Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,252 detections
Filters
Last updated
All Time
Detection languages
695
140
94
67
56
Contributors
394
247
199
52
45
Categories
787
416
267
248
193
Platforms
841
270
264
174
66
Products / Services
498
157
148
133
115
MITRE Techniques
18,116
15,638
12,585
8,395
6,225
1,252
CVEs
4
3
2
2
2
IDS Classtypes
70
58
3
3
2
IDS Protocols
66
23
15
12
9
Detects unexpected outbound network connections from the ConfigurationRemotingServer.exe or WindowsPackageManagerServer.exe processes. Threat actors use WinGet DSC execution to establish reverse shells or download payloads. Network activity from these processes is highly unusual.
This rule detects potential Command and Control (C2) communication utilizing DNS at the application layer. It specifically looks for DNS queries and triggers an alert if a single source IP performs more than 30 DNS queries within a 60-second window, indicating a high frequency of DNS activity that could be indicative of C2.
Detects network connections to known HarborWatch C2 server IPs and associated fake-Amazon infrastructure domains, directly identifying compromised hosts communicating with this threat actor's infrastructure.
Detects potential Trickbot activity by searching for known Trickbot-related keywords ('trickbot', 'server=', 'botnet', 'moduleload') in process command lines, combined with network-related keywords ('http', 'port'). This rule specifically looks for Event ID 4688 (a process creation event in Windows Security Event Logs) and analyzes its CommandLine field.
Detects processes making HTTP/HTTPS requests to localhost on ports 40341 or 40342 for '/metadata'. This pattern can indicate local service discovery, inter-process communication, or potentially malicious activity attempting to interact with local services, possibly for credential access or privilege escalation.
This rule detects a high volume of outbound network connections (20 or more within an hour) from a single device and process to non-RFC1918 IP addresses on ports commonly associated with Remote Access Trojans (RATs) or Command and Control (C2) communication. The ports monitored include 443, 8443, 8080, 80, 4444, 5555, 6666, and 7777. This pattern can indicate a compromised host attempting to establish C2 with an external adversary.
Detects generic application layer protocol abuse for C2 communications
This rule detects potential C2 beaconing activity over HTTP. It specifically looks for HTTP GET requests where the URI path consists of 8 to 16 lowercase alphanumeric characters. The rule uses a threshold of 20 such requests within 60 seconds from the same source IP address to identify beaconing behavior.
This rule detects processes making a high volume of successful network connections to GitHub's raw content (raw.github.com). This behavior can be indicative of an adversary downloading tools, scripts, or other malicious content from GitHub, potentially as part of a command and control (C2) channel or for staging purposes. The rule counts connections per hour per initiating process filename and flags if the count exceeds 5.
Detects outbound network connections initiated by 7-Zip processes. This could indicate compromise of the 7-Zip application, potentially through exploitation of vulnerabilities like CVE-2026-48095, leading to data exfiltration or command and control communication.
This rule detects unusual network beaconing activity from processes. It identifies processes that make more than 50 network connections within a 15-minute window to distinct remote IP addresses and ports, excluding common legitimate processes like svchost.exe, chrome.exe, msedge.exe, and explorer.exe. The rule then enriches this information with the last seen time of the process.
Detects the creation of a file on a server system by common network utilities (curl, ftp, powershell, winscp, certutil) within a 5-minute window of a network connection to common ports (21, 22, 80, 443). This could indicate ingress tool transfer or data exfiltration attempts.
This rule detects potential command and control (C2) beaconing activity by monitoring network events for specific URL patterns and user agent strings associated with known C2 frameworks like AzureVeil and Adaptix. It identifies beaconing if multiple devices communicate with the same remote IP address using these indicators within a 15-minute window, with more than 5 beacon counts and more than 1 distinct device.
This rule detects outbound network connections from devices to IP addresses identified as malicious by a threat intelligence feed. It joins device network events with threat intelligence indicators, specifically looking for successful connections or connection requests to IPs with a confidence score greater than 50. The alert provides details about the device, the remote IP, the initiating process, and the threat intelligence context.
This rule detects potential command and control (C2) communication over SMTP by looking for repeated 'EHLO' commands within a short timeframe from the same source IP address. The threshold is set to trigger if 10 'EHLO' commands are observed within 300 seconds (5 minutes) from a single source.
This rule detects potential command and control (C2) beaconing activity over HTTP. It specifically looks for HTTP POST requests with a content size between 50 and 300 bytes that occur at a regular interval (15 times in 60 seconds) from a single source IP address. This pattern is often indicative of malware communicating with a C2 server.
Detects network connections to typo-squatted lure domains, payload hosts, and C2 servers associated with the fake Gemini CLI and Claude Code campaign.
Detects DNS queries commonly associated with Local LLM (Large Language Model) frameworks or AI-related domains. This activity may indicate unauthorized AI usage or potential data exfiltration channels.
Detects network connections to known suspicious domains or IP addresses
This rule detects potential C2 beaconing behavior by identifying devices that make a high number of periodic outbound connections (20 or more within an hour) to a single external IP address on common web and C2-related ports (80, 443, 8080, 8443, 4444, 5555, 8888, 9001). The rule summarizes these connections by device, remote IP, and initiating process, highlighting sustained communication patterns indicative of command and control.
Detects network connections to known Command and Control (C2) servers associated with the ValleyRAT backdoor, used by the Silver Fox APT group.
Page 48 of 60