Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
868 detections
Filters
Last updated
All Time
Detection languages
863
4
1
Contributors
411
156
140
93
29
Categories
401
373
235
168
150
Platforms
773
171
98
28
24
Products / Services
846
413
94
47
26
MITRE Techniques
136
123
110
98
83
CVEs
9
5
5
4
4
IDS Classtypes
362
189
90
64
55
IDS Protocols
2,431
868
408
324
97
Detects outbound SMTP traffic associated withAVERAT malware, tracking the EHLO sequence, STARTTLS command negotiation, server acceptance, and subsequent custom TLS ClientHello patterns on port 25.
Detects outbound SMTP traffic associated withAVERAT malware, tracking the EHLO sequence, STARTTLS command negotiation, server acceptance, and subsequent custom TLS ClientHello patterns on port 25.
Detects outbound SMTP traffic associated withAVERAT malware, tracking the EHLO sequence, STARTTLS command negotiation, server acceptance, and subsequent custom TLS ClientHello patterns on port 25.
Detects outbound network traffic matching XMRig Monero cryptocurrency miner stratum login behavior originating from an internal host.
Detects the handshake process for Blackwood/Chisel reverse SOCKS5 or TCP-over-HTTP tunneling to a known malicious Iranian-hosted C2 IP address. The detection matches specific HTTP headers used by the Chisel tool during its initialization phase.
Detects outbound network traffic matching XMRig Monero cryptocurrency miner stratum login behavior originating from an internal host.
Detects outbound network traffic matching XMRig Monero cryptocurrency miner stratum login behavior originating from an internal host.
Detects outbound network traffic matching XMRig Monero cryptocurrency miner stratum login behavior originating from an internal host.
Detects the handshake process for Blackwood/Chisel reverse SOCKS5 or TCP-over-HTTP tunneling to a known malicious Iranian-hosted C2 IP address. The detection matches specific HTTP headers used by the Chisel tool during its initialization phase.
Detects outbound network traffic associated with the Azazel operation, including connections to identified C2 infrastructure, open directory/upload listeners, domain-specific staging servers, and exfiltration attempts to MEGA cloud storage endpoints.
Detects a network connection handshake indicating the use of Chisel, a fast TCP/UDP tunnel over HTTP, specifically identifying potential command-and-control beaconing activity.
Detects a network connection handshake indicating the use of Chisel, a fast TCP/UDP tunnel over HTTP, specifically identifying potential command-and-control beaconing activity.
Detects a network connection handshake indicating the use of Chisel, a fast TCP/UDP tunnel over HTTP, specifically identifying potential command-and-control beaconing activity.
Detects anomalous, high-frequency outbound connection attempts from a NetScaler appliance to internal network hosts. This pattern is indicative of potential post-exploitation lateral movement or internal network scanning by the SLAPSHOT malware (associated with CVE-2026-88772), as an appliance typically should not engage in rapid internal fan-out behavior.
Detects outbound SMTP traffic associated withAVERAT malware, tracking the EHLO sequence, STARTTLS command negotiation, server acceptance, and subsequent custom TLS ClientHello patterns on port 25.
Detects outbound network traffic associated with the Azazel operation, including connections to identified C2 infrastructure, open directory/upload listeners, domain-specific staging servers, and exfiltration attempts to MEGA cloud storage endpoints.
This rule detects anomalous outbound SMTP (port 25) traffic originating from a NetScaler ADC or Gateway appliance. Since these appliances have no legitimate business requirement to initiate outbound SMTP communication, such traffic is a strong indicator of post-compromise activity, potentially used for command and control or data exfiltration.
Detects outbound network traffic associated with the Azazel operation, including connections to identified C2 infrastructure, open directory/upload listeners, domain-specific staging servers, and exfiltration attempts to MEGA cloud storage endpoints.
Detects outbound TCP traffic on port 443 destined for a hardcoded IP address associated with ValleyRAT C2 activity. The rule specifically monitors for established connections with a small payload size (5 bytes) that lack standard TLS handshake characteristics (no SNI), and applies a threshold to mitigate noise. This behavior is indicative of C2 heartbeats from malicious implants using DLL side-loading techniques.
This rule monitors for a rapid sequence of TCP SYN packets directed towards common administrative ports (SSH/22, RDP/3389, SMB/445) within a short window, indicative of an automated lateral movement scanning attempt or a brute-force discovery phase originating from within the internal network.
Detects the handshake process for Blackwood/Chisel reverse SOCKS5 or TCP-over-HTTP tunneling to a known malicious Iranian-hosted C2 IP address. The detection matches specific HTTP headers used by the Chisel tool during its initialization phase.
Page 1 of 42