Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,876 detections
Filters
Last updated
All Time
Detection languages
2,951
1,378
313
289
239
Contributors
1,807
1,529
1,304
180
173
Categories
20,456
11,839
5,876
5,155
4,865
Platforms
3,744
1,857
1,076
782
160
Products / Services
2,238
1,434
1,273
746
582
MITRE Techniques
2,448
2,148
1,129
937
787
CVEs
19
15
9
7
5
IDS Classtypes
834
334
94
23
20
IDS Protocols
689
276
235
117
23
Detects network traffic associated with known Cobalt Strike Beacon request URI patterns. This rule utilizes network signature inspection to flag outbound connections containing URI fragments commonly used by Cobalt Strike default profiles.
Detects processes attempting to exfiltrate data over a Telegram C2 channel by making network connections to api.telegram.org or t.me, excluding legitimate Telegram client binaries and common web browsers. This behavior is characteristic of Vidar Stealer and other Malware-as-a-Service (MaaS) stealers.
This query detects network communication to known Command and Control (C2) IP addresses used by the Medusa ransomware group, often via malicious SimpleHelp RMM servers.
Detects notepad.exe making anomalous external network connections, which can be indicative of malware like PureHVNC or Brute Ratel C4 (BRc4) using a seemingly benign process for command and control or data exfiltration.
This rule detects network connections from devices to a specific IP address (62.102.148.212) and a set of associated ports (37393, 45839, 38471, 12345, 4444, 5555). This IP address and these ports are known indicators of compromise for the Remcos Remote Access Trojan (RAT) Command and Control (C2) infrastructure. Detection of such connections indicates potential Remcos RAT activity within the environment.
Detects a DAEMON Tools helper process launching cmd.exe and PowerShell with WebClient or DownloadFile methods. The process ancestry is unusual for disk-emulation software and matches the compromised update chain.
Detects outbound web requests to Bing's 'Search by Image' endpoint where the embedded image URL points to a non-Microsoft domain. This mechanism is used in the SearchLeak attack (CVE-2026-42824) to bypass CSP and exfiltrate data from Microsoft 365 Copilot.
Detects potential ransomware activity characterized by the creation of files with a specific extension (.prinzeugen) followed by outbound network communication to known malicious IP addresses within a 24-hour window, which is indicative of double-extortion ransomware behavior.
Detects successful outbound network connections to common botnet-associated remote ports (6667, 6697, 8006, 27374, 27375). The rule aggregates these connections by device to identify endpoints communicating with multiple distinct remote IP addresses, a behavior often indicative of botnet participation or command and control activity.
This rule detects network connections from endpoints to a list of known malicious domains. The detection is further refined by looking for specific URL paths such as '/wlc/', '/load/', or 'success/', which are commonly associated with command and control (C2) communication or data exfiltration activities by malware. This indicates potential compromise and active communication with adversary infrastructure.
Detects HTTP C2 communication patterns associated with Remcos RAT loader by monitoring network events for specific URLs and known malicious IP addresses. This rule identifies outbound network connections to hardcoded malicious IPs and specific URL paths often used for command and control by Remcos.
Detects network connections to known IP addresses associated with Remcos RAT loader infrastructure, identified by specific URL patterns indicative of loader-as-a-service operations. The rule triggers if a device makes 3 or more requests to these URLs within an hour.
This rule detects the explicit use of `curl` or `wget` to exfiltrate data, specifically AWS tokens, to a known Megalodon infrastructure IP address (216.126.225.129). This activity is indicative of the Megalodon CI/CD malware attempting to post extracted data.
This rule detects network connections from common user applications (explorer.exe, outlook.exe, word.exe) to specific remote ports (8080, 443, 445) where the remote URL contains known Emotet indicators. This helps identify potential Emotet malware command and control (C2) or dropper activity.
Detects Node.js initiating connections over port 2222. This is used by the Miasma botnet as a fallback C2/SSH channel when standard ports are blocked.
C2 Connection Detection
YARA-L
Detects network connections to known C2 infrastructure using specific ports
Detects browser connections to the Bing Search by Image endpoint, which can be exploited as an SSRF proxy to bypass Content Security Policies (CSP) and exfiltrate data, as seen in the SearchLeak attack.
This rule detects network connections to specific Steam and Telegram profiles known to be used by Broomstick operators as dead-drop resolvers for Vidar infostealer C2 infrastructure. The rule identifies attempts by devices to communicate with these hardcoded URLs.
Detects DbgView.exe, DbgView64.exe, or VirtualBox.exe processes making unexpected outbound network connections to public IP addresses. This behavior is associated with Backdoor.Turn, which is known to inject into these trusted processes via DLL sideloading to communicate with C2 servers, potentially routing traffic through Microsoft Teams TURN relays.
Detects IP geolocation lookups used to gather target network information
Detects outbound network communication originating from potential VILE ransomware processes. The rule monitors for suspicious Go-based HTTP clients using specific User-Agents (Go-http-client/2.0 or 1.1) initiating network connections to remote ports 80 or 443 with JSON payloads, while explicitly excluding common web browsers and internal RFC-1918 network ranges.
Page 235 of 280