Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
868 detections
Filters
Last updated
All Time
Detection languages
863
4
1
Contributors
411
156
140
93
29
Categories
401
373
235
168
150
Platforms
773
171
98
28
24
Products / Services
846
413
94
47
26
MITRE Techniques
136
123
110
98
83
CVEs
9
5
5
4
4
IDS Classtypes
362
189
90
64
55
IDS Protocols
2,431
868
408
324
97
Detects outbound TCP traffic originating from internal hosts to known command and control infrastructure associated with the SilkParasite campaign and the SpiceRAT malware family.
This rule detects a specific network exploit attempt targeting Dahua devices (CVE-2021-33045), where an attacker attempts to bypass authentication by manipulating the login parameters, specifically by forcing the system to interpret requests as coming from the local loopback interface.
Detects high-concurrency brute-force attempts against Dahua Easy4IP-enabled devices targeting port 37777, identified by specific binary patterns (opcode 0xA0) in the packet payload. This indicates an automated attempt to compromise device authentication.
Detects rapid TCP connection attempts to port 445 (SMB) from a single source IP address, indicative of network scanning or reconnaissance activities typically used by the DragonForce ransomware or similar automated threats for lateral movement.
Detects outbound network traffic from internal hosts directed toward identified Exvicy command-and-control (C2) infrastructure IP addresses. This includes both general beaconing attempts and established TLS handshake sessions potentially linked to post-ClickFix malicious activity.
This rule detects a raw TCP authentication handshake associated with the VelvetCake malware family. It specifically monitors for established connections to a known malicious C2 IP address (111.92.246.145) over port 12345 containing the specific hardcoded 'PASSWORD' string used for initial communication.
Detects PIVOTPIPE malware beaconing activity indicative of peer-to-peer (P2P) lateral movement between internal hosts. The rule monitors for sustained established TCP traffic with specific small packet size characteristics, suggesting command-and-control heartbeats or tunneled traffic within the internal network.
Detects outbound network traffic from internal hosts to known PIVOTPIPE-associated infrastructure, including attempts to access open directories for payload distribution and suspected Cobalt Strike command-and-control communications.
Detects network traffic consistent with PIVOTPIPE command-and-control activity and potential Cobalt Strike beaconing to known malicious infrastructure on specific ports.
Detects network traffic associated with PIVOTPIPE Cobalt Strike beacon activity communicating with a known suspicious external IP address on port 8088. This includes generic TCP, HTTP-based beaconing, and TLS-encrypted C2 sessions.
Detects specific command-and-control (C2) communication patterns associated with the VelvetCake malware. The rules identify initial authentication with a hardcoded password string, module enumeration requests, and session termination signals transmitted over TCP.
Detection of network traffic associated with VelvetCake (Konni) malware, identifying communication with known hardcoded C2 infrastructure, domain lookups, and exfiltration attempts via HTTP/TLS and raw TCP protocols.
Detection of network traffic associated with VelvetCake (Konni) malware, identifying communication with known hardcoded C2 infrastructure, domain lookups, and exfiltration attempts via HTTP/TLS and raw TCP protocols.
Detects network activity (TCP, DNS, TLS, HTTP) associated with the UNC6240 threat actor's infrastructure, specifically targeting communications with known malicious IP addresses and domains used in a campaign leveraging PeopleSoft-related lures.
Detects network activity (TCP, DNS, TLS, HTTP) associated with the UNC6240 threat actor's infrastructure, specifically targeting communications with known malicious IP addresses and domains used in a campaign leveraging PeopleSoft-related lures.
Detects established, bidirectional TCP connections between internal hosts and known infrastructure associated with the SIDEEYE backdoor on specific control and data ports (3333 and 3334).
Detects established, bidirectional TCP connections between internal hosts and known infrastructure associated with the SIDEEYE backdoor on specific control and data ports (3333 and 3334).
This rule detects network traffic patterns indicative of a reverse shell established by DSCourier, a tool or script that leverages the ConfigurationRemotingServer interface to facilitate interactive command execution on a remote host.
Detects specific FTP commands (STOR, RETR, TYPE I) and passive mode responses directed to or originating from identified malicious IP addresses associated with the LucidRook threat actor. This rule monitors for potential file exfiltration, payload retrieval, and command-and-control communication over the FTP protocol.
Detects outbound TCP traffic originating from internal hosts to known command and control infrastructure associated with the SilkParasite campaign and the SpiceRAT malware family.
Detects repeated authentication login attempts (opcode 0xA0) against Dahua Easy4IP devices over TCP port 37777, indicative of a brute-force or credential stuffing attack.
Page 5 of 42