Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,876 detections
Filters
Last updated
All Time
Detection languages
2,951
1,378
313
289
239
Contributors
1,807
1,529
1,304
180
173
Categories
20,456
11,839
5,876
5,155
4,865
Platforms
3,744
1,857
1,076
782
160
Products / Services
2,238
1,434
1,273
746
582
MITRE Techniques
2,448
2,148
1,129
937
787
CVEs
19
15
9
7
5
IDS Classtypes
834
334
94
23
20
IDS Protocols
689
276
235
117
23
Detects reverse shell commands commonly established by SPECTRALVIPER to connect back to Miasma C2 infrastructure over /dev/tcp. This rule specifically looks for process creation events where the command line contains a bash, sh, or zsh command initiating an interactive shell and redirecting I/O to a /dev/tcp connection to an IP address and port, then redirecting stderr to stdout.
This rule detects rapid access to specific classified document types (.doc, .docx, .pdf, .xls) followed by network egress to identified C2 structures within a 5-minute window. It correlates file access events for sensitive document types with subsequent network connections initiated by the same process on the same device.
Detects a high volume of outbound emails originating from an internal Exchange server to external addresses with spoofed headers, indicating an Open Relay exploit.
Detects web browsers connecting via Port 80 (HTTP) to domains that strictly mandate HTTPS (HSTS bypass), revealing SSL stripping via DNS hijack. Specifically targets 'login.microsoftonline.com' and 'okta.com'.
Detects Explorer.exe spawning PowerShell to fetch a polymorphic server-side payload where the URL contains randomized alphanumeric parameters preventing static caching.
Detects PowerShell downloading payloads from cdn.jsdelivr.net, which has been associated with malware like ClearFake.
Detects network connections initiated by 'RunSearch.exe' on port 443, which is indicative of Potemkin malware using cpp-httplib for command and control (C2) communication.
Detects outbound network connections initiated by Electron or Node.js processes that are launched from non-standard subdirectories within the AppData\Local path. This rule specifically excludes common legitimate applications like Microsoft programs, Slack, and Discord. The detection aims to identify potentially malicious Electron or Node.js applications attempting C2 communication or other unauthorized network activity from an unexpected location.
Detects outbound network connections initiated by Electron or Node.js processes that are launched from non-standard subdirectories within the AppData\Local path. This rule specifically excludes common legitimate applications like Microsoft programs, Slack, and Discord. The detection aims to identify potentially malicious Electron or Node.js applications attempting C2 communication or other unauthorized network activity from an unexpected location.
Detects Cobalt Strike beacon default HTTP checkin pattern
Detects outbound network connections from 'squid.exe' to internal IP addresses on port 21 (FTP). This could indicate an attacker controlling an FTP server within the internal network, potentially exploiting a vulnerability like Squidbleed.
This rule detects unusual outbound network connections from devices to well-known public DNS servers (Google DNS, Cloudflare DNS, Quad9, OpenDNS) on ports other than the standard DNS (53), HTTP (80), or HTTPS (443) ports. A high number of such connections (5 or more within an hour) could indicate command and control activity, data exfiltration, or the use of DNS tunneling.
This rule tracks the execution of a file named 'uds.exe' and subsequently monitors for any network connections initiated by this process within a 10-minute window of its creation. This behavior is indicative of a compiled payload attempting unauthorized network exfiltration shortly after dynamic compilation, as observed in the 'Operation SilentCanvas' campaign.
This rule detects suspicious network connections originating from specific processes (DbgView64.exe or VirtualBox.exe) to Microsoft Teams TURN relay servers, where the RemoteUrl does not start with "teams.microsoft.com". This indicates potential protocol tunneling or an attempt to exfiltrate data or establish command and control through an unexpected channel, possibly leveraging Microsoft Teams infrastructure in an unauthorized manner. The use of DbgView64.exe or VirtualBox.exe as initiating processes for such connections is highly unusual and indicative of malicious activity.
Detects pythonw.exe establishing a connection to the Vidar C2 domains and sending a significant byte count, confirming credential exfiltration.
This rule detects network connections to the 185.235.137.0/24 subnet, which is associated with XenoRAT command and control (C2) infrastructure. The detection specifically looks for these connections being initiated by 'mshta.exe' or 'powershell.exe', indicating potential malware activity or C2 communication.
Detects a single process initiating SSH connections to a large number of distinct private IP addresses within a ten-minute window. This behavior can indicate automated lateral movement, credential spraying, or other malicious network reconnaissance activities.
Detects C2 traffic using raw TCP/UDP without application layer protocols
Detects network callbacks from hardware implants like O.MG Cable or USB Rubber Ducky
Detects serverless function deployments used as C2 infrastructure
Detects a loader requesting a PHP payload with a generated host identifier and then writing a marker that prevents repeat delivery. This rule specifically looks for network connections initiated by executables like 'powershell', 'cmd', 'loader', or 'update' that include command-line arguments indicative of a PHP payload request with a unique identifier and a marker for single delivery.
Page 242 of 280