Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,876 detections
Filters
Last updated
All Time
Detection languages
2,951
1,378
313
289
239
Contributors
1,807
1,529
1,304
180
173
Categories
20,456
11,839
5,876
5,155
4,865
Platforms
3,744
1,857
1,076
782
160
Products / Services
2,238
1,434
1,273
746
582
MITRE Techniques
2,448
2,148
1,129
937
787
CVEs
19
15
9
7
5
IDS Classtypes
834
334
94
23
20
IDS Protocols
689
276
235
117
23
Detects non-browser processes initiating HTTPS network connections to well-known public DNS over HTTPS (DoH) resolvers. This behavior is often associated with command and control (C2) communication, where malware attempts to evade network security controls by tunneling DNS queries through encrypted HTTPS traffic.
Detects outbound network connections to common MQTT ports (1883, 8883) initiated by living-off-the-land binaries, command interpreters, or unknown processes. This behavior may indicate an attacker using MQTT as a covert C2 channel to bypass network filtering by mimicking legitimate IoT protocol traffic.
Detects potentially unauthorized or suspicious usage of the Jam build tool (jam.exe or jamplus.exe). The rule flags when Jam is executed by non-standard parent processes, when suspicious command-line arguments are used, when Jam spawns unexpected child processes, or when Jam initiates network connections.
This rule detects outbound network connections to 'minemine.gleeze.com' on port 8443 originating from specific .NET utility processes (InstallUtil.exe, RegAsm.exe, MSBuild.exe). This activity is indicative of cryptojacking, specifically a campaign abusing ScreenConnect and .NET utilities for GPU mining, as described in the referenced Microsoft blog.
Detects the disguised SoftwareLicencing.exe reaching out to external networks rather than internal KMS servers, as observed in the 'Screening Serpens' campaign attributed to Iranian APT groups.
This rule detects outbound Command and Control (C2) beaconing activity by the `UpdateChecker.dll` to Azure Websites, which is indicative of the Screening Serpens APT group. It specifically looks for the loading of `UpdateChecker.dll` followed by network connections to domains ending in `azurewebsites.net` from the same initiating process.
Detects the malicious ScreenConnect module beaconing to attacker-controlled C2 infrastructure on custom ports 5443/8041. This rule specifically looks for network connections initiated by a process identified as 'ScreenConnect' to these non-standard ports, indicating potential command and control activity.
Identifies network traffic to the attacker logging server endpoint ey.php initiated by the wrapper ._cache_GAME1.exe, which is associated with malicious Steam wallpapers.
Identifies the SimpleHelp binaries making outbound network connections to untrusted/anomalous IPs, bypassing the configured corporate RMM domains. This rule specifically looks for processes named 'JWrapper*.exe' making network connections to URLs that do not end with 'simple-help.com' or a specified corporate RMM domain, and to remote IPs that are not within the 10.0.0.0/8 private range.
Identifies the SimpleHelp service initiating unusually heavy outbound SMB (port 445) traffic, indicating lateral movement or ransomware propagation across the network.
Detects outbound network connections to common MQTT ports (1883, 8883) initiated by living-off-the-land binaries, command interpreters, or unknown processes. This behavior may indicate an attacker using MQTT as a covert C2 channel to bypass network filtering by mimicking legitimate IoT protocol traffic.
This rule detects the execution of JavaScript files named 'bw_setup.js' or 'execution.js' using the 'bun' runtime, immediately followed by an outbound network connection to the command and control (C2) domain 't.m-kosche.com'. The detection logic correlates process execution events with network connection events within a 10-minute window, indicating potential malicious activity associated with supply chain attacks.
Detects Microsoft Word making an outbound network connection and subsequently spawning the Equation Editor process (EQNEDT32.EXE). This behavior is associated with the exploitation of CVE-2017-11882 via a malicious remote template.
Identifies HTTP connections exhibiting Kazuar's distinct long, deeply nested URL path structures mimicking legitimate API endpoints. The rule specifically looks for URLs matching the pattern /api/v[1-3]/[a-z]+/[a-z]+/[a-f0-9]{32}/, which indicates a versioned API path followed by two alphabetical segments and a 32-character hexadecimal string, characteristic of Kazuar C2 beaconing.
Detects the secondary PowerShell payload establishing a persistent WebSocket connection to a randomly generated endpoint structure.
Identifies the hallmark behavior of AgentTesla (frequently delivered via tax lures) injecting into RegAsm and attempting SMTP/FTP exfiltration.
Tracks communication from ScreenConnect to attacker infrastructure over non-standard ports (5443/8041). This rule specifically looks for network connections initiated by 'ScreenConnect.ClientService.exe' to remote ports 5443 or 8041, which are associated with the SilentCanvas campaign's encrypted command-and-control communication.
Detects connections to cryptocurrency mining pools
This rule monitors for indicators associated with MiniUpdate/MiniJunk V2 RAT and general .NET AppDomainManager hijacking. It detects suspicious registry keys (AppDomainManagerAssembly/Type) or environment variable manipulation used to hijack .NET application execution flow. Additionally, it identifies .NET host processes loading DLLs from user-writable directories (e.g., AppData, Temp) and tracks suspicious beaconing patterns to known Azure CDN domains often used by these threats for Command and Control.
Detects a specific beaconing pattern associated with Fog Ransomware, characterized by a non-browser process making OAuth2 token requests to Google accounts followed by Drive/Sheets API calls, correlated with the deletion of volume shadow copies (VSS) for recovery inhibition.
This rule detects network connections to remote URLs containing specific keywords ('festung', 'germania', 'deutsch', 'prinz', 'eugen') that are indicative of Germany-themed infrastructure potentially associated with the Prinz Eugen Ransomware. This helps identify early communication with command and control servers or data exfiltration points.
Page 239 of 280