Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,875 detections
Filters
Last updated
All Time
Detection languages
2,950
1,378
313
289
239
Contributors
1,807
1,529
1,304
180
173
Categories
20,443
11,831
5,875
5,151
4,864
Platforms
3,743
1,857
1,076
782
160
Products / Services
2,237
1,434
1,273
746
582
MITRE Techniques
2,448
2,147
1,128
937
787
CVEs
19
15
9
7
5
IDS Classtypes
834
334
94
23
20
IDS Protocols
689
276
235
117
23
This rule detects outbound SSH (Secure Shell) connections initiated by common SSH client executables (ssh.exe, ssh, plink.exe, dbclient.exe) to external IP addresses. It explicitly excludes connections to common private IP address ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) and the loopback address (127.0.0.0/8) to reduce false positives from internal network activity.
Detects potential reverse shell activity originating from a Grandstream VoIP device. This is a high-fidelity indicator of compromise following the successful exploitation of CVE-2026-2329. This version uses DeviceNetworkEvents.
This rule detects suspicious Python command-line executions that attempt to import the 'requests' library, use 'exec()', and make HTTP/HTTPS requests. This pattern is commonly observed in malicious Python scripts used for command and control, data exfiltration, or downloading additional payloads.
This rule detects outbound network connections to known command and control (C2) infrastructure. Specifically, it looks for connections to suspicious URLs (meeting.bulletmailer.net, clawdbot.getintwopc.site, darkgptprivate.com, getintwopc.site) or specific IP addresses (179.43.176.32, 178.16.54.253), or connections on a specific port (8041) which has been associated with ScreenConnect C2. The rule also attempts to identify the specific threat indicator based on the matched URL, IP, or port.
Detects outbound network traffic to known infrastructure used in OpenClaw malicious skill delivery or credential exfiltration. These IOCs were identified in the NSFOCUS report on OpenClaw security risks.
Detects Notepad.exe initiating outbound network connections, specifically over SMB (port 445) or to public IP addresses over HTTP/S. This behavior is highly anomalous and can indicate an attempt to exploit CVE-2026-20841 to trigger an NTLM relay attack for credential harvesting or to download a remote payload.
Detects a specific two-step HTTP pattern characteristic of OysterLoader's initial C2 communication. The malware first sends a registration request containing a 'WordPressAgent' User-Agent string, followed by a login request with a 'FingerPrint' User-Agent string to the same destination. This version checks for the User-Agent strings in the 'AdditionalFields' column.
Identifies Node.js or Python processes attempting to download configuration-like files (e.g., .env, .env.example) from GitHub's raw content domain. This pattern is characteristic of the second-stage payload delivery in the Lazarus Group's Graphalgo campaign.
This query identifies outbound network connections made by the notepad++.exe process. This is useful for hunting for suspicious activity, such as connections to malicious update servers or C2 channels, by baselining normal update and plugin activity.
Detects the legitimate Windows utility 'attrib.exe' initiating outbound network connections to common SMTP ports. This behavior is highly anomalous as attrib.exe is used to modify file attributes and should not be making network connections. The Mispadu banking trojan is known to inject its code into attrib.exe and use it to self-propagate by sending phishing emails.
Detects the Notepad++ updater process (gup.exe) making network connections to domains other than the official Notepad++ or GitHub domains. This could indicate a compromised update process or a supply chain attack where the updater is redirected to a malicious download location.
This rule detects network connections to domains and IP addresses associated with the malicious OpenClawCLI campaign, which uses social engineering to trick users into running obfuscated commands.
This rule detects network connections or DNS queries to a predefined list of malicious domains. These domains are likely associated with typosquatting or other malicious infrastructure used by adversaries.
This rule detects suspicious outbound network connections to Cloudflare Workers domains, indicative of potential command and control (C2) activity. It identifies connections to known malicious Cloudflare Workers domains or IPs, as well as generic Cloudflare Workers domains (.workers.dev) when initiated by suspicious processes like `WsusService.exe`, `curl.exe`, `certutil.exe`, `bitsadmin.exe`, `Velociraptor.exe`, or `msiexec.exe`. The rule prioritizes detection based on specific indicators like known malicious workers or C2 IPs, and flags activity from processes commonly abused for C2 or payload delivery. It also provides severity scoring and investigation steps based on the identified threat type.
Detects a behavioral pattern associated with CastleLoader's anti-analysis technique, where a process initiates a DNS query that fails (NXDOMAIN) and is immediately followed by a successful network connection to a different destination. This can indicate an attempt to check for sandboxing or sinkholing environments.
Detects browser processes making direct network connections to known Large Language Model (LLM) API endpoints. This activity is unusual when originating from general user web browsing, as it may indicate a malicious website is using an LLM to dynamically generate and fetch malicious code (e.g., JavaScript for a phishing page) at runtime.
This rule detects Office applications (Word, Excel, PowerPoint) or Windows Explorer making outbound WebDAV connections to external, non-private IP addresses on standard web ports (80, 443). This behavior is associated with exploitation of vulnerabilities like CVE-2026-21509, potentially by threat actors such as APT28, to force authentication or exfiltrate data.
Detects when a Network Attached Storage (NAS) or Internet of Things (IoT) device establishes multiple or high-volume outbound SSH/SFTP connections to an external IP address. This behavior can indicate that the device has been compromised and is being used as an 'Operational Relay Box' (ORB) to proxy malicious traffic, mask C2 communications, or exfiltrate data.
Detects network traffic on TCP port 18789, the default gateway port for OpenClaw. Monitoring for unauthorized external access to this port helps identify exposed admin dashboards or exploitation.
Detects network connections to domains and IPs associated with the Notepad++ supply chain attack. These indicators are linked to the distribution of Cobalt Strike and the Chrysalis backdoor.
The query, as constructed, is primarily focused on detecting large outbound traffic volumes to external destinations on a per source-destination pair basis within daily aggregations. Adjust the threshold and aggregation criteria based on your specific security requirements and typical network behavior patterns.
Page 260 of 280