Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,875 detections
Filters
Last updated
All Time
Detection languages
2,950
1,378
313
289
239
Contributors
1,807
1,529
1,304
180
173
Categories
20,443
11,831
5,875
5,151
4,864
Platforms
3,743
1,857
1,076
782
160
Products / Services
2,237
1,434
1,273
746
582
MITRE Techniques
2,448
2,147
1,128
937
787
CVEs
19
15
9
7
5
IDS Classtypes
834
334
94
23
20
IDS Protocols
689
276
235
117
23
Detects the "EtherHiding" technique used by the FakeGit campaign. The malware queries a Polygon Mainnet smart contract via a public RPC node to resolve its current C2 server address. This rule looks for network connections to known blockchain RPC providers containing the specific function selectors used by the malware's V1 and V2 contracts.
This rule detects outbound network connections to a predefined list of suspicious cloud storage and file-sharing services. These services are often used by adversaries for exfiltration of collected data, providing a covert channel due to their common use and potential for SSL/TLS encryption. The rule specifically looks for `RemoteUrl` containing any of the domains listed in `suspiciousexfildomains`.
This rule detects network connections to known pastebin and text storage sites initiated by processes that are not common web browsers. This could indicate data exfiltration, staging of malicious code, or command and control activity where sensitive information is uploaded or retrieved by non-standard applications.
This rule detects network connections from devices to a list of known malicious domains. These domains are often associated with command and control (C2) infrastructure or other malicious activities.
Detects the use of curl.exe where the User-Agent string contains a URL pointing to temp.sh. This specific TTP was observed in the Notepad++ supply chain attack (Chrysalis infection chain) to exfiltrate system information and signal the uploaded file's location to the C2 server.
Detects network connections to the primary C2 IP and port (103.106.67.63:1244) used across all modules of the StegaBin infostealer toolkit. This specific IP and port combination is highly indicative of StegaBin activity.
This rule detects network communication with known AI model providers by checking `RemoteUrl` against a list of AI API URLs from an external CSV file. It aims to identify potential unauthorized use of AI services, data exfiltration to AI models, or to monitor AI usage within an environment.
was reading this article today on cybersecuritynews (🔗 ⬇️ ) about attackers abusing Windows File Explorer + WebDAV to deliver malware, and it made me think about how to monitor this threat.
The attack makes File Explorer connect to an external location that looks like a normal folder. From the user side nothing feels strange… but in reality explorer.exe is establishing an internet connection to attacker infrastructure.
As I usually say, it’s often better to focus on IOAs (how the activity happens) rather than only URLs or domains, because those are trivial for attackers to change. The behaviour is what tends to stay consistent.
The following KQL Query filter identify external connections initiated by Explorer + option to exclude False Positives based on URLs + option to specify connections to specific countries
The attack makes File Explorer connect to an external location that looks like a normal folder. From the user side nothing feels strange… but in reality explorer.exe is establishing an internet connection to attacker infrastructure.
As I usually say, it’s often better to focus on IOAs (how the activity happens) rather than only URLs or domains, because those are trivial for attackers to change. The behaviour is what tends to stay consistent.
The following KQL Query filter identify external connections initiated by Explorer + option to exclude False Positives based on URLs + option to specify connections to specific countries
Detects network connections to Hugging Face to download a large Large Language Model (LLM) module, a technique used by the SURXRAT Android RAT to induce network lag and degrade device performance.
Identifies network connections to known command and control (C2) and dropper distribution infrastructure associated with the EncystPHP web shell campaign.
Detects outbound network traffic or DNS queries to the Yandex Cloud Functions domain (functions.yandexcloud.net). This domain was used as a C2 relay by the 'ambar-src' malicious npm package, indicating potential command and control activity.
Detects network connections from the Claude Code CLI ('claude' or 'claude.exe') to a destination other than the official 'api.anthropic.com' endpoint. This indicates that the 'ANTHROPIC_BASE_URL' environment variable has likely been overridden by a malicious '.claude/settings.json' configuration file in an attempt to intercept and exfiltrate API keys, as described in CVE-2026-21852.
Detects network traffic to a known StegaBin C2 IP address or specific URI paths used for data exfiltration. This activity is associated with multiple modules of the StegaBin infostealer toolkit.
Detects non-browser processes making DNS-over-HTTPS (DoH) queries to Cloudflare's DNS service. This specific behavior is used by the Dohdoor backdoor to resolve its C2 domains while evading traditional DNS monitoring. The rule specifically looks for connections to Cloudflare's DoH service (1.1.1.1 or cloudflare-dns.com on port 443 with the /dns-query path) from processes that are not common web browsers. The fidelity is significantly increased by the optional check for the 'insomnia' User-Agent, which is characteristic of the Dohdoor malware.
Detects network connections to domains and URLs known to be used by the 'Contagious Interview' campaign for staging malicious batch scripts and PyArmor payloads. This rule specifically looks for connections to hardcoded malicious domains and URL paths identified with the campaign.
Detects network connections to known Command and Control (C2) infrastructure associated with the APT37 Ruby Jumper campaign. This includes the C2 IP address for the FOOTWINE backdoor and the Zoho WorkDrive Client ID used by the RESTLEAF implant for exfiltration.
Detects non-browser processes making outbound connections to specific Google Sheets API endpoints used by the GRIDTIDE backdoor for command and control. This activity is indicative of the malware using legitimate cloud services to disguise its C2 traffic.
Detects a Node.js process making outbound network connections to known malicious infrastructure associated with a developer-targeting campaign. The campaign used Vercel for staging and specific IPs for C2.
This rule detects potential C2 beaconing behavior by identifying devices that make a high number of periodic outbound connections (20 or more within an hour) to a single external IP address on common web and C2-related ports (80, 443, 8080, 8443, 4444, 5555, 8888, 9001). The rule summarizes these connections by device, remote IP, and initiating process, highlighting sustained communication patterns indicative of command and control.
Detects instances where an npm or node process spawns a shell, which in turn executes a command-line networking utility like curl or wget. This behavior is indicative of a malicious pre/post-install script used in supply chain attacks, such as the one seen with the 'ambar-src' package.
Detects outbound network traffic to a known Atomic macOS Stealer (AMOS) command and control (C2) server. This activity is associated with the exfiltration of stolen data, such as credentials, browser data, and system information, compressed into a ZIP archive.
Page 258 of 280