Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
868 detections
Filters
Last updated
All Time
Detection languages
863
4
1
Contributors
411
156
140
93
29
Categories
401
373
235
168
150
Platforms
773
171
98
28
24
Products / Services
846
413
94
47
26
MITRE Techniques
136
123
110
98
83
CVEs
9
5
5
4
4
IDS Classtypes
362
189
90
64
55
IDS Protocols
2,431
868
408
324
97
Detects established outbound network connections on TCP port 853 (DNS-over-TLS) to known C2 infrastructure associated with the RedTail malware. The rule monitors for both connection attempts to anomalous resolvers and specific TLS handshake patterns characteristic of RedTail C2 activity.
Detects established outbound network connections on TCP port 853 (DNS-over-TLS) to known C2 infrastructure associated with the RedTail malware. The rule monitors for both connection attempts to anomalous resolvers and specific TLS handshake patterns characteristic of RedTail C2 activity.
Detects sustained beaconing behavior originating from the internal network to known malicious HVNC (Hidden Virtual Network Computing) C2 infrastructure. The rule identifies repeated connection attempts (5 or more TCP SYNs within a 180-second window) targeting specific hardcoded IP addresses on non-standard ports (27015/27017), indicative of a compromised host maintaining persistent C2 communication.
Detects high-frequency TCP/445 connection attempts (a 'connect sweep') characteristic of automated SMB share enumeration, which is commonly used for lateral movement reconnaissance. The rule triggers when a threshold of 40 connection requests occurs from a single source within a 30-second window, specifically targeting SMB-related lateral movement behaviors.
Detects high-frequency SYN scanning activity targeting TCP port 37777 (commonly associated with Dahua devices) from an external source. This behavior is indicative of automated reconnaissance or mass-scanning campaigns, such as Operation CameraSwarm, attempting to identify exposed or potentially vulnerable IoT/surveillance hardware.
Detects outbound TCP traffic originating from the internal network destined for a known malicious IP associated with Meterpreter Java payload retrieval and post-exploitation Command and Control (C2) activity, potentially related to PaperCut vulnerability exploitation.
Detects outbound TCP traffic originating from the internal network destined for a known malicious IP associated with Meterpreter Java payload retrieval and post-exploitation Command and Control (C2) activity, potentially related to PaperCut vulnerability exploitation.
Detects the use of a specific magic string ('sxcdewqaz!@#') commonly associated with the Fire Ant implant to trigger or activate reverse-tunneling capabilities over TCP ports 443, 541, 8443, and 10443.
Detects sustained beaconing behavior originating from the internal network to known malicious HVNC (Hidden Virtual Network Computing) C2 infrastructure. The rule identifies repeated connection attempts (5 or more TCP SYNs within a 180-second window) targeting specific hardcoded IP addresses on non-standard ports (27015/27017), indicative of a compromised host maintaining persistent C2 communication.
Detects sustained beaconing behavior originating from the internal network to known malicious HVNC (Hidden Virtual Network Computing) C2 infrastructure. The rule identifies repeated connection attempts (5 or more TCP SYNs within a 180-second window) targeting specific hardcoded IP addresses on non-standard ports (27015/27017), indicative of a compromised host maintaining persistent C2 communication.
Detects the specific C2 handshake pattern associated with HVNC (Hidden Virtual Network Computing) remote access trojans. The rule monitors for a unique sequence of markers, specifically CLIENT_ID, COMPUTER, IDENTIFIER_CHANNEL, and a version string, indicating a malware-specific communication protocol.
Detects high-frequency TCP/445 connection attempts (a 'connect sweep') characteristic of automated SMB share enumeration, which is commonly used for lateral movement reconnaissance. The rule triggers when a threshold of 40 connection requests occurs from a single source within a 30-second window, specifically targeting SMB-related lateral movement behaviors.
Detects network activity (TCP, DNS, and HTTP) directed towards a known rogue infrastructure IP identified in a supply chain compromise affecting the Coder registry. The rule alerts on attempts to resolve or communicate with this infrastructure to download backdoored Terraform modules or interact with malicious resources.
Detects network activity (TCP, DNS, and HTTP) directed towards a known rogue infrastructure IP identified in a supply chain compromise affecting the Coder registry. The rule alerts on attempts to resolve or communicate with this infrastructure to download backdoored Terraform modules or interact with malicious resources.
Detects high-rate scanning and automated service probing patterns consistent with network reconnaissance. This includes tracking TCP SYN floods to external segments, excessive HTTP/login requests, and automated fingerprinting probes (e.g., favicon or admin panel enumeration). The rule accounts for common uptime monitoring services to minimize false positives.
Detects high-rate scanning and automated service probing patterns consistent with network reconnaissance. This includes tracking TCP SYN floods to external segments, excessive HTTP/login requests, and automated fingerprinting probes (e.g., favicon or admin panel enumeration). The rule accounts for common uptime monitoring services to minimize false positives.
This rule detects rapid SYN packet patterns from external sources targeting the Dahua proprietary port 37777, characteristic of network scanning tools like Masscan attempting to discover or identify vulnerable Dahua devices.
This rule detects a high volume of TCP synchronization (SYN) packets from external sources directed at a Cisco IOS XR network device. This behavioral pattern is indicative of a resource exhaustion denial-of-service (DoS) attack, potentially attempting to exploit vulnerabilities such as CVE-2026-20274 by flooding the control plane.
Detects established outbound network connections on TCP port 853 (DNS-over-TLS) to known C2 infrastructure associated with the RedTail malware. The rule monitors for both connection attempts to anomalous resolvers and specific TLS handshake patterns characteristic of RedTail C2 activity.
Detects the FTP STOR command uploading a file with a .pcap extension to an external host on port 21 or 20 — consolidated from three overlapping detections (generic server, router-specific, and capture-file variants). Indicates an adversary (e.g. Fire Ant/UNC3886) exfiltrating captured network traffic from a compromised network device via FTP.
This rule detects rapid, repetitive connection attempts (TCP SYN) from a source within the internal network to a set of high-value targets (SSH, HTTP, SMB, RDP ports) within the same internal network. Such patterns are indicative of lateral movement or internal network reconnaissance, often performed by adversaries pivoting through a compromised host to discover services on other internal systems.
Page 13 of 42