Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,875 detections
Filters
Last updated
All Time
Detection languages
2,950
1,378
313
289
239
Contributors
1,807
1,529
1,304
180
173
Categories
20,443
11,831
5,875
5,151
4,864
Platforms
3,743
1,857
1,076
782
160
Products / Services
2,237
1,434
1,273
746
582
MITRE Techniques
2,448
2,147
1,128
937
787
CVEs
19
15
9
7
5
IDS Classtypes
834
334
94
23
20
IDS Protocols
689
276
235
117
23
Detects network connections from a node.js process to a known C2 server address (87.236.177.9:3000) used by DPRK-linked threat actors.
This rule detects network connections to known cryptocurrency mining pools or domains associated with cryptocurrency mining activities. It specifically looks for keywords like 'miningpool', 'stratum', 'xmr', 'ethash', 'moneropool' in the remote URL or specific IP addresses like 'connect.moneropool.com' and 'pool.supportxmr.com'. This activity often indicates unauthorized resource hijacking (cryptojacking) on the affected device.
Detects processes, other than legitimate web browsers or the official Telegram client, making DNS queries for the Telegram Bot API. This behavior is indicative of malware using Telegram for command-and-control (C2) or data exfiltration, as seen in a campaign leveraging Amnesia RAT.
This rule detects common chromium browser processes establishing outbound network connections to known C2 domains associated with malicious 'ChatGPTStealer' infostealer extension. Detections by this rule indicates a high likelihood that a malicious chromium infostealer extension is currently or had been installed on an endpoint.
Detects large volumes of outbound data transfers using the Cyberduck application to known cloud storage providers. The Qilin ransomware group has been observed using Cyberduck for data exfiltration.
This rule detects outbound network connections initiated by 'chrome.exe' to a predefined list of known Command and Control (C2) domains over HTTPS (port 443). This indicates potential communication with malicious infrastructure.
This rule detects network connections initiated by 'tor.exe' or 'meek-client.exe', indicating potential use of the Tor anonymity network. It enriches the events with process and certificate information to provide context about the initiating process and its trust status.
This rule detects common chromium browser processes establishing outbound network connections to known C2 domains associated with malicious 'ChatGPTStealer' infostealer extension. Detections by this rule indicates a high likelihood that a malicious chromium infostealer extension is currently or had been installed on an endpoint.
Detects Microsoft Word making an outbound network connection and subsequently spawning the Equation Editor process (EQNEDT32.EXE). This behavior is associated with the exploitation of CVE-2017-11882 via a malicious remote template.
This query detects network communication to known Command and Control (C2) IP addresses used by the Medusa ransomware group, often via malicious SimpleHelp RMM servers.
This detection identifies outbound network traffic to domains, IP addresses, or a specific port known to be associated with the PHALT#BLYX campaign's infrastructure. The campaign uses these for malware delivery and DCRat command and control (C2). The rule specifically looks for connections to known malicious IPs or domains, or connections on port 3535 (used by DCRat) originating from processes associated with the malware (staxs.exe, tybd7.exe, aspnet_compiler.exe).
Detects outbound network traffic with a User-Agent header indicating the use of the Rust 'reqwest' HTTP client library. This User-Agent is used by the RustyWater implant, associated with the MuddyWater APT group, for command and control (C2) communications.
vvs-stealer
KQL
This rule detects activities associated with the VVS Stealer malware, as described in the Palo Alto Networks Unit 42 blog. It identifies the malware through specific SHA256 hashes of known VVS Stealer executables, network connections to hardcoded Discord webhook URLs used for exfiltration, persistence mechanisms via creation of executables in Windows startup folders, creation of '_vault.zip' files (likely containing stolen data), and suspicious Discord-related process activity indicative of the stealer's operation.
Detects network communication patterns
This rule detects network connections from devices to a predefined list of known malicious domains. It identifies attempts by internal systems to communicate with command and control servers, phishing sites, or other infrastructure associated with threat actors.
This rule detects outbound network connections to domains associated with the Tykit malware family or domains matching a specific regular expression pattern often used for credential harvesting (e.g., 'loginmicr.s*.cc'). It leverages an external intelligence feed for known Tykit domains and a regex for common phishing/credential theft patterns.
This rule detects potential command and control (C2) activity by identifying devices that first query 'api.ipify.org' (often used by malware to determine external IP addresses) and then subsequently establish an outbound network connection on port 7712 to a non-private IP address. This sequence of events can indicate a compromised host attempting to beacon out to a C2 server after initial reconnaissance.
Detects outbound network connections to a known PCPcat C2 server IP address on specific ports used for API communication, reverse tunneling, and payload distribution. This rule identifies potential command and control activity and data exfiltration attempts by monitoring network traffic to a hardcoded malicious IP and associated non-standard ports.
Detects when legitimate .NET utilities, often abused for process hollowing, make outbound network connections. This is anomalous behavior and may indicate that the process has been injected with malicious code to bypass defenses.
Detects outbound network connections to a list of IP addresses identified as high-confidence command and control (C2) infrastructure for the Clop ransomware group. This infrastructure has been observed across multiple campaigns, including the exploitation of vulnerabilities like CVE-2025-61882 (Oracle E-Business Suite), CVE-2023-34362 (MOVEit), and CVE-2023-0669 (GoAnywhere).
This rule detects PowerShell processes that are initiated by a LOLBAS binary and subsequently establish an outbound network connection to a public IP address. It leverages an external LOLBAS JSON data source to identify suspicious parent processes. This behavior could indicate an adversary using a Living Off The Land Binary or Script (LOLBAS) to execute PowerShell for malicious purposes, such as command and control or data exfiltration.
Page 262 of 280