Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,876 detections
Filters
Last updated
All Time
Detection languages
2,951
1,378
313
289
239
Contributors
1,807
1,529
1,304
180
173
Categories
20,456
11,839
5,876
5,155
4,865
Platforms
3,744
1,857
1,076
782
160
Products / Services
2,238
1,434
1,273
746
582
MITRE Techniques
2,448
2,148
1,129
937
787
CVEs
19
15
9
7
5
IDS Classtypes
834
334
94
23
20
IDS Protocols
689
276
235
117
23
Detection of persistent WebSocket connections using libwebsockets to C2.
Detects serialized system metadata being transmitted on port 8443 by MsBuild.
Detects Python scripts making outbound network connections directly to IP addresses without prior DNS resolution. This behavior can strongly indicate hardcoded Command and Control (C2) communication, where an adversary has embedded the C2 server's IP address directly into the script to bypass DNS-based security controls or to ensure connectivity even if DNS is compromised or unavailable. The rule filters out private IP addresses and aggregates connections by device and remote IP, flagging those with a low connection count (less than 10) to reduce noise from legitimate, high-volume bare-IP traffic.
This rule detects unusual outbound Server Message Block (SMB) traffic originating from common Windows processes (explorer.exe, svchost.exe, system.exe) to external IP addresses (not RFC1918 private ranges). It triggers if a device makes 5 or more SMB connections to unique remote IPs within an hour. This could indicate lateral movement, data exfiltration, or other malicious activity.
Detects anomalous external network connections originating from specific Windows binaries (LockAppHost, makecab, Magnify) targeted by DeepLoad's APC injection technique. These native binaries rarely initiate external public network connections.
This rule detects processes making three or more successful outbound network connections within an hour to known code or text sharing sites like Pastebin, GitHub, or Gist. This activity can be indicative of data exfiltration, command and control (C2) communication, or staging of malicious code.
Detects anomalous outbound network connections originating from the Python/vLLM process to irregular ports or cloud metadata IPs. This behavior may indicate command-and-control establishment, secondary staging, or cloud metadata pivoting following a successful CVE-2026-22778 exploit.
Identifies outbound network connections to the Microsoft Device Code authentication endpoint, which may indicate phishing attempts (e.g., via PhaaS kits like Kali365).
Detects cmd.exe invoking curl.exe to download payloads from raw.githubusercontent.com, commonly used for retrieving multi-stage scripts.
Detects PowerShell executing a one-liner Invoke-WebRequest to pull the TiFlux installer directly from an attacker-hosted repository or the vendor.
Detects modern systems generating HTTP traffic using a hardcoded, outdated Internet Explorer 8 User-Agent string, which is indicative of malware beaconing.
This rule detects outbound network communication to a known command and control (C2) IP address (193.42.11.108) on port 8041, specifically when initiated by processes named 'RuntimeHost.exe' or 'InstallUtil.exe'. This activity is indicative of cryptojacking, potentially leveraging ScreenConnect for initial access or persistence, as described in the referenced Microsoft blog.
Flags outbound HTTPS traffic to a specific Azure Blob Storage path ('note1ggbbhggdwa1.blob.core.windows.net/note/ats/') when initiated by 'RuntimeBroker_update.exe'. This pattern is indicative of a dead-drop command and control (C2) mechanism, potentially associated with the 'Operation Dragon Weave' campaign.
This rule detects PowerShell executing a payload deceptively named as a JPEG image file, specifically 'sysupdate.jpeg', followed by subsequent outbound network activity. This behavior is indicative of the SilentCanvas campaign.
This rule detects the execution of 'ComputerDefaults.exe' without command-line arguments, which is a known method for User Account Control (UAC) bypass. It then correlates this activity with outbound network connections to specific ports (5443, 8041, 8443, 80, 443), indicating potential post-exploitation communication or data exfiltration after privilege escalation.
This rule detects the execution of 'curl.exe' that initiates a network connection to the domain 'kak.is'. This activity is indicative of the UnregStealer malware attempting to fetch additional components or communicate with its command and control (C2) server.
Detects outbound network connections to URLs containing strings associated with Qakbot (Qbot) malware infrastructure and common ports used by the malware for command-and-control communication.
Detects network activity associated with the ROOTBOY actor, specifically identifying internal devices communicating with known malicious command and control (C2) IP addresses and subsequently attempting to access specific suspicious domains or URLs linked to the actor's infrastructure.
Detects successful network connections from hosts to specific remote IP ranges (associated with CN infrastructure) on known ports commonly used by ValleyRAT and Gh0st RAT.
Detects successful outbound network connections to common botnet-associated remote ports (6667, 6697, 8006, 27374, 27375). The rule aggregates these connections by device to identify endpoints communicating with multiple distinct remote IP addresses, a behavior often indicative of botnet participation or command and control activity.
This rule detects network connections from internal devices to identified APT Command and Control (C2) IP address ranges over common ports (8080, 443, 21, 22, 23, 25, 445). This traffic pattern is indicative of unauthorized external communication commonly associated with malware or adversary activity.
Page 240 of 280