Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
667 detections
Filters
Last updated
All Time
Detection languages
304
127
82
42
35
Contributors
151
83
80
37
31
Categories
442
354
165
142
112
Platforms
398
212
86
70
20
Products / Services
184
122
103
93
65
MITRE Techniques
18,116
15,638
12,585
8,395
6,225
CVEs
5
3
3
1
1
IDS Classtypes
74
35
7
6
3
IDS Protocols
71
22
17
7
2
This rule detects the presence of hardcoded tokens associated with the dYdX supply chain attack. These tokens were used for C2 authentication and as an API key for data exfiltration. The rule searches across process command lines, network URLs, network headers, and common security logs for these specific tokens.
This rule detects network connections to malicious infrastructure associated with a supply chain attack targeting dYdX npm and PyPI packages. The infrastructure is used for credential exfiltration and as a C2 for a RAT.
This rule set detects various stages of the OysterLoader malware activity, including its registration and login attempts to a command and control (C2) server, specific C2 communication patterns via HTTP URIs, and connections to known OysterLoader C2 domains and IP addresses. The rules look for specific HTTP URI paths like "/reg" and "/login" combined with distinct User-Agent strings ("WordPressAgent" and "FingerPrint"), as well as specific API paths under "/api/" and hardcoded C2 domains and IP addresses.
This rule detects suspicious activity related to a malicious Notepad++ updater, specifically looking for command strings that indicate data exfiltration to 'temp.sh' using 'curl.exe'. It identifies the presence of 'temp.sh/upload', '--user-agent', 'temp.sh/', '/list', and 'curl.exe' within the analyzed content, suggesting an attempt to upload data or list contents to a temporary sharing service.
This rule set looks for signs linked to the Shadow Campaigns espionage group. It flags the use of their loader, checks for connections to known servers they have used, spots fake security software used as bait, and highlights suspicious activity coming from web server processes that may indicate a hidden backdoor.
This YARA rule detects the Arkanix Stealer by identifying specific strings found within its code or related artifacts. It looks for a combination of unique user agent strings, domain names associated with its command and control infrastructure, API endpoints used for session creation or data exfiltration, a secret key, and a staging identifier. The rule requires at least one domain, one endpoint, and one of the distinctive user agent, key, or staging hints to trigger, aiming to reduce false positives by combining multiple indicators.
This rule detects OysterLoader C2 communication based on specific HTTP User-Agent strings and URI paths. It looks for 'WordPressAgent' or 'FingerPrint' in the User-Agent field combined with URIs like '/reg', '/login', '/api/kcehc', '/api/v2/init', '/api/v2/facade', or '/api/jgfnsfnuefcnegfnehjbfncejfh'. This activity is indicative of OysterLoader's multi-stage evasion techniques as described in a Sekoia report.
Detects a sequence of events associated with a malicious Notepad++ update. This malicious process executes reconnaissance commands.
Detects the execution of 'finger.exe' or 'ct.exe' with command-line arguments indicating an attempt to start 'cmd.exe', correlated with network connections to a known malicious IP address (69.67.173.30). This behavior is indicative of LOLBIN (Living Off the Land Binaries and Scripts) abuse for command and control communication.
Detects an unusual exfiltration technique where a URL, typically from temp.sh, is embedded within the User-Agent string of an HTTP request. This TTP was observed in the Notepad++ supply chain attack in 2025 for exfiltrating system information.
Detects a specific data exfiltration pattern observed in the Notepad++ supply chain attack. An attacker uses curl.exe to upload a file containing reconnaissance data to the temp.sh file sharing service. Subsequently, a beacon is sent to the C2 where the User-Agent string of the HTTP request contains the temp.sh URL for the exfiltrated data.
Detects a sequence of system reconnaissance commands followed by data exfiltration to temp.sh, a TTP used in the Notepad++ supply chain attack.
This rule detects network connections and DNS resolutions to a predefined list of known malicious IP addresses and domains. It also identifies HTTP requests containing specific URL paths ('update/update.exe', '/users/admin', '/api/') when made to these malicious IPs. This behavior is indicative of potential command and control (C2) communication or malware attempting to download updates or exfiltrate data.
Active Directory serves as the central repository for an organization's authentication infrastructure. Malicious actors frequently focus on obtaining the NTDS.dit database file, which holds encrypted password data and essential domain configuration. Successful acquisition of this file can lead to complete organizational compromise.
The rule detects large file transfers where the MIME type is declared as 'text/plain' but the file size exceeds 1,000,000 bytes. It specifically looks for files originating locally and excludes transfers to internal IP addresses. This behavior is often used by C2 frameworks to disguise binary payloads or exfiltrated data as harmless text to evade proxy inspection.
This query utilizes the IOCs provided by Rapid7 and focuses on columns in the DeviceFileEvents, DeviceProcessEvents and DeviceNetworkEvents tables. This is a high FP query, however each event will require an investigation to its legitimacy. The query accounts for all devices that have installed notepad++ in the past 400d and only looking for IOCs within time of known compromise in order to save on resources. Some IOCs are commented out due to high FP rate.
Detects HTTP requests where the User-Agent string contains a full URL pointing to 'temp.sh'. This technique was observed in the Notepad++ supply chain attack where attackers passed the URL of exfiltrated data back to their C2 server within the User-Agent header.
Detects the use of curl.exe where the User-Agent header is abused to pass a URL. This is a specific technique observed in the Notepad++ supply chain attack where attackers used it to exfiltrate reconnaissance data by sending a temp.sh URL to their C2 server.
The malware used the legitimate curl.exe to upload data to temp[.]sh. This is a high-fidelity indicator as legitimate business processes rarely upload data to ephemeral pastebins via command line.
ClawdBot C2 Network Communication
Cortex XDR
Detects network connections to known malicious ClawdBot command and control (C2) infrastructure based on specific IP addresses and hostnames.
This query hunts for the specific "reconnaissance batch" behavior observed in this campaign: a process piping netstat, systeminfo, or tasklist output into a text file (specifically a.txt as seen in the report, though looking for any single-letter text file is a good heuristic).
Page 24 of 32