Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,875 detections
Filters
Last updated
All Time
Detection languages
2,950
1,378
313
289
239
Contributors
1,807
1,529
1,304
180
173
Categories
20,443
11,831
5,875
5,151
4,864
Platforms
3,743
1,857
1,076
782
160
Products / Services
2,237
1,434
1,273
746
582
MITRE Techniques
2,448
2,147
1,128
937
787
CVEs
19
15
9
7
5
IDS Classtypes
834
334
94
23
20
IDS Protocols
689
276
235
117
23
Detects outbound HTTP POST requests containing the specific custom header 'X-Filename: tpcp.tar.gz' used by the TeamPCP credential harvester for data exfiltration. This rule targets a highly specific Indicator of Compromise (IOC) associated with the TeamPCP threat.
This rule detects various indicators associated with the 'Fake Clawdbot VS Code Extension' malware, which is known to install the ScreenConnect Remote Access Trojan (RAT). Detection logic includes suspicious domain names, specific file names downloaded from those domains or Dropbox, known malicious IP addresses, specific SHA256 hashes of malicious files, outbound network connections on port 8041 (excluding common private/reserved IP ranges), ScreenConnect service installations/starts, and suspicious file writes or process executions from temporary directories related to ScreenConnect or 'Code.exe'.
This rule detects potential lateral movement attempts originating from IIS web servers (identified by 'w3wp.exe' as the initiating process) to other internal IP addresses using common lateral movement ports (SMB, RDP, WinRM, SSH). It specifically looks for successful network connections from an IIS server to a private IP address on one of the specified ports, where the remote IP is not the local IP.
This rule detects outbound network connections to URLs associated with common file sharing services (e.g., Dropbox, Mega, Gofile) or temporary email providers (e.g., Temp-Mail). Such connections can indicate data exfiltration attempts, use of unsanctioned services, or communication with command and control infrastructure.
Detects when 'Cursor.exe' (a legitimate application) spawns common command-line utilities (cmd.exe, powershell.exe, pwsh.exe, curl.exe, wget.exe, certutil.exe, bitsadmin.exe) with command-line arguments indicative of downloading files from the internet (e.g., containing 'http://', 'https://', 'ftp://', '-o', '-OutFile', 'iwr', 'DownloadString', 'DownloadFile'). This could indicate malicious activity where 'Cursor.exe' is being abused to facilitate ingress tool transfer or execute malicious payloads.
Detects interactive shell execution within a container in a production, using 'exec'. The execution of `cat`, followed by network connections. This would be communicating with a service that runs arbitrary commands.
This rule detects network connections to a predefined list of known Microstealer malicious domains. These domains are often associated with malware command and control (C2) infrastructure, phishing, or other malicious activities. Monitoring connections to such domains can help identify compromised systems or active malware infections.
Detects network connections to known LLM/AI API endpoints from processes that are not standard web browsers. This is indicative of the LAMEHUG malware used by APT28, which leverages these APIs to dynamically generate and execute commands.
Detects command and control (C2) communication to a specific Telegram Bot API endpoint hardcoded in the LampoRAT malware. This activity is associated with the Boggy Serpens (MuddyWater) threat actor.
Detects C2 communication from Boggy Serpens (MuddyWater) backdoors like Nuso and BlackBeard, which use non-standard HTTP status codes (201, 202, 418) to receive commands from known C2 servers.
This rule detects network connections to a list of domains identified as associated with phishing activities associated with Crimson Kingsnake. Monitoring these connections can help identify compromised systems or users attempting to access malicious sites.
Storm-2561 Network IOC Detection
Cortex XDR
Detects outbound network connections from Windows endpoints to known Storm-2561 Command and Control (C2) infrastructure, including a specific C2 IP address and various domains used for credential exfiltration and initial access via spoofed VPN services.
This rule detects the creation of Amazon SNS (Simple Notification Service) subscriptions that are configured to send notifications to external HTTP or HTTPS endpoints. It specifically looks for `Subscribe` events from the `sns.amazonaws.com` service where the `protocol` is either `http` or `https` and the `endpoint` does not belong to Amazon's own domains (amazon.com, awsapps.com, amazonaws.com). This could indicate data exfiltration or misconfiguration where sensitive information might be sent to an unapproved external service.
KQL Query
This file looks for the part of the TrustConnect campaign where a fake work-related app reaches out to download a remote access package. The language in the rule is kept close to the behavior from the report so it does not turn into a generic rule for every support tool. It focuses on a command that pulls a package with the ScreenConnect name while avoiding the official vendor address. That matters because many companies use remote support software for real work, and a broad rule would create too much noise. The point here is to catch the suspicious pattern where a disguised lure app is used to bring in hidden remote access, not to flag normal help desk activity. In plain language, this file tries to spot a download step that fits the fake workplace-software scam described by Microsoft, where something that looks safe or familiar is used to quietly place a control tool on the victim machine.
Detects outbound network traffic to Icedrive domains from non-browser and non-Icedrive client processes, which could indicate C2 communication by the BeardShell implant used by Sednit (APT28).
Detects outbound network traffic to Filen domains from non-browser and non-Filen client processes, which could indicate C2 communication by Sednit's modified Covenant implant.
This rule detects suspicious outbound network connections from devices that exhibit a consistent timing pattern (low standard deviation relative to the average time delta between connections) to public IP addresses. It specifically looks for connections that are not initiated by common browsers unless they are running in headless mode, or connections initiated by processes with low global prevalence or identified as Living Off The Land Binaries (LOLBAS). This pattern can indicate automated activity, command and control communication, or data exfiltration.
Detects a common PowerShell reverse shell pattern in script block logs (EID 4104). This pattern involves creating a TCP client, getting the network stream, and using Invoke-Expression (iex) to execute commands received over the network.
This rule detects successful outbound SSH (port 22) connections originating from a private IP address on a device to a public IP address. This could indicate unauthorized remote access, data exfiltration, or command and control activity.
This rule detects network connections initiated by specific executables (clawdbot, node, moltbot, openclaw) from a local port (18789, 3000, or 8080) to a remote IP address that is not localhost, not within private IP ranges (10.0.0.0/8, 192.168.0.0/16, 172.16.0.0/12), and not within the 17.0.0.0/8 CIDR block. This could indicate command and control (C2) communication or unauthorized data exfiltration by potentially malicious bots or applications.
Page 257 of 280