Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,875 detections
Filters
Last updated
All Time
Detection languages
2,950
1,378
313
289
239
Contributors
1,807
1,529
1,304
180
173
Categories
20,443
11,831
5,875
5,151
4,864
Platforms
3,743
1,857
1,076
782
160
Products / Services
2,237
1,434
1,273
746
582
MITRE Techniques
2,448
2,147
1,128
937
787
CVEs
19
15
9
7
5
IDS Classtypes
834
334
94
23
20
IDS Protocols
689
276
235
117
23
Detects Linux cron persistence, log tampering, outbound IRC ports, or compiler use from temp paths, matching SSHStalker botnet tradecraft.
Detects outbound SMTP connections from processes that are not typical mail clients, a technique used by malware like Agent Tesla to exfiltrate stolen data. This rule specifically looks for .NET utilities known to be abused in process hollowing attacks.
Detects LOLBin processes (mshta.exe, wscript.exe, cscript.exe) making outbound network connections to non-standard ports. This behavior is characteristic of the PeckBirdy framework's C2 communication.
Detects outbound network connections to known command-and-control (C2) and payload delivery infrastructure associated with the Rekoobe campaign. The rule specifically looks for connections to the IP address 154.84.63.184 or domains img.spoolsv.cc, img.spoolsv.net, spoolsv.cc, and spoolsv.net.
Detects network connections to the 10xprofit backend infrastructure. Connections to these domains indicate the presence of a malicious browser extension and potential exfiltration of scraped e-commerce data or tracking activity.
This rule detects a suspicious sequence of events: a file named 'host.exe' being created in the Windows Startup folder, a 'runtime.zip' file being created in the local temporary directory, and subsequent network communication to the Telegram API (api.telegram.org) from the same device. This pattern is indicative of malware establishing persistence, staging data, and exfiltrating it via Telegram, potentially associated with malware like Small Sieve.
This rule detects various indicators associated with the SSHStalker botnet on Linux systems, including outbound IRC-like network connections, modifications to cron files for persistence, log tampering (specifically utmp/wtmp/lastlog files), and the execution of compilers from suspicious directories like /tmp or /dev/shm. Each section of the rule targets a specific behavior of the botnet.
Detects periodic network traffic (beaconing) from browser processes to external domains, which may indicate automated data exfiltration by a malicious extension like the ChatGPT Stealer. This threat is known to exfiltrate data at approximately 30-minute intervals.
This rule detects outbound network connections from devices to IP addresses identified as malicious by a threat intelligence feed. It joins device network events with threat intelligence indicators, specifically looking for successful connections or connection requests to IPs with a confidence score greater than 50. The alert provides details about the device, the remote IP, the initiating process, and the threat intelligence context.
Detects legitimate Windows processes, known to be targeted by Dohdoor for process hollowing, making outbound network connections. This is highly indicative of the injected Dohdoor payload communicating with its C2 server.
This rule detects outbound network connections to known Command and Control (C2) and exfiltration domains associated with the SANDWORM_MODE campaign. These domains are used to exfiltrate stolen credentials and other sensitive data.
This rule detects attempts to download Android Application Package (APK) files directly to an endpoint. This activity is often associated with 'quishing' (QR code phishing) attacks, where users are tricked into scanning a malicious QR code that leads to a direct APK download, bypassing official app store security checks. The rule specifically looks for network connection success events where the remote URL or additional fields contain '.apk'.
Detects network connections to identified command and control (C2) infrastructure for both the original TrustConnect malware and its successor, DocConnect. This rule specifically looks for connections to known suspicious domains and IP addresses associated with these malware families.
Detects outbound HTTPS traffic to specific URI paths and User-Agent strings hardcoded in MIMICRAT's malleable C2 profiles. These profiles impersonate legitimate web analytics traffic.
Detects network requests to specific URI endpoints associated with the DOMOAuth2_ and IRAOAuth2.0 malicious NuGet packages. These packages exfiltrate ASP.NET Identity data to a local C2 proxy. The rule specifically looks for traffic to these URIs on localhost via port 7152.
This rule detects outbound network connections from devices to a known Moonrise C2 IP address (193.23.199.88). It specifically looks for successful connections, inbound connections accepted, or connection attempts to this malicious IP.
This detection identifies network connections from non-browser processes to known Large Language Model (LLM) API endpoints. While some connections may be legitimate developer or application traffic, unexpected processes connecting to these services could indicate unauthorized data exfiltration, corporate espionage, or misuse of AI services.
Detects network traffic to a local proxy on port 7152, a behavior associated with a malicious NuGet package campaign involving NCryptYo, DOMOAuth2_, IRAOAuth2.0, and SimpleWriter_. This traffic is characterized by communication to a loopback address (127.0.0.1 or ::1) or 'localhost' on the suspicious port, specifically targeting '/api/auth/' endpoints.
Detects PowerShell one-liners used by TrustConnect/DocConnect to download and execute secondary payloads. These commands are provided as a 'Quick Deploy' feature in the MaaS C2 panel and typically use Invoke-RestMethod (irm) piped to Invoke-Expression (iex) from known malicious domains.
This rule detects outbound network connections from Ivanti EPMM appliances to known Out-of-Band (OOB) interaction services and tunneling platforms. This activity is often associated with automated reconnaissance and exploitation verification for vulnerabilities like CVE-2026-1281.
Detects outbound network connections to known Command and Control (C2) domains and IPs associated with the TrustConnect and DocConnect malware infrastructure.
Page 259 of 280