Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,876 detections
Filters
Last updated
All Time
Detection languages
2,951
1,378
313
289
239
Contributors
1,807
1,529
1,304
180
173
Categories
20,453
11,837
5,876
5,154
4,865
Platforms
3,744
1,857
1,076
782
160
Products / Services
2,238
1,434
1,273
746
582
MITRE Techniques
2,448
2,148
1,129
937
787
CVEs
19
15
9
7
5
IDS Classtypes
834
334
94
23
20
IDS Protocols
689
276
235
117
23
This rule detects HTTP network connections to common Cloud Virtual Private Server (VPS) providers (DigitalOcean, Vultr, Linode, Hetzner) where the URI content includes the word 'create'. This combination suggests an attempt to set up new infrastructure, potentially for malicious purposes, aligning with resource development tactics.
This rule detects large data uploads over HTTPS (port 443) from the home network to any external destination. Specifically, it triggers if the data size in a single TCP flow to the server exceeds 65,000 bytes. To prevent excessive alerts, it uses a threshold of 20 such events within 60 seconds, tracked by the source IP address. This behavior is indicative of potential data exfiltration.
This rule detects TCP network connections originating from the internal network ($HOME_NET) to any external destination on port 1337. The detection is specifically for the initial SYN packet of a TCP handshake (flags:S) and is categorized as 'trojan-activity'. Port 1337 is commonly associated with Remote Access Trojans (RATs) for Command and Control (C2) communications, aligning with MITRE ATT&CK technique T1219.
This rule detects sustained outbound network traffic with a data size greater than 1000 bytes, originating from the home network. It triggers an alert if 200 such connections are observed from the same source IP address within a 300-second window. This behavior is indicative of automated exfiltration, where an attacker continuously sends data out of the network.
Detects cURL making direct HTTP requests to raw IPv4 addresses specifically seeking 'installer' binaries. This specific command-line pattern is a documented staging technique used by UNC3753 to deploy RMM payloads on victim machines.
Detects modifications to the 'SSLKEYLOGFILE' environment variable in the Windows Registry. This variable is often used by applications like web browsers to log SSL/TLS session keys to a file, which can then be used to decrypt encrypted network traffic. Malicious actors might enable this to capture sensitive data.
This rule detects suspicious outbound DNS queries originating from a device that are not directed to common public DNS servers (Google DNS, Cloudflare DNS). The rule specifically flags queries where the remote DNS name contains keywords like 'malware', 'c2', or 'c&c', and where at least 5 such queries occur within an hour from the same device. This pattern can indicate potential malware communication or command and control (C2) activity.
This rule detects a high volume of outbound network connections (20 or more within an hour) from a single device and process to non-RFC1918 IP addresses on ports commonly associated with Remote Access Trojans (RATs) or Command and Control (C2) communication. The ports monitored include 443, 8443, 8080, 80, 4444, 5555, 6666, and 7777. This pattern can indicate a compromised host attempting to establish C2 with an external adversary.
Detects network connections to the '.cfd' TLD originating from common web browsers. This cheap TLD is increasingly abused by attackers to host phishing redirect pages delivered via malicious SVG files.
Detects generic application layer protocol abuse for C2 communications
Detects junk data padding in HTTP requests used to obfuscate C2 communications
Detects compromised host participating in botnet C2 beaconing
Detects automated social media account registration used for fake identity infrastructure
This rule detects DNS queries for TXT records that contain specific patterns indicative of DNS calculation C2 (Command and Control) activity. The pattern searched for is a PCRE regex matching two alphanumeric strings, each 4 to 8 characters long, separated by a dot (e.g., 'abcd.efgh.'). This type of activity is often associated with malware using DNS TXT records to encode C2 instructions or data, potentially involving IP math for dynamic C2 server resolution. The rule includes a threshold to prevent excessive alerts, triggering if 5 such queries are observed from the same source within 60 seconds.
This rule detects potential callback activity from a remote hardware implant. It specifically looks for HTTP requests where the URI contains common callback patterns like '/callback', '/checkin', '/ping', or '/heartbeat', and the User-Agent header indicates a scripting tool such as 'python', 'curl', or 'wget'. The rule also specifies that the HTTP body size should be between 1 and 199 bytes, and it uses a threshold to trigger an alert if 10 such events occur within 60 seconds from the same source.
Detects network traffic to known Command and Control (C2) IP addresses and ports associated with the ClickFix Python RAT.
Detects network connections over common exfiltration ports (80, 443, 53) to external IP addresses originating from executables running out of uncommon, temporary, or public directories. This behavior frequently indicates custom or unrecognized malware binaries conducting data exfiltration or establishing Command and Control (C2) communication.
Detects network connections over common exfiltration ports (80, 443, 53) to external IP addresses originating from executables running out of uncommon, temporary, or public directories. This behavior frequently indicates custom or unrecognized malware binaries conducting data exfiltration or establishing Command and Control (C2) communication.
This rule detects potential brute force or enumeration attempts against an IIS web server by identifying a high volume of access denied (HTTP 401 or 403) responses from a single IP address within a one-hour window. A count of 20 or more such responses from the same IP is considered suspicious.
This rule detects processes making a high volume of successful network connections to GitHub's raw content (raw.github.com). This behavior can be indicative of an adversary downloading tools, scripts, or other malicious content from GitHub, potentially as part of a command and control (C2) channel or for staging purposes. The rule counts connections per hour per initiating process filename and flags if the count exceeds 5.
This rule detects processes making a high volume of network connections (10 or more within an hour) to URLs containing 'release' or 'download'. This behavior can be indicative of malware downloading additional components, updates, or exfiltrating data, but could also be legitimate software updates or large file transfers.
Page 250 of 280