Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,876 detections
Filters
Last updated
All Time
Detection languages
2,951
1,378
313
289
239
Contributors
1,807
1,529
1,304
180
173
Categories
20,453
11,837
5,876
5,154
4,865
Platforms
3,744
1,857
1,076
782
160
Products / Services
2,238
1,434
1,273
746
582
MITRE Techniques
2,448
2,148
1,129
937
787
CVEs
19
15
9
7
5
IDS Classtypes
834
334
94
23
20
IDS Protocols
689
276
235
117
23
Detects wscript.exe initiating outbound network connections to non-standard HTTP ports (ports other than 80, 443, or 8080), which aligns with JS.MonoGlyphRAT's C2 communication profile. This rule specifically looks for successful network connections from wscript.exe to remote IPs that are not private and are not using standard web ports, indicating potential command and control activity.
Detects Python processes (python.exe, pythonw.exe) making more than 3 connections to public IP addresses. This activity could indicate data exfiltration, command and control communication, or other suspicious network behavior originating from a Python script.
This rule detects potential C2 beaconing behavior by identifying devices that make a high number of periodic outbound connections (20 or more within an hour) to a single external IP address on common web and C2-related ports (80, 443, 8080, 8443, 4444, 5555, 8888, 9001). The rule summarizes these connections by device, remote IP, and initiating process, highlighting sustained communication patterns indicative of command and control.
This rule detects a high volume of outbound TCP communication from the home network to any destination on port 8080. This pattern can indicate a compromised server acting as a proxy or engaging in other suspicious network activity, potentially for resource development or command and control.
This rule detects attempts to enumerate domain trust relationships using LDAP queries. Specifically, it looks for TCP traffic on port 389 (LDAP) containing the string "(objectClass=trustedDomain)" in the server-bound flow. This string is commonly used in LDAP queries to discover trusted domains within an Active Directory environment, which can be a reconnaissance step for attackers.
This rule detects outbound TCP connections to port 9050, which is commonly used by Tor proxies. The rule specifically looks for the initial SYN packet (flags:S) of a TCP connection from the home network to any destination on port 9050. This activity is flagged as a policy violation, indicating the use of a Tor proxy for accessing closed source resources.
This rule detects attempts to access known online platforms used for purchasing stolen data, such as 'leakbase', 'breachforums', and 'raidforums'. It specifically looks for these keywords in the HTTP host header during client-to-server HTTP traffic.
This rule detects access to known exploit kit purchase or dark web marketplace sites by inspecting HTTP host headers for specific domain patterns. The rule triggers an alert if a client on the home network attempts to connect to any of the listed domains, which are associated with exploit kit sales or underground forums.
This rule detects HTTP requests to known data broker websites such as Spokeo, Intelius, and BeenVerified. It triggers an alert if 10 or more such requests are observed from a single source IP within a 60-second window. This activity could indicate reconnaissance efforts to gather information about individuals.
This rule detects potential Secure File Transfer Protocol (SFTP) large file exfiltration attempts. It triggers an alert when a TCP connection on port 22 (SFTP) from the home network to any destination transfers a large amount of data (greater than 65000 bytes) to the server. A threshold of 20 such transfers within 60 seconds from the same source IP is set to reduce false positives. The rule specifically looks for the SFTP protocol magic bytes '|00 00 00|' within the first 4 bytes of the payload.
This rule detects TCP connections to port 8888, which is commonly used by Remote Access Trojans (RATs) for Command and Control (C2) communications. The rule specifically looks for the SYN flag in the TCP handshake, indicating the initiation of a new connection from the internal network ($HOME_NET) to any external destination.
This rule detects network connections to TCP port 4444, which is a commonly used default handler port for Metasploit, a popular penetration testing framework. The rule specifically looks for the initial SYN packet (flags:S) of a TCP connection from any source to any destination on port 4444 within the home network. This activity is often associated with command and control (C2) communication or reverse shells established by attackers using Metasploit.
This rule detects network connections to TCP port 45700, which is a default port used by the XMRig cryptocurrency miner. The detection specifically looks for the initiation of a connection (SYN flag) from the internal network ($HOME_NET) to any external host. This activity is indicative of a system within the internal network potentially running an XMRig miner, which aligns with the MITRE ATT&CK technique T1496 (Resource Hijacking).
Detects potential WordPress malware activity that abuses Steam Community profile comments as a command-and-control (C2) channel. The malware retrieves encoded payloads hidden in Steam profile comments using invisible Unicode characters, decodes malicious URLs, and downloads additional JavaScript payloads. This rule identifies outbound connections from WordPress servers to Steam Community URLs or known malicious infrastructure associated with this campaign.
This rule detects a high volume of successful network connections to common web ports (80, 443, 8080, 8443) where the remote URL contains keywords like 'version' or 'software'. This pattern could indicate an adversary performing reconnaissance to identify installed software and their versions, potentially looking for vulnerabilities or specific applications to target. The threshold of 10 such activities within an hour for a single device is set to flag anomalous behavior.
Detects devices making a high volume (5 or more per hour) of successful network connections to remote URLs containing 'update' or 'patch' on port 443 (HTTPS). This could indicate legitimate system updates, but also potentially malicious update checks or beaconing activity.
Detects web requests containing the specific user-agent or custom secret headers used by the Moika campaign beacon to retrieve its stage 2 payload.
This rule detects suspicious network connections made by processes (excluding legitimate EDR processes like mssense.exe and senseir.exe) to URLs commonly associated with EDR command and control (C2) infrastructure. This could indicate an attempt by an adversary to communicate with or manipulate the EDR agent.
KQL Query
Detects outbound internet communications generated by rundll32.exe, which is uncommon and frequently associated with malware execution, including ACR Stealer.
This rule detects devices making a high volume of outbound network connections (more than 1000 connections within a one-minute window) to a single remote IP address. This behavior could indicate a network denial-of-service (DoS) attack originating from the device, or potentially other forms of high-volume network activity such as data exfiltration or scanning.
Page 253 of 280