Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,876 detections
Filters
Last updated
All Time
Detection languages
2,951
1,378
313
289
239
Contributors
1,807
1,529
1,304
180
173
Categories
20,456
11,839
5,876
5,155
4,865
Platforms
3,744
1,857
1,076
782
160
Products / Services
2,238
1,434
1,273
746
582
MITRE Techniques
2,448
2,148
1,129
937
787
CVEs
19
15
9
7
5
IDS Classtypes
834
334
94
23
20
IDS Protocols
689
276
235
117
23
Detects outbound network traffic from endpoints to known malicious IP addresses associated with Loader-as-a-Service (LaaS) campaigns. The rule monitors DeviceNetworkEvents for connections to specific indicators of compromise (IOCs) and checks for URL patterns commonly associated with file staging and malware loading (e.g., /drop, /stage, /loader).
This rule detects the combination of a Node.js process reading a JavaScript file with a 24-character hexadecimal filename, immediately followed by outbound network communication to known command and control (C2) IP addresses associated with the 'easy-day-js' campaign. This behavior is indicative of the Mastra NPM supply chain compromise.
This rule detects the creation of the 'class-wc-subscription-diagnostics.php' backdoor file followed by a network connection to the command and control (C2) domain 'generate.2faplugin.org' within a 30-minute window on the same device. This correlation indicates a potential supply chain compromise targeting ShapedPlugin, where backdoored pro plugins are distributed via official channels, leading to 2FA exfiltration.
Detects patterns indicative of double extortion ransomware attacks, specifically the staging of large volumes of archived data followed by suspicious command and control (C2) communications. The rule identifies the creation, modification, or movement of multiple large archive files (RAR, 7z, ZIP, TAR, GZ, CAB) in common temporary or system directories, and correlates this activity with outbound network connections to known C2 indicators such as Tor/I2P/VPN/proxy services or non-RFC1918 IP addresses.
Detects outbound network connections to 'seed1.getsession.org', a known Miasma Command and Control domain. This rule specifically looks for network events where the remote URL contains this domain, indicating potential C2 communication.
Detects a custom proxy process listening for forwarding instructions and creating a second outbound connection to a supplied host and service. This rule specifically looks for network events where the process image name contains 'chainworm', 'svc', or 'proxy' (case-insensitive) and the command line arguments indicate forwarding or connection establishment activities like 'forward', 'next hop', 'bind', 'listen', 'reconnect', or 'TcpClient'.
Detects an unsigned game-related process creating an archive and initiating cloud-storage network activity without an interactive cloud client. This rule specifically looks for network events where the process name contains 'bird', 'rok', 'game', 'update', 'python', or 'ruby' (case-insensitive) and the command line includes terms like 'zip', 'archive', 'upload', 'multipart', 'cloud', 'dropbox', or 'pcloud'.
Detects patterns indicative of double extortion ransomware attacks, specifically the staging of large volumes of archived data followed by suspicious command and control (C2) communications. The rule identifies the creation, modification, or movement of multiple large archive files (RAR, 7z, ZIP, TAR, GZ, CAB) in common temporary or system directories, and correlates this activity with outbound network connections to known C2 indicators such as Tor/I2P/VPN/proxy services or non-RFC1918 IP addresses.
This rule detects network connections to AzureWebsites (specifically '.azurewebsites.net') where the URI path matches patterns used by the Nimbus Manticore implant for command and control polling or initialization. The patterns include '/agent/poll?token=' or '/agent/init' or '/agent/result'. This indicates potential communication with a Manticore implant hosted on an Azure web app.
Detects modern systems generating HTTP traffic using a hardcoded, outdated Internet Explorer 8 User-Agent string, a static artifact of the loader's C2 channel. This specific User-Agent string is 'MSIE 8.0; Windows NT 6.0; WOW64; Trident/4.0'.
Detects connections to cryptocurrency mining pools
Correlates payload execution with anomalous BitTorrent DHT UDP traffic (ports 10000/6881) used for distributed C2 path retrieval.
Detects the legitimate Microsoft .NET build component MSBuild.exe initiating outbound network connections to public IP addresses. This activity is a known LOLBin technique for establishing command and control (C2) or exfiltrating data. Threat actors have been observed abusing MSBuild.exe for host reconnaissance data exfiltration and C2 communications.
Detects unusual connections from IT subnets to known OT/ICS protocol ports (Modbus:502, DNP3:20000, EtherNet/IP:44818, S7Comm:102, OPC UA:4840, IEC 60870-5-104:2404, BACnet/IP:18245) within private IP ranges. This rule specifically looks for a high volume of connections (more than 5) from a single source IP to different destination IPs on these OT ports, excluding traffic from Rockwell devices, which might indicate lateral movement or reconnaissance by threat actors like TheGentlemen, who have historically targeted OT environments.
This rule detects network connections from common user applications (explorer.exe, outlook.exe, word.exe) to specific remote ports (8080, 443, 445) where the remote URL contains known Emotet indicators. This helps identify potential Emotet malware command and control (C2) or dropper activity.
Detects network connections to IP addresses and domains associated with ShinyHunters' infrastructure, observed during the Oracle PeopleSoft data theft campaign.
Detects C2 traffic using non-standard ports to evade detection
Detects creation of cloud accounts for establishing attack infrastructure
Detects access to underground markets selling initial access to compromised networks
Detects internal proxy connections used to relay C2 traffic through network
Detects access to Azure portal for cloud service dashboard discovery
Page 241 of 280