Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,252 detections
Filters
Last updated
All Time
Detection languages
695
140
94
67
56
Contributors
394
247
199
52
45
Categories
787
416
267
248
193
Platforms
841
270
264
174
66
Products / Services
498
157
148
133
115
MITRE Techniques
18,116
15,638
12,586
8,396
6,226
1,252
CVEs
4
3
2
2
2
IDS Classtypes
70
58
3
3
2
IDS Protocols
66
23
15
12
9
This rule detects devices making a high volume of successful network connections to GitHub's API endpoints (api.github.com or api.releases). A count of 5 or more successful connections within an hour from a single device is considered suspicious and could indicate data exfiltration, automated tooling, or unusual development activity.
Detects execution and file artifacts associated with the GSocket (gs-netcat) utility, often used by threat actors like Velvet Ant (Operation Highland) for establishing SOCKS proxies, tunneling, and persistent remote access. The rule monitors process creation, file modifications, and network connections related to the tool's binary names, command-line arguments, and specific file paths.
This rule detects anomalous, high-frequency HTTP POST requests directed at sensitive API endpoints related to payment, billing, or administration. By calculating requests per minute and identifying unique source IP behavior, it aims to flag potential automated brute-force attacks, unauthorized API discovery, or data exfiltration attempts against critical system management interfaces.
Detects when 'Cursor.exe' (a legitimate application) spawns common command-line utilities (cmd.exe, powershell.exe, pwsh.exe, curl.exe, wget.exe, certutil.exe, bitsadmin.exe) with command-line arguments indicative of downloading files from the internet (e.g., containing 'http://', 'https://', 'ftp://', '-o', '-OutFile', 'iwr', 'DownloadString', 'DownloadFile'). This could indicate malicious activity where 'Cursor.exe' is being abused to facilitate ingress tool transfer or execute malicious payloads.
Detects network connections to specific cloud service providers (Google Cloud PubSub/MQTT, Azure Service Bus) or common STUN/WebRTC ports (3478) initiated by processes other than standard web browsers or common communication applications.
This rule detects a sequence of events where a host initiates a network connection on port 1313 (a common port associated with certain web-based C2 or exploitation frameworks) followed shortly by an outbound network connection initiated by PowerShell within a 5-minute window. This behavior is indicative of a post-exploitation phase where an initial entry point leverages a malicious script or shell to establish persistent communication.
Identifies network connections to known ShinyHunters IP addresses or domains associated with the recent Oracle PeopleSoft exploitation campaign. This rule monitors both endpoint network events and perimeter firewall/proxy logs for outbound communication to the specified malicious infrastructure.
Detects the suspicious creation of executable files in C:\ProgramData with randomized paths, typically associated with the SystemBC backdoor. The detection rule correlates this file creation event with co-occurring suspicious activities indicative of ransomware operations, such as the creation of known ransomware-related files (e.g., decryptor notes) or signs of lateral movement via non-standard network traffic and SMB activity.
This rule identifies suspicious outbound network beaconing by analyzing flow statistics for consistency in interval and payload size. It flags processes that demonstrate periodic communication (heartbeats) to external endpoints on non-standard ports. The detection logic calculates a 'beacon_score' based on the consistency of the communication interval, small average payload sizes, low variance in payload sizes, and the number of connections. Additional weighting is applied to connections made by typically non-network processes (e.g., svchost, explorer, wscript) or those connecting to ports associated with known malware like SystemBC.
Detects instances where AI coding assistants (e.g., Claude Code, Cursor, Windsurf) spawn shell interpreters or scripting runtimes that subsequently initiate outbound network connections to non-private IP addresses. This behavior is indicative of potential malicious activity, such as credential theft or workspace trust bypass exploits (e.g., CVE-2026-12957), where an attacker leverages an AI coding assistant to execute arbitrary code. The rule excludes common build and test runner processes to minimize false positives.
This rule detects suspicious activities originating from Python processes spawned by development tools like VS Code, Node.js, or npm. It flags potential credential access when such processes attempt to read sensitive files (e.g., browser profiles, SSH keys, cloud configuration files) or perform suspicious network communication to external, non-standard ports, which may indicate data exfiltration or command-and-control behavior.
Detects instances where a process, other than known benign applications, writes a screen capture image file (BMP, JPG, JPEG, or PNG) to a temporary directory, followed by a network connection to an external IP address within two minutes by the same process.
This rule identifies instances of PowerShell executing with an encoded command followed immediately (within 300 seconds) by an outbound network connection to a non-standard port or non-internal IP address. This behavior is indicative of a remote access tool or reverse shell establishing command and control (C2) communication.
This rule detects outgoing TCP traffic that initiates a SOCKS5 handshake (indicated by the byte sequence |05 01 00|) on destination ports other than standard web ports (80, 443, 8080, 8443). This behavior is characteristic of TOR client traffic attempting to establish an anonymous connection to an external TOR relay or node via non-standard network ports.
Detects network connections resolving to specific domains or UUID-based API endpoints used by Lorem Ipsum's primary C2 cluster following the late-May ClickFix pivot. This rule identifies known command and control (C2) infrastructure by matching specific domain names and a UUID-based API endpoint pattern in network connection URLs.
This rule detects suspicious network connections originating from internal IP addresses to common service ports (DNS, SMB, RDP, WinRM) on remote, non-internal IP addresses. It flags instances where a single process on a device makes 10 or more such connections within an hour, which could indicate reconnaissance, lateral movement, or data exfiltration attempts.
This rule detects devices making a high volume of successful network connections to GitHub's API endpoints (api.github.com or api.releases). A count of 5 or more successful connections within an hour from a single device is considered suspicious and could indicate data exfiltration, automated tooling, or unusual development activity.
This rule monitors for node.exe processes running from the AppData directory initiating multiple network connections to non-private (external) IP addresses over common web ports (80, 443, 8080, 8443). Running Node.js from user-writable temporary directories can be an indicator of malicious activity or the execution of unauthorized web applications attempting command and control communication.
This rule detects malicious activity associated with the TinyRCT backdoor, specifically focusing on the AppDomainManager injection technique. It monitors for the presence of known malicious file names, specific process command-line arguments involving VMware paths, and known file hashes connected to the chrome_setup.zip attack chain, as well as network communication with known malicious IP addresses.
Detects the SearchLeak (CVE-2026-42824) exploit, where an attacker uses a prompt-injected M365 Copilot URL to force the assistant to search the victim's mailbox for sensitive authentication information such as MFA codes, OTPs, or security passcodes. The rule correlates an external HTTP request containing the malicious URL with a subsequent Exchange search query initiated by the Copilot service within a 2-minute window.
This rule detects network connections from devices to a specific IP address (62.102.148.212) and a set of associated ports (37393, 45839, 38471, 12345, 4444, 5555). This IP address and these ports are known indicators of compromise for the Remcos Remote Access Trojan (RAT) Command and Control (C2) infrastructure. Detection of such connections indicates potential Remcos RAT activity within the environment.
Page 36 of 60