Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,252 detections
Filters
Last updated
All Time
Detection languages
695
140
94
67
56
Contributors
394
247
199
52
45
Categories
787
416
267
248
193
Platforms
841
270
264
174
66
Products / Services
498
157
148
133
115
MITRE Techniques
18,124
15,647
12,595
8,404
6,230
1,252
CVEs
4
3
2
2
2
IDS Classtypes
70
58
3
3
2
IDS Protocols
66
23
15
12
9
Detects successful network connections to a specific domain (buildersouthwestlondon.com) where the request URL path includes the string '/cloud/'. This pattern is often indicative of downloading secondary payloads, command-and-control communication, or accessing malicious infrastructure related to a specific campaign.
This rule monitors endpoint telemetry for occurrences of known malicious file hashes, C2 IP addresses, and C2 domains. It aggregates file creation/modification events, process execution, and network connections to detect activity associated with known malicious entities.
This rule monitors endpoint telemetry for occurrences of known malicious file hashes, C2 IP addresses, and C2 domains. It aggregates file creation/modification events, process execution, and network connections to detect activity associated with known malicious entities.
Detects outbound network connections made by 1C Enterprise processes (rmngr.exe or rphost.exe) to non-private/external IP addresses over specific ports (1541, 1570, 1571). These processes typically handle database server management and application host functions within the 1C platform, and direct external communication from them may indicate unauthorized activity or C2 traffic.
Detects network connections to known JeetBot infrastructure domains and IP addresses. The rule specifically identifies potential exfiltration of Twitch OAuth tokens via URL parameters or interaction with known token-collection proxy endpoints, which are associated with the JeetBot/Twitch Enhanced Viewer credential harvesting campaign.
Detects network connections originating from browser processes to known JeetBot command and control (C2) infrastructure. The rule identifies suspicious C2 communication and, specifically, attempts at token exfiltration by monitoring for auth tokens in the URL of requests directed to known JeetBot hosts and Twitch-related infrastructure.
Detects network connections originating from browser processes to known JeetBot command and control (C2) infrastructure. The rule identifies suspicious C2 communication and, specifically, attempts at token exfiltration by monitoring for auth tokens in the URL of requests directed to known JeetBot hosts and Twitch-related infrastructure.
This rule detects activity matching known indicators of compromise (IOCs) associated with recent Russian espionage campaigns, including malicious domains, IP addresses, email senders, file names, and file hashes. It monitors network, sign-in, email, process, and file events across enterprise systems.
Detects network connections to known FLATROOF and ROOFDECK C2 infrastructure used by Jade Sleet/TraderTraitor (UNC4899, Lazarus) in campaigns targeting IT services and DevOps engineers.
Detects network connections to known FLATROOF and ROOFDECK C2 infrastructure used by Jade Sleet/TraderTraitor (UNC4899, Lazarus) in campaigns targeting IT services and DevOps engineers.
Detects established SSH network connections originating from the internal network to external destinations on ports other than the standard port 22. This behavior is often associated with unauthorized SSH tunneling or command-and-control (C2) communication intended to bypass standard firewall egress filtering.
Detects network communication with domains and IP addresses known to be associated with 'ClickFix' social engineering campaigns (specifically those masquerading as legitimate HBO Max or macOS related updates). The rule applies a strict correlation between observed malicious IP traffic and specific DNS requests to reduce noise from IP address reuse or threat intelligence feed probes, while also excluding known security-related processes.
Detects network traffic matching a list of known malicious domains and IP addresses observed in CommonSecurityLog events, tightened to reduce noise from scanners/TI feeds, sinkholed infrastructure, and generic reused IPs by requiring domain-specific selectors and deduplicating repeated matches per host.
Detects the creation, modification, or execution of a hidden file named '.rc' located in '/usr/local/bin/'. This behavior is suspicious as it may indicate an attempt to establish persistence or run malicious scripts via hidden configuration files, especially when performed by non-standard installers.
This rule detects network connections or process command lines associated with known malicious domains, IP addresses, or payload URLs. Additionally, it correlates connections to common public file-sharing platforms or APIs (e.g., Gofile, Telegram) if these events occur on the same device within a 60-minute window of a confirmed malicious infrastructure event, reducing false positives from legitimate uses of shared infrastructure.
This rule identifies successful network connections from local devices to a predefined list of known malicious IP addresses within the last 7 days. Such connections often indicate active communication between a compromised endpoint and adversary-controlled infrastructure.
Detects outbound network connections from endpoints to domains and IP addresses associated with the Kimsuky (APT43) threat actor group. This rule leverages endpoint network telemetry to identify potential command and control (C2) communication or data exfiltration activities.
This rule detects activity associated with the 'Ghostcode' threat campaign by monitoring multiple telemetry sources. It identifies connections to known malicious IP addresses and domains, patterns consistent with phishing kit hosting, and specific URL structures used in credential harvesting or payload delivery. The rule correlates sign-in logs, device network events, DNS queries, and email telemetry to identify potential compromise.
CloudSEK researchers uncovered BigBear 2.0, a global Microsoft 365 phishing-as-a-service operation targeting hundreds of organizations across 40+ countries. The investigation exposed the attacker’s admin panel, affiliate network, phishing infrastructure, and thousands of stolen credentials and session cookies, revealing how modern AiTM attacks can hijack authenticated sessions even after MFA.
Detects network activity (DNS lookups, TLS SNI, and HTTP Host headers) associated with proxy infrastructure (iproyal.com and lightningproxies.net) known to be used by the HEAVYGRAM/CHOSEN BRICK threat actors to mask Telegram-based command and control traffic.
Detects network communication with known Command and Control (C2) IP addresses associated with Phantom Stealer malware. This rule monitors both outbound connections from the internal network and inbound traffic from the identified malicious infrastructure.
Page 22 of 60