Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,875 detections
Filters
Last updated
All Time
Detection languages
2,950
1,378
313
289
239
Contributors
1,807
1,529
1,304
180
173
Categories
20,443
11,831
5,875
5,151
4,864
Platforms
3,743
1,857
1,076
782
160
Products / Services
2,237
1,434
1,273
746
582
MITRE Techniques
2,448
2,147
1,128
937
787
CVEs
19
15
9
7
5
IDS Classtypes
834
334
94
23
20
IDS Protocols
689
276
235
117
23
Detects Windows Explorer (explorer.exe) initiating outbound network connections over port 445 (SMB) to non-private, external IP addresses. This behavior aligns with the zero-click authentication coercion vulnerability (CVE-2026-32202) where Explorer automatically reaches out to a remote UNC path to fetch an icon resource, leaking NTLM hashes.
This rule detects outbound network connections from endpoints to specific, potentially suspicious, IPv4 address ranges (162.220.234.0/24 and 162.220.232.0/24). Such connections could indicate command and control (C2) activity, data exfiltration, or communication with malicious infrastructure.
Detects Windows Explorer (explorer.exe) initiating outbound network connections over port 445 (SMB) to non-private, external IP addresses. This behavior aligns with the zero-click authentication coercion vulnerability (CVE-2026-32202) where Explorer automatically reaches out to a remote UNC path to fetch an icon resource, leaking NTLM hashes.
Detects PowerShell processes executing commands that include common download cradle patterns (nop, w hidden, bypass) and attempt to retrieve content over HTTP/HTTPS. This often indicates an attempt to download and execute malicious scripts or payloads from a remote source.
Detects PowerShell processes executing commands that include base64 decoding (FromBase64String), invoking expressions (IEX), creating web client objects (New-Object Net.WebClient), and making HTTP/HTTPS requests. This combination is often indicative of malicious PowerShell activity, such as downloading and executing payloads from remote servers, potentially obfuscated.
This rule detects instances where MSBuild.exe initiates network connections to external IP addresses. MSBuild.exe is a legitimate Microsoft utility, but it can be abused by adversaries to proxy execution of malicious code and establish command and control (C2) communications. The rule filters out connections to internal, loopback, and non-routable IP spaces to focus on potentially malicious external communication attempts.
Identifies active command and control or exfiltration connections associated with the recent AMOS Stealer campaign delivered via AI agents by matching known C2 infrastructure IP addresses.
Detects PowerShell processes executing web requests (Invoke-WebRequest, iwr, curl) followed by immediate code execution (iex, Invoke-Expression). This pattern is commonly used by adversaries to download and execute malicious scripts or payloads directly in memory, bypassing disk-based detection.
Identifies active command and control or exfiltration connections associated with the recent AMOS Stealer campaign delivered via AI agents by matching known C2 infrastructure IP addresses.
Detects unusual network connections initiated by the Windows Snipping Tool. While SnippingTool may occasionally connect for telemetry or updates, active outbound connections to non-Microsoft endpoints are highly suspicious and could indicate process injection or masquerading.
This rule detects instances where a 'node.exe' process initiates an outbound network connection over HTTPS (port 443) to a domain within the '.vercel.app' top-level domain. This could indicate development activity, but also potential malicious use of Node.js applications for command and control or data exfiltration to cloud services.
This rule detects the execution of a 'curl' command on macOS that attempts to make a POST request to a file named 'salmonela' within the '/tmp/' directory. This pattern is highly suspicious and could indicate an attempt to exfiltrate data, upload malicious content, or interact with a temporary malicious script.
This rule detects suspicious processes (winupdate.exe, windows.exe, svchost.exe, system32.exe) initiating network connections from unusual directories (Downloads, Public, System32) to known cloud storage providers (Amazon AWS, DigitalOcean, Azure Blob Storage) or over port 443. This behavior could indicate data exfiltration, command and control activity, or malware communication.
This rule detects DNS queries made to a list of known malicious domains. These domains are often associated with malware command and control (C2) infrastructure or other malicious activities. Monitoring such queries can help identify compromised systems attempting to communicate with adversary-controlled resources.
Detects a Python process initiating outbound network connections to common administrative and remote access ports (135, 445, 3389). This activity is indicative of the internal port scanning phase used by UNC6692 prior to lateral movement in their SNOW ecosystem deployment.
This rule detects the specific command and control check-in format used by the PhantomPull loader to retrieve the final PhantomPulse payload. It monitors for the URL pattern '/v1/updates/check?build=payloads' within process command lines on Windows systems, indicating communication with the PhantomPulse C2 infrastructure.
Detects instances where Windows screen capture tools (Snipping Tool or Screen Sketch) initiate network connections to external IP addresses on ports commonly associated with Server Message Block (SMB) or Common Internet File System (CIFS). This could indicate an attempt to exfiltrate captured screenshots to an external server.
Detects Adobe Reader initiating unexpected network connections, which may indicate an exploit fetching a secondary payload or communicating with a C2 server.
Monitors for the specific URL pattern used by the PhantomPull loader to fetch the final PhantomPulse payload via WinHTTP. This behavior is associated with the REF6598 campaign.
Detects network connections to Masjesu's hardcoded fallback command and control IP addresses over port 443. This rule is critical for detecting mature infections where Masjesu actively falls back to a set of hardcoded IP addresses if domain resolution fails.
Detects DNS requests directed to the cloudapi[.]stream domain, which is associated with a widespread malicious Chrome extension campaign involving over 100 extensions. Monitoring for this specific domain allows defenders to identify compromised hosts regardless of the specific extension ID.
Page 255 of 280