Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
868 detections
Filters
Last updated
All Time
Detection languages
863
4
1
Contributors
411
156
140
93
29
Categories
401
373
235
168
150
Platforms
773
171
98
28
24
Products / Services
846
413
94
47
26
MITRE Techniques
136
123
110
98
83
CVEs
9
5
5
4
4
IDS Classtypes
362
189
90
64
55
IDS Protocols
2,431
868
408
324
97
Detects high-volume SSH authentication attempts originating from a single source IP targeting a server on port 22, indicating a potential brute force attack.
Detects outbound network traffic matching Stratum protocol JSON-RPC methods (mining.subscribe, mining.authorize, mining.submit) typically used by XMRig and other cryptomining software to communicate with a mining pool. The rule monitors for established TCP connections on non-standard ports, excluding common web ports 80 and 443.
Detects outbound connections to a known malicious C2 infrastructure associated with the CARBONATO threat actor. The rule identifies both established SSH sessions using the OpenSSH implementation and the initiation of outbound TCP connections on ports dynamically determined by an MD5 hash, which is a known behavior of this actor's C2 communication strategy.
Detects established, bidirectional TCP connections between internal hosts and known infrastructure associated with the SIDEEYE backdoor on specific control and data ports (3333 and 3334).
Detects network communication associated with VelvetCake C2 infrastructure, including plaintext authentication, specific inventory request commands, and session termination commands over port 12345.
Detects the initiation of a SOCKS5 proxy handshake from an internal host to an external destination. The rule monitors for the characteristic SOCKS5 greeting (0x05) while specifically excluding HTTP traffic to identify potential unauthorized proxy tunneling used for command and control or data exfiltration.
This rule monitors for outbound TCP and HTTP traffic to a known malicious infrastructure hosting a fake or compromised 'Corp MDM' (Mobile Device Management) admin panel, which serves as a Command and Control (C2) channel for spyware.
This rule detects potential attempts to exploit an SSH pre-authentication rekey or authentication bypass vulnerability (CVE-2026-67279) in MikroTik RouterOS devices. It monitors incoming TCP traffic on port 22 that contains the 'ROSSSH' signature followed by specific binary sequences indicative of exploitation attempts.
Detects network traffic consistent with a hardcoded C2 channel used by PolinRider or NullReceiver malware families. The rule monitors TCP traffic directed to a specific IP address (193.26.115.131) and port (15152) that contains serialized command/status structures formatted with specific JSON-like content patterns.
Detects network communication associated with the Cyclops Blink modular malware, specifically targeting known Sandworm C2 IP addresses and non-standard ports used for firewall rule manipulation and C2 beaconing. The rule identifies both inbound and outbound traffic, including potential TLS handshakes on specific non-standard ports.
This rule detects network traffic containing the specific 'Xwormmm' string in the payload, which serves as a handshake or banner characteristic of XWorm command-and-control (C2) communications.
This rule detects unauthorized or unauthenticated attempts to call the NetrServerPasswordSet2 method on a Domain Controller via the MS-NRPC (Netlogon) interface, which is indicative of an exploitation attempt related to CVE-2020-1472 (Zerologon). This vulnerability allows an attacker to bypass authentication and reset a Domain Controller's computer account password, leading to full domain compromise.
Detects outbound TCP traffic originating from internal network hosts to a known hardcoded AsyncRAT C2 IP address (158.51.122.136). This indicates a successful infection where a host has established communication with the C2 infrastructure.
Detects repeated, small outbound HTTP/HTTPS requests to an external destination, a behavior characteristic of scripted command-and-control (C2) beaconing where a client periodically polls a server for instructions.
Detects high-frequency TCP SYN scanning activity originating from external networks targeting port 37777, commonly associated with the Dahua DVR P2P discovery service. This behavior is indicative of automated reconnaissance and scanning campaigns searching for vulnerable IoT devices.
Detects network traffic attempting to exploit CVE-2021-33044, an authentication bypass vulnerability in Dahua NetKeyboard devices, by identifying specific login request strings used in the exploit chain.
This rule monitors for outbound TCP and HTTP traffic to a known malicious infrastructure hosting a fake or compromised 'Corp MDM' (Mobile Device Management) admin panel, which serves as a Command and Control (C2) channel for spyware.
Detects anomalous MS-DRSR DRSGetNCChanges requests occurring between hosts where the requester is not a recognized Domain Controller. This pattern is commonly used by attackers to perform a DCSync attack, allowing for the replication of sensitive Active Directory data such as user password hashes.
Detects network traffic attempting to exploit the Dahua CVE-2021-33044 vulnerability, which allows an unauthenticated user to bypass authentication mechanisms on affected NetKeyboard devices.
Detects outbound TCP traffic originating from the internal network destined for a known malicious IP associated with Meterpreter Java payload retrieval and post-exploitation Command and Control (C2) activity, potentially related to PaperCut vulnerability exploitation.
Detects network activity (TCP, DNS, TLS, HTTP) associated with the UNC6240 threat actor's infrastructure, specifically targeting communications with known malicious IP addresses and domains used in a campaign leveraging PeopleSoft-related lures.
Page 3 of 42