Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,876 detections
Filters
Last updated
All Time
Detection languages
2,951
1,378
313
289
239
Contributors
1,807
1,529
1,304
180
173
Categories
20,456
11,839
5,876
5,155
4,865
Platforms
3,744
1,857
1,076
782
160
Products / Services
2,238
1,434
1,273
746
582
MITRE Techniques
2,448
2,148
1,129
937
787
CVEs
19
15
9
7
5
IDS Classtypes
834
334
94
23
20
IDS Protocols
689
276
235
117
23
This rule detects network connections from devices to a predefined list of known malicious domains. It identifies attempts by internal systems to communicate with command and control servers, phishing sites, or other infrastructure associated with threat actors.
This rule detects outbound Server Message Block (SMB) communications from internal devices to external (non-private) IP addresses. It specifically looks for connections on ports 137, 138, 139, and 445. The rule then aggregates these events over 10-minute intervals and flags devices that have more than 5 such SMB connections to distinct external IPs, indicating potential data exfiltration or unauthorized external communication.
Detects outbound network activity to the known malicious domain sfrclak.com or IP address 142.11.206.73. This behavior may indicate malware beaconing, command-and-control communication, or interaction with attacker-controlled infrastructure.
This rule detects suspicious network connections originating from internal IP addresses to common service ports (DNS, SMB, RDP, WinRM) on remote, non-internal IP addresses. It flags instances where a single process on a device makes 10 or more such connections within an hour, which could indicate reconnaissance, lateral movement, or data exfiltration attempts.
This rule detects an unusually high volume of network connections to common proxy ports (3128, 8080, 80, 443) initiated by critical system processes such as 'services.exe', 'svchost.exe', or 'rundll32.exe'. This behavior can indicate the installation and use of a trojan proxy or other malicious software attempting to exfiltrate data or establish command and control through a proxy.
Detects C2 beaconing and token validation activity via GitHub API commit searches using the exact strings hardcoded in the Miasma payload. The worm uses these searches to validate connectivity and verify stolen token legitimacy.
This rule detects HTTP connections to known paid intelligence databases. It specifically looks for hostnames containing 'silobreaker.com', 'sixgill.io', or 'cybersixgill' in HTTP traffic flowing from the home network to any destination. This could indicate an internal system or user accessing external threat intelligence platforms, which might be a normal operation for security teams but could also be an indicator of reconnaissance activity by an adversary.
Detects outbound network connections to known Command and Control (C2) IP addresses associated with the OP-512 threat actor, which are used as fallback infrastructure, including Meterpreter. This rule specifically looks for connections to '43.160.202.246' and '140.206.161.227'.
Detects issuance of free SSL certificates for newly registered attack domains
Detects instances where rundll32.exe executes with missing or minimal DLL arguments and subsequently establishes outbound network connections. This behavior is uncommon in legitimate Windows operations and has been observed during ACR Stealer infections, including executions originating from remote SMB shares and memory-loaded payloads.
This rule detects the upload of virtual machine disk images (VMDK, OVA, OVF, QCOW2, VHD) to cloud storage via HTTP PUT requests. The rule specifically looks for HTTP PUT methods, URIs ending with common VM image file extensions, and a minimum file size of 1MB, indicating a substantial file transfer. This activity could signify an attacker attempting to upload a backdoored or malicious VM image for persistence or to establish a foothold in a cloud environment.
This rule detects attempts to establish a raw socket connection that is not TCP, UDP, or ICMP. This behavior can be indicative of a socket filter backdoor, where an attacker uses raw sockets to bypass standard network stack processing and potentially sniff or inject arbitrary network traffic. The rule specifically looks for outgoing connections from the home network to any destination where the IP protocol is not 6 (TCP), 17 (UDP), or 1 (ICMP).
This rule detects when an Office Add-in is loaded from a remote URL, specifically targeting graph.microsoft.com. It looks for HTTP POST requests where the host is 'graph.microsoft.com' and the URI contains 'addIns'. This activity could indicate an attempt to establish persistence or execute malicious code via Office Add-ins.
This rule detects the use of TCP port 5938, which is commonly associated with the TeamViewer protocol. The rule is specifically looking for established connections to this port, indicating potential remote command and control (C2) activity. A threshold is set to trigger an alert if three such connections are observed from the same source within 60 seconds, aiming to reduce noise from legitimate, infrequent TeamViewer usage while still catching suspicious patterns.
Detects Node.js or Bun processes making network connections to the GitHub API. This rule is designed to identify potential exfiltration attempts, specifically referencing the Miasma campaign which spoofs a 'python-requests/2.31.0' User-Agent to evade network detection while exfiltrating credentials to api.github.com/repos/.
Offshore VPS Provider API Access
Suricata
This rule detects HTTP traffic to specific domains associated with offshore VPS providers (frantech.ca, serverius.net, combahton.net). This could indicate API access or other interactions with these services, which might be suspicious depending on the environment.
This rule detects suspicious HTTP traffic indicating a LinkedIn message that contains an external link. It specifically looks for HTTP requests to 'linkedin.com' with a URI containing '/messaging/' and triggers if 10 such events occur within 60 seconds from the same source IP address. This pattern is often associated with social engineering attempts where attackers use LinkedIn messaging to direct users to malicious external sites.
This rule detects an unusually high volume of successful network connections over SMB (ports 135, 139, 445) originating from a single account within a one-hour window. This behavior can be indicative of lateral movement, reconnaissance, or data exfiltration activities using SMB/RPC.
Detects outbound internet communications generated by rundll32.exe, which is uncommon and frequently associated with malware execution, including ACR Stealer.
This rule generates a comprehensive forensic timeline for a specific executable file, analyzing its origin (file creation/drops), execution context (process creation and child processes), network communications (outbound connections), and persistence mechanisms (registry modifications for run keys/startup and scheduled task creation/updates). It correlates events across different data sources based on the executable's file name or SHA256 hash.
Detects potential WordPress malware activity that abuses Steam Community profile comments as a command-and-control (C2) channel. The malware retrieves encoded payloads hidden in Steam profile comments using invisible Unicode characters, decodes malicious URLs, and downloads additional JavaScript payloads. This rule identifies outbound connections from WordPress servers to Steam Community URLs or known malicious infrastructure associated with this campaign.
Page 248 of 280