Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,875 detections
Filters
Last updated
All Time
Detection languages
2,950
1,378
313
289
239
Contributors
1,807
1,529
1,304
180
173
Categories
20,443
11,831
5,875
5,151
4,864
Platforms
3,743
1,857
1,076
782
160
Products / Services
2,237
1,434
1,273
746
582
MITRE Techniques
2,448
2,147
1,128
937
787
CVEs
19
15
9
7
5
IDS Classtypes
834
334
94
23
20
IDS Protocols
689
276
235
117
23
ET INFO DYNAMIC_DNS HTTP Request to a *.freeddns .tokyo domain
Detects suspicious command sequence that JexBoss
ET MALWARE TA569 Gholoader CnC Domain in TLS SNI (plesk .breeconsulting .net)
ET INFO Observed Commonly Actor Abused Cloud Hosting Service Domain (vercel .app in TLS SNI)
ET INFO Blockchain RPC Domain in TLS SNI (arbitrum .one)
ET INFO DYNAMIC_DNS HTTP Request to a *.anchorchain .co .za domain
ET ATTACK_RESPONSE Nishang Invoke-PowerShellTcp Shell Prompt Outbound
ET EXPLOIT_KIT LandUpdate808 Domain (dolmain .com) in TLS SNI
ET EXPLOIT_KIT LandUpdate808 Domain (forrbes .com) in TLS SNI
This rule detects HTTP traffic where the User-Agent string contains the case-insensitive substring 'iot'. This is often indicative of compromised IoT devices or botnet activity attempting to blend in or identify themselves.
ET MALWARE Observed Malicious Domain (tamku .shoplerter .opnetorologies .net in TLS SNI)
ET MALWARE Observed Malicious Domain (tamku .shop in TLS SNI)
ET INFO Blockchain RPC Domain in TLS SNI (polygon-rpc .com)
Detects network connections to blockchain APIs that are indicative of EtherHiding techniques, specifically those used by UNC5342 to retrieve malicious payloads. It identifies connections to domains containing keywords like 'explorer', 'block', 'cypher', 'eth', 'bit', 'coin', or 'crypto', combined with suspicious URL patterns such as 'eth_call' (a read-only function call for smart contracts) or 'apiKey=freekey' (a common free API key used by threat actors).
Detects outbound network connections to the OpenAI API from unusual processes, a TTP used by the SesameOp backdoor for command and control (C2).
Detects processes with names used by Qilin malware (`hosts.exe`, `dato.exe`) that are launched without a visible window and subsequently make an outbound network connection. This pattern is indicative of a hidden C2 beacon, a technique used by Qilin to evade user detection.
This detection identifies network connections to external DNS servers over TCP (port 53) initiated by common scripting engines like PowerShell, Python, or WScript. While DNS over TCP is a valid protocol, it is less common for standard queries and is often used by malware for command and control (C2) or data exfiltration through DNS tunneling.
Detects a program that invoked suspicious DNS queries known from Cobalt Strike beacons
This rule detects potential command and control (C2) activity by identifying devices that first query 'api.ipify.org' (often used by malware to determine external IP addresses) and then subsequently establish an outbound network connection to a non-private IP address on port 7712. This sequence of events can indicate a compromised host attempting to beacon out to a C2 server after initial reconnaissance.
This rule detects uncommon outbound network connections on TCP port 88, which is the default port for Kerberos. Such activity, especially from processes other than expected system services like LSASS or common applications like web browsers and Tomcat, can indicate potential lateral movement or initial privilege escalation attempts through Kerberos delegation. Attackers often leverage Kerberos for authentication in Windows environments to move between systems or elevate privileges, for example, using tools like Rubeus for Kerberoasting or other Kerberos-based attacks.
Detects potential remote code execution associated with the exploitation of Oracle E-Business Suite vulnerability CVE-2025-61882 on Windows hosts. The rule looks for a Java process spawning a command shell to execute reconnaissance commands, followed by an outbound network connection from the same Java process within a short time frame. This behavior is consistent with post-exploitation activity observed in the campaign.
Page 265 of 280