Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,876 detections
Filters
Last updated
All Time
Detection languages
2,951
1,378
313
289
239
Contributors
1,807
1,529
1,304
180
173
Categories
20,456
11,839
5,876
5,155
4,865
Platforms
3,744
1,857
1,076
782
160
Products / Services
2,238
1,434
1,273
746
582
MITRE Techniques
2,448
2,148
1,129
937
787
CVEs
19
15
9
7
5
IDS Classtypes
834
334
94
23
20
IDS Protocols
689
276
235
117
23
Detects outbound network connections to 'filev2.getsession.org', a known Miasma payload hosting and exfiltration domain. This domain has been associated with Miasma malware for command and control and data exfiltration activities.
Detects Node.js initiating network connections over port 2222. This activity is associated with the Miasma botnet, which uses port 2222 as a fallback C2/SSH channel when standard ports are blocked.
Detects command-line parameters indicating RPC calls to Ethereum/Polygon for C2 resolution, specifically looking for 'eth_call' and known blockchain service providers like 'drpc.org', 'tenderly', 'flashbots', or 'blastapi'. This activity is indicative of the EtherHiding malware.
Detects network traffic to the malicious domain web-telegram[.]ug, which is indicative of Command and Control (C2) communication.
Detects potential port scanning activity originating from a Squid proxy server targeting FTP (port 21). This rule identifies instances where a Squid process attempts to connect to port 21 on multiple remote IPs within a one-hour window, which could indicate reconnaissance or malicious activity.
Detects potential port scanning activity originating from a Squid proxy server targeting FTP (port 21). This rule identifies instances where a Squid process attempts to connect to port 21 on multiple remote IPs within a one-hour window, which could indicate reconnaissance or malicious activity.
This rule detects network connections using the GRE (Generic Routing Encapsulation) protocol to external IP addresses. GRE is often used for tunneling and can be leveraged by adversaries for command and control or data exfiltration, especially when communicating outside of internal networks.
This rule detects network connections made over FTP (port 21) where the remote URL contains keywords often associated with legacy or specific network services like 'NetWare', 'NFS', or 'Novell', combined with the presence of multiple spaces or specific whitespace indicators. This combination could indicate an attempt to interact with or exploit older network protocols or systems, potentially for reconnaissance or data exfiltration.
Detects node.exe initiating outbound network connections to external IPs/domains shortly after an npm.exe or npx.exe process event, excluding common legitimate NPM and GitHub domains. This behavior is indicative of supply chain compromise where malicious NPM packages might execute code and establish C2 communication.
Detects WHOIS queries used to gather domain information for reconnaissance
This query detects network communication to known Command and Control (C2) IP addresses used by the Medusa ransomware group, often via malicious SimpleHelp RMM servers.
Detects network connections initiated by 'backgroundTaskHost.exe' to known Remcos C2 infrastructure, specifically targeting 'duckdns.org' or communicating over port 53552. This rule aims to identify potential Remcos RAT activity.
This rule detects unusual outbound network connections from devices to well-known public DNS servers (Google DNS, Cloudflare DNS, Quad9, OpenDNS) on ports other than the standard DNS (53), HTTP (80), or HTTPS (443) ports. A high number of such connections (5 or more within an hour) could indicate command and control activity, data exfiltration, or the use of DNS tunneling.
This rule detects PowerShell processes attempting to retrieve or execute remote .rtf resources via web requests. It specifically looks for `powershell.exe` or `pwsh.exe` in the process path combined with command-line arguments indicating `Invoke-WebRequest`, `iwr`, `DownloadString`, `Invoke-Expression`, or `iex` targeting a URL ending in `.rtf`.
This rule detects processes generating network connections to multiple known malicious ports (4444, 7211, 8000, 8001, 8002, 10000) within a 30-minute window. This behavior is indicative of command and control (C2) beaconing, where a compromised system periodically communicates with a C2 server. The rule is designed to identify a pattern of C2 activity that might be used across different threat campaigns, leveraging ports commonly associated with various C2 frameworks or custom C2 implementations.
This rule detects outbound HTTP connections to Cloudflare Workers URLs that match the dynamic, date-derived campaign folder parameters used by the GammaDrop malware. Specifically, it looks for URLs ending with a pattern like '/[A-Za-z0-9-]+/[a-z]+/[0-9]{2}.[0-9]{2}.[0-9]{3}/[0-9]+.(tif|bmp)'. This pattern is indicative of GammaDrop's command and control (C2) communication.
Searches for outbound GET requests containing specific parameter structures used to label harvested metadata sources, indicative of data exfiltration via the Stitch-SDK.
Detects curl commands transmitting harvested GitHub tokens (ghp_ prefix) in the request body, representing the final exfiltration stage of gh-token-monitor.
Detects headless browsers managed by AI agents making Cross-Site WebSocket Hijacking connections to localhost. Specifically, it looks for network connections initiated by processes with 'playwright' or 'MultimodalWebSurfer' in their command line, connecting to localhost (127.0.0.1 or ::1) on ports 8080 or 8081.
Identifies the Node/Python payload initiating outbound queries to Solana RPC nodes to fetch encoded C2 instructions hidden in blockchain transaction memos.
Detects network connection attempts to the cloud Instance Metadata Service (IMDS) endpoint (169.254.169.254) initiated by processes that are not known cloud management agents or system utilities, which may indicate unauthorized credential or IAM role token theft.
Page 238 of 280