task dispatch endpoints.
Outbound network connections from a sideloaded process context to Alibaba Cloud IPs.
Detects DNS requests originating from endpoints targeting the 'adblock-for-youtube.com' domain. This activity may be associated with browser extensions that exhibit unexpected or potentially unwanted network behavior.
Page 233 of 280