Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,989 detections
Filters
Last updated
All Time
Detection languages
1,774
868
397
195
188
Contributors
1,070
924
756
221
96
Categories
2,448
1,307
1,164
785
713
Platforms
2,415
1,310
658
528
133
Products / Services
1,307
886
808
561
337
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
3,989
CVEs
6
5
5
5
5
IDS Classtypes
564
275
11
8
6
IDS Protocols
537
174
64
64
12
Detects suspicious patterns within the search query parameters of Microsoft Copilot and M365 search requests, indicative of potential prompt injection, data exfiltration, or exploitation attempts through malicious URL parameters.
Detects Python interpreter activity associated with the LegionLoader malware, specifically monitoring for Python execution from within the 'AppData\Roaming\Traiolx' directory, or outbound network connections from Python processes to known malicious infrastructure such as 'birdeemusic.com' or other suspicious outbound HTTP/HTTPS communication.
Detects potential Command and Control (C2) communication associated with Emotet malware by monitoring for successful network connections to suspicious remote ports frequently used by the malware. The rule flags endpoints that establish connections to at least three of these high-risk ports within a one-hour window, which is indicative of automated C2 beaconing behavior.
This rule detects the use of JSON-RPC 'eth_call' by a non-browser process during network connection events. It specifically looks for network activity where the process is not a known web browser (Chrome, Edge, Firefox) and the network traffic or command line contains the string '"method":"eth_call"'. This behavior is indicative of malware or other malicious software attempting to interact with blockchain services, potentially for dynamic command and control or address resolution, as described in the Check Point research.
Detects potential C2 beaconing activity associated with LegionLoader by monitoring for outbound network connections to 'birdeemusic.com' domains initiated by Python or AppData/Roaming-based processes, following a precursor process launch (msiexec.exe or from AppData/Roaming) on the same host within 10 minutes.
Detects evidence of a malicious browser extension, identified by extension ID flkebkiofojicogddingbdmcmkpbplcd, designed to redirect search traffic through a typosquatted domain 'perplexity-ai.online'. The rule monitors for file-system creation of the malicious extension, modifications to browser preferences files, manipulation of system registry keys to enforce the search provider, and outbound network connections to the malicious domain from major web browsers.
Detects the execution of AWS STS 'get-caller-identity' commands via a network utility (curl) initiated by common development tools like VS Code, node, or amazonq-lsp. This behavior is indicative of potential cloud credential theft or reconnaissance performed through a compromised developer environment.
Detects indicators of the BeepRAT malware (associated with Operation DragonClone), including specific process execution patterns of HFY.exe, LuaJit.exe, or tcc.exe, network connections to known C2 infrastructure on port 18848, keylogger file creation, and malicious task scheduling or TCC loader execution techniques.
Detects BeepRAT malware activity, including network communication to its command-and-control (C2) server on port 18848 and the creation of screenshot or video artifacts by known loader processes (HFY.exe, LuaJit.exe, tcc.exe). It also monitors for unauthorized network connections to the known BeepRAT C2 IP address.
This rule detects network connections initiated by VBScript (wscript.exe or cscript.exe) to external IP addresses. This behavior can be indicative of malicious VBScript execution attempting to communicate with command and control servers or exfiltrate data, often associated with phishing attacks.
Detects anomalous network activity originating from Firefox (firefox.exe). The rule flags connections to port 8765 (associated with specific browser-based exfiltration PoCs) and any outbound connection on non-standard ports (excluding common browser ports: 80, 443, 8080, 8443, 8888, 53) directed to public IP addresses.
Detects outbound network traffic associated with Djinn Stealer malware beaconing to a hardcoded C2 IP address (96.126.130.126) on port 58942. The detection specifically monitors for HTTP POST requests containing the malicious User-Agent 'telemetry-client/1.0' and 'application/octet-stream' content-type, which are characteristic of this stealer's exfiltration activity.
This rule detects potential command-and-control (C2) activity or data exfiltration by monitoring for first-time DNS resolution of known typosquatted domains targeting 'Perplexity AI', followed by persistent outbound network connections from common web browsers to the same domain family.
Detects persistent outbound network connections to known SystemBC (Coroxy) C2 infrastructure and Tor gateway IP addresses. The rule identifies suspicious beaconing behavior characterized by repeated connections over ports 4001 or 4002, originating from processes in user-writable directories, and correlates these with process lineage from common office applications or browsers.
Detects network connections to known blockchain and crypto-related domains (trongrid.io, aptoslabs.com) initiated by common programming and development tools (node, Code, python, python3). This pattern is often associated with the deployment of unauthorized cryptocurrency miners, blockchain interaction scripts, or malicious actors leveraging development environments.
This rule detects the execution of common command-line tools (npm, node, or go) where the command arguments contain known malicious or suspicious strings associated with recent supply chain or exploitation activity (such as malicious npm packages, specific GitHub repositories, or unusual file path access).
This rule detects WebSocket communication attempts from a device to known command and control (C2) IP addresses associated with the Remcos Remote Access Trojan (RAT). It specifically looks for network events where the remote URL contains 'ws://', 'wss://', or 'websocket' and the remote IP address matches one of the listed indicators of compromise (IOCs).
Detects outbound network connections to remote URLs containing keywords associated with blockchain, cryptocurrency, or Web3 technologies. This behavior may indicate an adversary utilizing blockchain services or decentralised infrastructure for command and control (C2) communication, exfiltration, or proxying.
Detects outbound network traffic from endpoints to known malicious IP addresses associated with Loader-as-a-Service (LaaS) campaigns. The rule monitors DeviceNetworkEvents for connections to specific indicators of compromise (IOCs) and checks for URL patterns commonly associated with file staging and malware loading (e.g., /drop, /stage, /loader).
This rule detects the updated GammaLoad malware's User-Agent variant. This variant is characterized by replacing double colons with double semicolons in the User-Agent string and appending '/.wsntimidate/.' to it. The detection logic specifically looks for HTTP connection events where the User-Agent matches a regex pattern indicative of this GammaLoad variant.
This rule query identifies likely post‑exploitation activity associated with React2Shell (CVE-2025-55182) in which Part 1 identifies web servers spawning unusual child processes (such as command shells or system utilities) combined with suspicious command-line patterns, which may indicate post-exploitation behavior following a compromise. and part 2 detects web servers making outbound network connections to known malicious IPs or hostnames, or to domains associated with tunneling services (e.g., trycloudflare.com), suggesting potential command-and-control activity or data exfiltration.
Page 140 of 190