Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,252 detections
Filters
Last updated
All Time
Detection languages
695
140
94
67
56
Contributors
394
247
199
52
45
Categories
787
416
267
248
193
Platforms
841
270
264
174
66
Products / Services
498
157
148
133
115
MITRE Techniques
18,116
15,638
12,586
8,396
6,226
1,252
CVEs
4
3
2
2
2
IDS Classtypes
70
58
3
3
2
IDS Protocols
66
23
15
12
9
Detects browser processes connecting to internal IP addresses followed by a connection to an external (non-whitelisted) destination within a 2-minute window. This behavior is indicative of potential data staging or exfiltration, where a web browser is used to access internal resources before transferring data to an external site.
This rule detects potential deployment of the 'gs-netcat' utility by identifying specific suspicious command-line patterns or file masquerading (where a file's original name doesn't match its current filename while residing outside standard system paths). It correlates these process execution events with subsequent outbound network connections on high ports (>10000) within a 5-minute window to identify potential reverse shell activity.
Detects browser processes connecting to internal IP addresses followed by a connection to an external (non-whitelisted) destination within a 2-minute window. This behavior is indicative of potential data staging or exfiltration, where a web browser is used to access internal resources before transferring data to an external site.
Detects browser processes connecting to internal IP addresses followed by a connection to an external (non-whitelisted) destination within a 2-minute window. This behavior is indicative of potential data staging or exfiltration, where a web browser is used to access internal resources before transferring data to an external site.
This rule detects potential JDY botnet activity characterized by host fingerprinting and data exfiltration patterns. It looks for repeated POST requests to specific URI patterns ('/gate', '/report', '/scan') accompanied by a significant volume of outbound data, indicative of automated C2 communication or data staging. The rule aggregates metrics per host to identify high-volume exfiltration patterns and calculates a risk score based on the frequency of requests and the diversity of destination IPs.
This rule identifies network connections (DNS queries, HTTPS/WebSocket traffic) directed toward known suspicious domains associated with potentially malicious C2 infrastructure.
Detects anomalous outbound network connections from node.exe processes initiated by developer tools like VS Code, npm, or installation binaries. The rule specifically monitors for patterns indicative of Command and Control (C2) communication, including high-frequency Socket.io polling, WebSocket upgrades, and long-duration connections to external, non-private IP addresses.
This rule detects potential data exfiltration attempts by monitoring for network connections to URLs containing suspicious substrings (bit, onion, .cc, .su) over common web and DNS ports (53, 80, 443, 8080). It flags high-frequency unique connection attempts from a single device, which may indicate command-and-control (C2) traffic or data exfiltration over covert channels.
Detects anomalous network traffic from svchost.exe processes exhibiting suspicious behavior indicative of DcRAT, specifically reconnaissance activities that involve gathering system information and security product details for exfiltration to a Command and Control (C2) server.
This rule detects a process injection event where a process running from a suspicious directory (e.g., Temp, AppData, ProgramData) injects code into a common system or browser process, followed by that same process initiating a network connection to non-internal IP ranges on specific ports within a 10-minute window. This behavior is indicative of malware establishing persistence or C2 communications.
Detects potentially malicious activity associated with the Ghidra reverse engineering framework, including the spawning of unexpected non-Java child processes, loading of suspicious project files (.gzf/.gar), loading of unsigned extensions from non-standard directories, and unexpected outbound network connections from decompiler or Java processes.
Detects a network-connected Linux process exhibiting beaconing behavior (high-frequency external connections) that is subsequently correlated with unauthorized file access to sensitive Linux configuration files (/etc/passwd, /etc/shadow, or authorized_keys). This rule filters out common system processes and standard management binaries, targeting suspicious command-and-control activity combined with credential theft.
Detects credential abuse patterns from FortiGate logs including administrative changes, tunneling activity, and anomalous source-IP behavior.
Detects network communication associated with DcRAT, specifically identifying DNS lookups for the known C2 domain kkxqbh.top or network connections to port 2671 originating from suspicious or specific host processes.
This rule detects activities associated with the VILE ransomware, specifically the creation of file staging artifacts (vile_user_files.zip), execution of associated binaries, and network communication with Gofile.io infrastructure used for exfiltration.
Detects network activity associated with Cobalt Strike Beacon behavior by identifying specific file extensions (.bin, .stager, .update, .task, .post) commonly used in Beacon staging and communication profiles within network inspection events.
This rule detects potential command and control (C2) beaconing activity by identifying devices communicating with known suspicious remote IP addresses at regular, repeating intervals. It calculates the time difference between consecutive connections to specific suspicious IPs and identifies devices that establish at least three connections within one-hour bins, adhering to a 1 to 15-minute heartbeat interval.
This rule detects the use of TLS protocol on port 443 with a specific content signature, indicating potential Command and Control (C2) activity. It triggers an alert if 20 such connections are observed from the same source within 60 seconds.
This rule detects network connections from internal hosts to a list of known malicious IP addresses associated with the Payroll Pirate campaign (attributed to Storm-2755 and Storm-2657). Identifying these connections indicates potential communication with adversary-controlled infrastructure.
Detects execution of potentially malicious processes masquerading as 'pythonw.exe' or 'userscreen.exe', specifically when they exhibit behavior associated with the APT37 NarwhalRAT. The rule identifies processes loading critical system DLLs (kernel32.dll, ntdll.dll) while simultaneously initiating network connections to known C2 infrastructure within a 10-minute window.
Detects potential Command and Control (C2) communication associated with Emotet malware by monitoring for successful network connections to suspicious remote ports frequently used by the malware. The rule flags endpoints that establish connections to at least three of these high-risk ports within a one-hour window, which is indicative of automated C2 beaconing behavior.
Page 38 of 60