Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,252 detections
Filters
Last updated
All Time
Detection languages
695
140
94
67
56
Contributors
394
247
199
52
45
Categories
787
416
267
248
193
Platforms
841
270
264
174
66
Products / Services
498
157
148
133
115
MITRE Techniques
18,116
15,636
12,583
8,393
6,223
1,252
CVEs
4
3
2
2
2
IDS Classtypes
70
58
3
3
2
IDS Protocols
66
23
15
12
9
Sweeps endpoint telemetry for known UAC-0099 MATCHBOIL/LONEPAGE indicators: SHA256 hashes, C2 IPs, C2 domains (including subdomains), and payload/C2 URLs. Matches are limited to public outbound connections, Defender self-activity is excluded from file hits, and repeat hits are collapsed to one row per device and indicator. The lists are a subset of the 142 IOCs in the source report.
This rule monitors network traffic from CommonSecurityLog data to detect bidirectional communication between NetScaler appliances and known malicious infrastructure associated with the CVE-2026-88772 campaign, which is indicative of command-and-control activity.
Detects potential remote shell behavior where a process named libgcrypt establishes an outbound connection on TCP port 9999 and spawns a shell (such as sh, bash, dash, zsh, or ash) within a short time window.
Detects potential remote shell behavior where a process named libgcrypt establishes an outbound connection on TCP port 9999 and spawns a shell (such as sh, bash, dash, zsh, or ash) within a short time window.
Detects potential remote shell behavior where a process named libgcrypt establishes an outbound connection on TCP port 9999 and spawns a shell (such as sh, bash, dash, zsh, or ash) within a short time window.
Detects endpoint and network activity matching known Indicators of Compromise (IOCs) associated with BPFDoor, AVERAT, and Rekoobe backdoors based on Rapid7 research. The query checks for specific file hashes, IP addresses, and domain names across process, file, image load, network, and DNS events.
Detects endpoint and network activity matching known Indicators of Compromise (IOCs) associated with BPFDoor, AVERAT, and Rekoobe backdoors based on Rapid7 research. The query checks for specific file hashes, IP addresses, and domain names across process, file, image load, network, and DNS events.
Detects endpoint and network activity matching known Indicators of Compromise (IOCs) associated with BPFDoor, AVERAT, and Rekoobe backdoors based on Rapid7 research. The query checks for specific file hashes, IP addresses, and domain names across process, file, image load, network, and DNS events.
This rule monitors endpoint telemetry for indicators of compromise (IOCs) associated with known malicious activity. It checks for file creation, process execution, and network connections that match a defined list of malicious file hashes (SHA256, SHA1, MD5), C2 IP addresses, and malicious domains or URL patterns.
IOC sweep for ARTEX campaign indicators: C2 host, nine proxy IPs, xcai.pro and its subdomains, and the CLAUDE.md URL across Defender, CEF/firewall, DNS and Entra sign-in telemetry. Domains match on exact host or subdomain only, connection types are limited to real connection events, and sign-ins are limited to successes and credential failures.
Detects the handshake process for Blackwood/Chisel reverse SOCKS5 or TCP-over-HTTP tunneling to a known malicious Iranian-hosted C2 IP address. The detection matches specific HTTP headers used by the Chisel tool during its initialization phase.
This rule performs an IOC sweep over the past 30 days using DeviceNetworkEvents, DeviceFileEvents, and DeviceProcessEvents to detect indicators associated with PoeLLM / Canto Incognito malware campaigns, specifically scanning for known C2 IP addresses, Kryptex cryptomining pool endpoints/domains, and specific file hashes (SHA256).
Detects potential remote shell behavior where a process named libgcrypt establishes an outbound connection on TCP port 9999 and spawns a shell (such as sh, bash, dash, zsh, or ash) within a short time window.
Detects network connections to known Indicators of Compromise (IOCs) associated with the TraderTraitor campaign, including trojanized Terraform providers (FLATROOF/ROOFDECK malware families) using specific domains and URL paths.
This rule monitors endpoint telemetry for indicators of compromise (IOCs) associated with known malicious activity. It checks for file creation, process execution, and network connections that match a defined list of malicious file hashes (SHA256, SHA1, MD5), C2 IP addresses, and malicious domains or URL patterns.
Sweeps Defender XDR telemetry for known NEBULA / KNTRAT indicators (SHA256 hashes, C2 IP, decoy domain and URLs, burner publisher emails). Hash matching is scoped per table (execution hash only in process events), noisy tooling is excluded from command-line matches, network hits are limited to connection events, and results are aggregated per device and IOC.
Sweeps Defender XDR telemetry for known NEBULA / KNTRAT indicators (SHA256 hashes, C2 IP, decoy domain and URLs, burner publisher emails). Hash matching is scoped per table (execution hash only in process events), noisy tooling is excluded from command-line matches, network hits are limited to connection events, and results are aggregated per device and IOC.
Detects outbound network traffic associated with the Azazel operation, including connections to identified C2 infrastructure, open directory/upload listeners, domain-specific staging servers, and exfiltration attempts to MEGA cloud storage endpoints.
Detects endpoint connections to known DarkSword/Coruna exploit-host and C2 infrastructure. The shared AWS IP is only matched on C2 ports 8881/8882 to reduce collateral hits.
Detects endpoint connections to known DarkSword/Coruna exploit-host and C2 infrastructure. The shared AWS IP is only matched on C2 ports 8881/8882 to reduce collateral hits.
Detects devices reaching P7 DarkSword exploit-delivery hosts (cdn/js.gotoiphone.com, mzpo30.cam) and the agdx53.cc C2, with delivery-then-C2 chaining surfaced as the highest-confidence match. Matching is limited to the exact listed hosts and successful/attempted connection events.
Page 5 of 60