Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,876 detections
Filters
Last updated
All Time
Detection languages
2,951
1,378
313
289
239
Contributors
1,807
1,529
1,304
180
173
Categories
20,456
11,839
5,876
5,155
4,865
Platforms
3,744
1,857
1,076
782
160
Products / Services
2,238
1,434
1,273
746
582
MITRE Techniques
2,448
2,148
1,129
937
787
CVEs
19
15
9
7
5
IDS Classtypes
834
334
94
23
20
IDS Protocols
689
276
235
117
23
Detects the execution of VILE ransomware by identifying specific dropped file artifacts (vile_icon.ico, vile_deadlines.json, vile_user_files.zip) and correlating these file events with outbound network connections made by the same process to remote non-private IP addresses, indicating the likely exfiltration of harvested system metadata.
Detects the initial phishing delivery vector: Microsoft Teams spawning a process which downloads from AWS S3 buckets.
Detects network activity initiated by the 'PerfWatson2.exe' process, which is associated with the TinyRCT .NET backdoor, communicating with a known malicious C2 IP address (45.32.113.172). The rule monitors for network connections from this specific binary to the identified infrastructure, indicative of beaconing or command and control activity.
Tracks python executing loop structures scanning internal class C subnets on standard lateral movement ports (135, 445, 3389). The rule identifies devices where python.exe initiates network connections to more than 15 unique remote IPs on these ports within a one-minute interval.
Detects instances where a node.exe process attempts to open sensitive browser files such as 'Login Data' or 'Cookies', which are common targets for credential theft. Additionally, it monitors for network communication (DNS requests or HTTP connections) to the domain 'stitch-production.org', which may be a command and control (C2) endpoint.
This rule detects the execution of processes masquerading as legitimate VMware-related utilities or XDR agents when they exhibit behaviors associated with command-and-control (C2) activity. Specifically, it flags processes matching these names or non-standard file paths that include command-line arguments indicative of tunneling (e.g., 'reverse', 'admin-auth-flag') or connect to a specific, hardcoded malicious IP address on port 41256.
Detects the execution of the XDRAgent process with command-line arguments indicative of a reverse shell connection to a specific remote IP address and port.
Detects anomalous execution of the Bun runtime on CI/CD infrastructure, often associated with the 'Miasma/Mini Shai-Hulud' campaign. The rule monitors for unauthorized Bun process creation spawned by Node.js package management tools (likely via binding.gyp lifecycle hooks), execution using specific campaign-related command-line arguments, or network activity initiated by Bun on non-standard paths, which may indicate build-time compromise and subsequent C2 communication.
Detects anomalous network communication with a known C2 domain associated with the Miasma worm, or attempts by JavaScript runtime processes (node, bun) to access sensitive developer-related files (SSH keys, cloud credentials, browser data) without an authorized IDE parent process.
Detects network activity initiated by PerfWatson2.exe communicating with known command-and-control (C2) IP addresses. PerfWatson2.exe is used as a masquerading process to blend in with legitimate Visual Studio telemetry traffic, a technique observed in TinyRCT C2 beaconing.
Detects potentially malicious activity involving the node.exe process. The rule identifies suspicious parent processes (PowerShell, cmd.exe, explorer.exe, wscript.exe), execution from non-standard user-writable directories (e.g., AppData, Temp), and network connections over non-standard C2 ports typically associated with TonRAT behavior.
This rule detects potential command and control (C2) communication by monitoring for connections to known malicious domains or IP addresses and identifies the creation of suspicious staging files (specifically 'debug.txt') commonly used to collect or exfiltrate data.
This rule detects network connections to known malicious IP addresses or attempts to resolve specific domains associated with malicious activity. It monitors for outbound network traffic patterns identified as potential indicators of compromise (IOCs) linked to command and control (C2) servers.
This rule detects network activity involving connections to known malicious IP addresses or DNS domains ('govtop.one') and subsequent attempts to download specific suspicious file payloads, such as archives or image files often associated with malicious activity. This activity is indicative of potential command and control communication or initial malware ingress.
Detects endpoint activity associated with the Operation DragonReturn phishing campaign, including DNS resolution of known malicious domains, download of specific malicious ZIP archives, execution of extracted dropper files, and network communication with identified command-and-control infrastructure.
This rule detects fileless reflective loading behavior where a process performs an in-memory DLL load (specifically 'mscoree.dll' via 'LdrLoadDllApiCall') and is immediately followed by an outbound network connection within a 5-minute window. This sequence is indicative of techniques used for in-memory execution and command and control (C2) communication.
Detects macOS Terminal (bash/zsh) retrieving 'loader.sh' or 'payload.applescript' directly from the ClickFix attacker infrastructure, indicating potential compromise related to the ClickFix campaign.
Identifies network connections made by Python immediately after loading safetensors or pickle files, indicating a potential supply chain payload phoning home. The rule joins file events where specific model file types (.safetensors, .pkl, .pth) are loaded with network connection events from the same initiating process within one minute of the file load. It specifically excludes local loopback connections.
Detects the Silent Rotor malware transmitting collected system profile as a serialized JSON blob to the C2 domain cdn.kleymarket.ru. The detection specifically looks for network connections to this domain initiated by a process named 'Подтверждение заказа продукции ЦАИ.exe'.
Detects InstallService.exe making outbound network connections over port 445 (SMB) to external or untrusted IPs. This activity could indicate an attempt to coerce authentication or establish remote access.
Correlates the code.exe service initiating encrypted, SSH-like tunnel relay connections without legitimate user IDE engagement.
Page 236 of 280