Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,876 detections
Filters
Last updated
All Time
Detection languages
2,951
1,378
313
289
239
Contributors
1,807
1,529
1,304
180
173
Categories
20,456
11,839
5,876
5,155
4,865
Platforms
3,744
1,857
1,076
782
160
Products / Services
2,238
1,434
1,273
746
582
MITRE Techniques
2,448
2,148
1,129
937
787
CVEs
19
15
9
7
5
IDS Classtypes
834
334
94
23
20
IDS Protocols
689
276
235
117
23
This rule detects an unusually high volume of network connections to common proxy ports (3128, 8080, 80, 443) initiated by critical system processes such as 'services.exe', 'svchost.exe', or 'rundll32.exe'. This behavior can indicate the installation and use of a trojan proxy or other malicious software attempting to exfiltrate data or establish command and control through a proxy.
This rule detects suspicious outbound DNS queries originating from a device that are not directed to common public DNS servers (Google DNS, Cloudflare DNS). The rule specifically flags queries where the remote DNS name contains keywords like 'malware', 'c2', or 'c&c', and where at least 5 such queries occur within an hour from the same device. This pattern can indicate potential malware communication or command and control (C2) activity.
This rule detects anomalous network communication patterns that might indicate Command and Control (C2) activity. It identifies devices making at least 5 connections within a 10-minute window to common web/HTTPS ports (443, 8443, 8080) where the initiating process is not a standard web browser (chrome.exe, firefox.exe, iexplore.exe, msedge.exe). This pattern can suggest non-browser applications establishing frequent connections to C2 servers.
Detects network connections to known or suspected Command and Control (C2) IP addresses and ports associated with ransomware activity. This rule specifically looks for outbound connections from devices to a predefined list of suspicious remote IP addresses on common C2 ports (443, 8443, 6379, 27017).
This rule detects high volume data exfiltration (over 1GB) from devices to a list of known malicious IP addresses within a one-hour window. It specifically looks for network events where a significant amount of data (SentBytes > 100MB initially, then summed to over 1GB) is sent to hardcoded remote IP addresses associated with potential command and control or data exfiltration infrastructure.
This rule detects network connections initiated by the 'teams.exe' process to public IP addresses. It specifically looks for outbound connections from the Microsoft Teams application to external, non-private IP ranges. This could be used to monitor unusual external communication patterns from Teams, although the specific intent without further context is unclear.
Curl Download From Telegram Channel
Cortex XDR
Detects the use of curl.exe to download files from public Telegram channels to the user's Temp directory, indicative of Gamaredon Dead Drop Resolver (DDR) resolution.
This rule detects outbound TCP connections on port 9050, which is commonly used by the Tor anonymity network. The rule is configured to trigger an alert if there are at least 3 such connections from the same source within a 60-second window, indicating potential use of Tor. The message suggests this activity is related to accessing an Initial Access Broker market.
This rule detects HTTP requests made to well-known AI service API endpoints (OpenAI, Anthropic, Google Generative Language) specifically targeting 'completions' functionality. It triggers an alert if a single source IP makes more than 30 such requests within a 60-second window, indicating potential automated or high-volume use of AI tools for content generation, which could be leveraged for attack content.
Detects compromised serverless functions being used as C2 relay infrastructure
Detects connections to common proxy ports on potentially compromised servers
This rule detects TCP connections originating from the internal network ($HOME_NET) to any external destination on port 9150, specifically looking for the SYN flag in the TCP handshake. Port 9150 is commonly associated with Tor Browser's SOCKS proxy. The rule's message suggests it's intended to identify instances where Tor Browser is being used to access external resources, potentially bypassing organizational policies or security controls.
This rule detects potential data exfiltration attempts via Discord webhooks. It specifically looks for HTTP POST requests to discord.com/api/webhooks/ with a data size greater than 500 bytes. This could indicate an attacker sending sensitive information out of the network using Discord's API.
This rule detects potential data exfiltration over HTTP POST requests. It specifically looks for HTTP POST requests with a client body size greater than 500 bytes and containing the case-insensitive string "ESTABLISHED". This combination suggests that network connection data might be embedded and sent out via HTTP POST, which is a common technique for command and control or data exfiltration.
This rule detects potential internal SSH lateral movement attempts. It triggers an alert when there are 5 or more TCP SYN packets (indicating connection attempts) to port 22 (SSH) within a 60-second window, originating from a host within the home network and targeting another host within the home network. This threshold-based detection aims to identify rapid, repeated SSH connection attempts that could signify an attacker trying to move between internal systems.
This rule detects DNS queries that match a specific pattern indicative of C2 fallback domain rotation. The pattern looks for domains consisting of 8 to 12 alphanumeric characters followed by a top-level domain (TLD) from a list including .top, .xyz, .club, .icu, or .pw. This behavior is often associated with malware using domain generation algorithms (DGAs) or similar techniques for command and control communication, specifically as a fallback mechanism when primary C2 channels are disrupted.
This rule detects processes making a high volume of successful network connections (3 or more within an hour) to domains containing 'codeartifact' or 'artifactory'. This behavior could indicate an attempt to download tools, libraries, or other artifacts, potentially as part of an ingress tool transfer or supply chain attack.
Detects serverless function deployments used as C2 infrastructure
This rule detects a high volume of network connections (10 or more within an hour) from a single process to remote URLs containing 'artifact' or 'maven' on standard HTTP (port 80) or HTTPS (port 443) ports. This activity could indicate legitimate software development or build processes, but also potentially malicious activities such as supply chain compromise, data staging, or exfiltration of development-related artifacts.
This rule detects unusually large network uploads from devices. It identifies successful network connections where individual transfers exceed 100MB and aggregates these transfers by account name and hour. The rule then flags any account that has uploaded a total of 1TB or more within a single hour. This pattern could indicate data exfiltration, unauthorized data synchronization, or other malicious activities involving significant data transfer volumes.
Detects network connections to a specific malicious GitHub raw URL path used by Miasma to download 5th and 6th stage payloads. This rule specifically targets the URL 'raw.githubusercontent.com/letsgo0/sayyadina-phibian-159'.
Page 247 of 280