Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,252 detections
Filters
Last updated
All Time
Detection languages
695
140
94
67
56
Contributors
394
247
199
52
45
Categories
787
416
267
248
193
Platforms
841
270
264
174
66
Products / Services
498
157
148
133
115
MITRE Techniques
18,116
15,638
12,585
8,395
6,225
1,252
CVEs
4
3
2
2
2
IDS Classtypes
70
58
3
3
2
IDS Protocols
66
23
15
12
9
Detects outbound HTTP POST requests to the Polygon blockchain using the 'eth_call' JSON-RPC method, specifically targeting a known smart contract address associated with EtherHiding-style C2 infrastructure. This behavior indicates an adversary utilizing decentralized blockchain storage or services as an unconventional command-and-control channel to resolve malicious configurations or payloads.
Detects network traffic associated with NGate Android malware communicating with its Command and Control (C2) server. The rule monitors for specific HTTP POST patterns, including an 'okhttp' user-agent and binary body content characteristic of NFC relay relay attempts used for fraudulent payment activities.
Detects instances where critical system processes (such as svchost.exe, lsass.exe, or w3wp.exe) spawn known command-line interpreters or script execution utilities (e.g., cmd.exe, powershell.exe, certutil.exe) which then initiate outbound network connections to common ports (445, 3389, 135, 5985, 5986, 1433, 80, 443) that are external to the local network. This behavior is often associated with lateral movement, command and control (C2) communication, or reconnaissance.
This rule monitors for known malicious file hashes, IP addresses, C2 domains, and specific URL markers associated with identified threat activity. It consolidates multiple detection vectors including file activity, process execution, network connections, and DNS queries to identify compromised devices communicating with attacker-controlled infrastructure.
Comprehensive IOC sweep across endpoint file/process/network telemetry for the full set of known SilkParasite/SpiceRAT/NodeEdgeRAT/NomadRAT/BloodAlchemy infrastructure indicators reported by Hunt.io and Security Affairs: all listed C2/decoy/certificate-hosting IPs, all listed spoofed/infrastructure domains, and known file/certificate hashes (SHA256, SHA1).
Detects outbound network connections from devices to specific suspicious domains identified in the detection logic. This rule monitors for connections to 'ns2.asiainfo.it.com' and 'www.wordcheck.info', which may be indicative of malware communication, command and control, or malicious web activity.
Detects command-and-control (C2) communication patterns associated with the Graphalgo framework, which utilizes the Arbitrum Sepolia blockchain for dead-drop resolution and task orchestration. The rules monitor for specific JSON-RPC method calls ('eth_call', 'setCPubKey') and repeated polling of contract functions ('serviceData') characteristic of this threat actor's network behavior.
Detects anomalous activity associated with AI and LLM service providers by identifying accounts that are either interacting with these services for the first time or exhibiting a significant spike in API call volume compared to their 14-day historical baseline. This pattern may indicate unauthorized use of enterprise AI resources, potential persistence mechanisms, or exfiltration activities abusing legitimate LLM orchestration APIs.
This rule monitors for outbound network connections to a list of known malicious IP addresses identified as part of the GhostCode command-and-control (C2) infrastructure. It uses DeviceNetworkEvents data to flag activity originating from endpoints and highlights a specific IP address used during the Intune/MDM enrollment process for further investigation.
Detects instances where AI-assisted development tools (such as Claude, Codex, Copilot, or Gemini) initiate command-line processes (e.g., shells, interpreters, or network utilities) with arguments indicative of credential access, reconnaissance, or sensitive file interactions.
This rule detects network connections to domains and IP addresses associated with known malicious TLS CA infrastructure (TLC DV TLS CA) identified by JA4X fingerprints. It monitors endpoint network telemetry for communication with identified command-and-control (C2) servers.
This rule monitors network, file, and process telemetry for matches against a predefined list of malicious IP addresses, domain names, and file hashes. It flags suspicious network connections to known C2 infrastructure and the presence or execution of known malicious files based on SHA256 and SHA1 indicators.
C2 Ioc Detection
YARA-L
Detects Network, File, or Process events associated with known C2 IOCs
C2 Ioc Detection
YARA-L
Detects Network, File, or Process events associated with known C2 IOCs
C2 Ioc Detection
YARA-L
Detects Network, File, or Process events associated with known C2 IOCs
This rule monitors network, file, and process telemetry for matches against a predefined list of malicious IP addresses, domain names, and file hashes. It flags suspicious network connections to known C2 infrastructure and the presence or execution of known malicious files based on SHA256 and SHA1 indicators.
This rule monitors network, file, and process telemetry for matches against a predefined list of malicious IP addresses, domain names, and file hashes. It flags suspicious network connections to known C2 infrastructure and the presence or execution of known malicious files based on SHA256 and SHA1 indicators.
This rule monitors network, file, and process telemetry for matches against a predefined list of malicious IP addresses, domain names, and file hashes. It flags suspicious network connections to known C2 infrastructure and the presence or execution of known malicious files based on SHA256 and SHA1 indicators.
This rule monitors network, file, and process telemetry for matches against a predefined list of malicious IP addresses, domain names, and file hashes. It flags suspicious network connections to known C2 infrastructure and the presence or execution of known malicious files based on SHA256 and SHA1 indicators.
This rule detects network connections from internal devices to a list of known malicious IP addresses associated with command-and-control (C2) infrastructure. It monitors for outbound traffic across all monitored network events on endpoints.
This rule detects network connections from internal devices to a list of known malicious IP addresses associated with command-and-control (C2) infrastructure. It monitors for outbound traffic across all monitored network events on endpoints.
Page 16 of 60