Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,873 detections
Filters
Last updated
All Time
Detection languages
2,949
1,378
313
289
239
Contributors
1,807
1,529
1,304
180
173
Categories
20,439
11,829
5,873
5,151
4,864
Platforms
3,743
1,857
1,075
781
160
Products / Services
2,237
1,434
1,273
746
582
MITRE Techniques
2,448
2,145
1,128
937
787
CVEs
19
15
9
7
5
IDS Classtypes
834
334
94
23
20
IDS Protocols
689
276
235
117
23
Detects the execution of the 'curl' command on Linux systems. This typically indicates an attempt to download files from a remote location or make web requests to external servers. This activity can be associated with adversaries transferring tools or communicating with command and control infrastructure.
Detects non-standard tools initiating outbound connections over port 3389, which is commonly used for Remote Desktop Protocol (RDP). This activity can indicate possible lateral movement within a network. The rule filters out legitimate RDP clients and other known third-party tools to reduce false positives. An initial baseline of legitimate RDP tooling is required for effective use.
Detects Dllhost.EXE initiating an outbound network connection to a non-local IP address. Dllhost.exe is a legitimate Windows process that hosts DLL-based COM+ applications. While legitimate network communication from Dllhost.exe can occur, especially for applications it hosts, unexpected connections to external IP addresses (excluding known Microsoft ranges and local networks) can indicate malicious activity. Adversaries may abuse Dllhost.exe for proxy execution or to establish command and control.
This rule detects instances where the 'winlogon.exe' process initiates outbound network connections to public IP addresses. Winlogon.exe is a critical Windows component responsible for user logon/logoff and the secure attention sequence. Typically, winlogon.exe should not be making outbound network connections to public IPs. Such activity could indicate compromise, potentially by malware like BlackLotus, which has been observed to leverage winlogon.exe for malicious purposes, including command and control or data exfiltration.
Detects potential C2 communication related to Devil Bait malware by identifying specific URI patterns in GET requests. The rule looks for URIs containing '/cross.php?op=', '&dt=', and '&uid=' which are indicative of Devil Bait's communication with its command and control server.
Detects potential beaconing activity to known malicious domains associated with the 3CXDesktopApp supply chain compromise. This rule specifically looks for connections through a proxy to a list of hardcoded domains identified as indicators of compromise (IOCs) during the 3CXDesktopApp incident.
This rule detects outbound network connections from a Linux system to known Monero crypto mining pools. The detection is based on a predefined list of destination hostnames associated with various Monero mining operations. This activity is indicative of resource hijacking, where a system's computational resources are illicitly used for cryptocurrency mining.
This rule detects outbound network connections initiated by the `cmstp.exe` process. `cmstp.exe` is the Microsoft Connection Manager Profile Installer, and it is uncommon for this legitimate binary to initiate outbound network connections. Such activity could indicate an adversary is abusing `cmstp.exe` to proxy execution of malicious code, potentially for defense evasion or UAC bypass, by loading malicious INF files or scriptlets from remote servers.
This rule detects outbound network connections to destination ports 8080 or 8888 that are not within common local IP ranges or initiated by programs in standard system directories. This aims to identify potentially malicious command and control (C2) activity or data exfiltration using non-standard ports.
This rule detects outbound network connections initiated by the Windows Script Host interpreters, wscript.exe or cscript.exe, to non-local IP addresses. This behavior is often indicative of adversaries using scripts to download additional malicious payloads or establish command and control. The rule filters out connections to common private and loopback IP ranges to reduce false positives.
WebDav Put Request
Sigma
A General detection for WebDav user-agent being used to PUT files on a WebDav network share. This could be an indicator of exfiltration.
Detects suspicious shell commands or program code that may be executed or used in command line to establish a reverse shell
This YARA rule detects the TimeCrypt ransomware by identifying specific bytecode patterns related to file discovery, file encryption, and network communication activities, including HTTP and DNS requests. The rule looks for a combination of these patterns within executable files (MZ header).
Yara rule that detects Pay2Key ransomware.
Page 280 of 280