Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,252 detections
Filters
Last updated
All Time
Detection languages
695
140
94
67
56
Contributors
394
247
199
52
45
Categories
787
416
267
248
193
Platforms
841
270
264
174
66
Products / Services
498
157
148
133
115
MITRE Techniques
18,116
15,636
12,583
8,393
6,223
1,252
CVEs
4
3
2
2
2
IDS Classtypes
70
58
3
3
2
IDS Protocols
66
23
15
12
9
This rule detects outbound network connections to known Command and Control (C2) and exfiltration domains associated with the SANDWORM_MODE campaign. These domains are used to exfiltrate stolen credentials and other sensitive data.
Detects XWorm LATAM campaign artifacts via published SHA256 and unique network/mutex markers from ANY.RUN analysis.
This rule detects outbound network connections from devices to a known Moonrise C2 IP address (193.23.199.88). It specifically looks for successful connections, inbound connections accepted, or connection attempts to this malicious IP.
This rule detects the creation of specific mutex names ('kongxin1123') which are known to be associated with the Blackmoon botnet. The detection is based on monitoring process creation events on Windows systems for these particular mutexes, indicating potential Blackmoon botnet activity.
OysterLoader uses a Windows scheduled task to keep itself running. It creates a task with a name that looks like a normal security or updater tool, so it blends in. The task runs repeatedly in the background, helping the malware come back even after a restart and making it harder to notice or remove.
This query identifies outbound network connections made by the notepad++.exe process. This is useful for hunting for suspicious activity, such as connections to malicious update servers or C2 channels, by baselining normal update and plugin activity.
This rule correlates multiple indicators of compromise (IOCs) across file, network, and process events to detect potential advanced persistent threats (APTs) or sophisticated malware. It looks for specific file paths associated with tools like Lightshot, ScreenConnect, or suspicious VS Code extensions, combined with network connections to known malicious domains/IPs or unusual ports, and the execution of suspicious processes like 'Code.exe' outside of its legitimate VS Code path or 'ScreenConnect' related executables. A high threat score is assigned if multiple types of these indicators are observed on the same device and account within a 30-day window.
Detection content for the Notepad++ supply-chain compromise and the Chrysalis backdoor, attributed to Lotus Blossom. Detection rules use KQL only.
Detects TTPs associated with the Lazarus Group malware families OtterCookie and BeaverTail. This rule identifies persistence via registry run keys and scheduled tasks, suspicious node.js execution for keylogging, and network connections to known C2 infrastructure.
This query hunts for network activity and other events related to specific domains (freefoodaid.com, wellnessmedcare.org) potentially associated with CVE-2026-21509. It searches DNS queries, network connections, generic web proxy/firewall logs, and URL click events to identify interactions with these domains.
Detects network traffic to or from known IP addresses associated with TA584 command and control (C2) servers and hosting infrastructure. This actor is a known initial access broker, and infections can lead to ransomware.
Detects instances where an AI agent process (e.g., Moltbot, ClawdBot) performs a web search or HTTP request containing suspicious internal identifiers (like API keys or project names) as URL parameters. This behavior is a hallmark of 'search-and-leak' exfiltration tactics, often triggered by indirect prompt injection.
This rule detects unsigned executables originating from the WindowsApps directory that are making network connections to IP lookup services. This behavior can indicate a potentially malicious application attempting to identify its external IP address, possibly for command and control communication or reconnaissance. Common browsers are excluded from this detection to reduce false positives.
Detects C2 network traffic associated with the InvisibleFerret RAT, used by the PurpleBravo group. This malware uses a plaintext HTTP channel for beaconing, data exfiltration, and payload delivery to specific URI endpoints.
This rule detects patterns indicative of cryptomining malware execution, specifically targeting those distributed via impersonated PyPI packages. It looks for Python processes exhibiting characteristics such as: 1. Command lines containing keywords related to mining, cryptocurrency, hashing, and mining pools. 2. Python processes making suspicious network connections to stratum+tcp or mining pools. 3. Python processes engaging in resource-intensive operations like multiprocessing or threading, often utilizing all available CPU cores. 4. Python processes executing obfuscated code, potentially involving base64, zlib, or gzip decoding, combined with network requests. The rule triggers if any of these conditions are met, or if a combination of suspicious network activity and resource-intensive behavior, or obfuscated execution and resource-intensive behavior, is observed.
Detects events involving indicators of compromise (IOCs) that are associated with currently active APT groups
operating from or targeting Germany, based on threat intelligence feeds updated within the last 24 hours.
operating from or targeting Germany, based on threat intelligence feeds updated within the last 24 hours.
TIFCE (Threat Intelligence Feed Content Evaluation) is a simple way to measure if a TI feed is actually useful based on four things — uniqueness, real matches, confirmed maliciousness, and activity.
🚨 TIFCE allows using one detection per IOC type (URLs, domains, file hashes) instead of dozens of rules per feed, keeping detections clean, centralized, and easy to maintain.
If you rely on threat intelligence for detection, it can be a good solution to how to evaluate current or new TI feeds.
🚨 TIFCE allows using one detection per IOC type (URLs, domains, file hashes) instead of dozens of rules per feed, keeping detections clean, centralized, and easy to maintain.
If you rely on threat intelligence for detection, it can be a good solution to how to evaluate current or new TI feeds.
This query detects network communication to known Command and Control (C2) IP addresses used by the Medusa ransomware group, often via malicious SimpleHelp RMM servers.
Detects HTTP C2 beaconing patterns based on burst request counts with small response bodies (1-499 bytes). This rule correlates multiple HTTP requests to the same destination within a short timespan, where each response has a small body size. This pattern is indicative of command and control (C2) communication.
This rule detects network connections from devices to a predefined list of known malicious domains. It identifies attempts by internal systems to communicate with command and control servers, phishing sites, or other infrastructure associated with threat actors.
This rule detects network connections to the Telegram API endpoint (api.telegram.org) from processes other than common web browsers like Chrome or Edge. This activity could indicate the use of Telegram for command and control, data exfiltration, or other malicious purposes by malware or threat actors.
Page 51 of 60