Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,989 detections
Filters
Last updated
All Time
Detection languages
1,774
868
397
195
188
Contributors
1,070
924
756
221
96
Categories
2,448
1,307
1,164
785
713
Platforms
2,415
1,310
658
528
133
Products / Services
1,307
886
808
561
337
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
3,989
CVEs
6
5
5
5
5
IDS Classtypes
564
275
11
8
6
IDS Protocols
537
174
64
64
12
This rule detects a high volume of web requests (20 or more within 5 minutes from a single IP address) containing keywords commonly associated with denial-of-service (DoS) attacks, performance testing, or reconnaissance activities against web applications. Keywords include 'sleep', 'benchmark', and 'loadtest' in the URI query string.
Detects outbound network connections from the aspnet_compiler.exe process. This process is often abused by malware like LokiBot as a host for malicious payloads through process injection to establish C2 communication, as it has no legitimate need for external network connectivity.
Detects DNS queries for domains associated with the Tykit phishing kit infrastructure. These domains are used for hosting phishing pages and for C2 exfiltration.
Detects DNS queries for domains associated with the Tykit phishing kit infrastructure. These domains are used for hosting phishing pages and for C2 exfiltration.
This rule detects secondary Command and Control (C2) communication associated with the Remcos RAT loader. It identifies suspicious network connections to specific IP addresses, domains (including those often used by malicious actors like .bit, .onion, .su, .cc), and remote ports commonly utilized by Remcos.
Detects outbound network connection from a host to a known malicious IP and port associated with the exploitation of the GeoServer WFS vulnerability CVE-2024-36401. This rule identifies the potential post-exploitation callback, such as a curl command, following successful remote code execution.
This rule detects network traffic indicative of the 'EvilTokens' phishing kit, specifically targeting Microsoft OAuth Device Code flow. It looks for HTTP POST requests to the '/api/device/start' URI on domains hosted on Cloudflare Workers ('.workers.dev'). This pattern suggests an attempt to initiate a device code phishing attack, where adversaries trick users into entering credentials or codes to grant access to malicious applications.
Detects Microsoft Teams processes (teams.exe or ms-teams.exe) making multiple network connections to domains or IP addresses that are not part of the expected Microsoft Teams infrastructure. This rule specifically looks for connections to non-Microsoft domains (excluding .microsoft.com, .office.com, .office365.com, .skype.com, .azure.com, .cdn.office.net) and non-private IP addresses, indicating potential C2 activity by the Backdoor.Turn malware.
A node/python/pip-driven package install resolves a domain that Palo Alto classifies as newly-registered within seconds of the install. This signals a potential malicious dependency or compromised package beaconing to attacker infrastructure (supply-chain compromise / install-time C2).
This rule monitors and alerts on network connections originating from hosts to known command-and-control (C2) or infrastructure domains associated with malicious browser extensions, specifically those identified in the BadBlocker campaign. These extensions often masquerade as legitimate ad-blocking tools to perform lifecycle beaconing or redirect users to promotional/malicious content.
Detects outbound HTTP/HTTPS requests to api.adblock-for-youtube.com to fetch scriptlet rules. This activity is consistent with the Adblock for YouTube extension (cmedhionkhpnakcndndgjjdbohmhepckk) periodically polling for updates.
This rule detects network communication targeting specific external IP addresses associated with known SD-WAN infrastructure and common management endpoints (e.g., /dataservice/). This behavior may indicate an attempt to interact with, enumerate, or compromise SD-WAN controllers or managed edge devices.
This rule detects potentially malicious activity associated with the exploitation of Ray framework dashboards. It identifies three distinct indicators: inbound network connections to the Ray dashboard port (8265), the execution of common file download tools (e.g., curl, wget) by Ray worker processes, and outbound connections from Ray processes to known C2 infrastructure.
This rule detects the installation or update of known malicious browser extensions followed by network communication to identified command-and-control or malicious infrastructure domains. It also monitors for direct network beaconing to these malicious domains, providing defense-in-depth even if installation telemetry is absent.
This rule detects an unsigned process executing from the AppData or Temp directories that loads user32.dll, a required step for installing keyboard hooks (SetWindowsHookEx). This activity is correlated with network connections from the same process to the Telegram Bot API, a common technique for exfiltrating captured keystrokes or other sensitive data.
This rule monitors network logs (DNS, Proxy, or general network traffic) for communication with TON (The Open Network) blockchain-related infrastructure, including known C2 domains associated with TONResolver and specific blockchain API queries. It flags connections made by suspicious processes such as node.exe, powershell, wscript, cscript, or mshta, which are often used by malware to execute scripts or facilitate C2 communication.
This rule detects potential DcRAT initial beaconing by correlating WMI 'AntiVirusProduct' enumeration with subsequent outbound network connections to known DcRAT C2 infrastructure within a short time window. This behavior is indicative of a post-exploitation reconnaissance phase followed by initial callback.
This rule detects malicious activity associated with the TONResolver RAT, which leverages node.exe to execute JavaScript payloads stored in AppData\Local\Nodejs. The rule monitors for multiple suspicious behaviors, including outbound C2 beaconing to known malicious domains, spawning of suspicious child processes (powershell.exe, cmd.exe, wscript.exe, cscript.exe), unauthorized access to browser-based credential stores (Login Data and Cookies), and establishment of persistence via Windows Registry Run keys.
This rule detects network connections to specific domains known to be associated with malicious activity or to URLs matching a common Command and Control (C2) communication pattern. The domains 'openanyworddocument.com', 'kittyfreespace.com', 'searchdocumentsfree.com', 'autoupdatet.com', 'autoupdaters.com', and 'autoupdatethis.com' are explicitly listed as indicators. Additionally, the rule identifies C2 communication attempts via a regex pattern '/api/(init|cl)/[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}' which often signifies communication with a C2 server using a specific API endpoint and a GUID-like identifier.
This rule detects the use of JSON-RPC 'eth_call' by a non-browser process during network connection events. It specifically looks for network activity where the process is not a known web browser (Chrome, Edge, Firefox) and the network traffic or command line contains the string '"method":"eth_call"'. This behavior is indicative of malware or other malicious software attempting to interact with blockchain services, potentially for dynamic command and control or address resolution, as described in the referenced Check Point research.
Detects Python-based command and control activity associated with LegionLoader by monitoring for network connections, DNS queries to specific malicious domains, and file modifications involving '_socket.pyd' within the 'Traiolx Custom Utils' directory path.
Page 139 of 190