Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,989 detections
Filters
Last updated
All Time
Detection languages
1,774
868
397
195
188
Contributors
1,070
924
756
221
96
Categories
2,448
1,307
1,164
785
713
Platforms
2,415
1,310
658
528
133
Products / Services
1,307
886
808
561
337
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
3,989
CVEs
6
5
5
5
5
IDS Classtypes
564
275
11
8
6
IDS Protocols
537
174
64
64
12
Detects vLLM establishing outbound network connections to fetch external media files (e.g., .mov, .mp4, .jp2) from non-private IP addresses. This activity may indicate exploitation of CVE-2026-22778, allowing for remote code execution by fetching malicious content.
Detects browser connections to the Bing Search by Image endpoint, which can be exploited as a Server-Side Request Forgery (SSRF) proxy to bypass Content Security Policies (CSP) and exfiltrate data, as seen in the SearchLeak attack. The rule specifically looks for connections to 'bing.com/images/searchbyimage' that also include the 'imgurl=' or 'imgurl%3d' parameter, indicating an attempt to use the server-side fetch functionality.
This rule monitors web browser processes (msedge.exe, chrome.exe) for two distinct behaviors: performing network connections to known command and control (C2) or exfiltration domains, and accessing sensitive browser files such as cookies, login data, or web data files.
Detects ransomware C2 communication to known onion domain patterns
This rule detects suspicious activity involving interaction with the 'perplexity-ai.online' domain and the creation of specific browser extension files, which may indicate browser-based data exfiltration or credential theft. The rule correlates file creation events, DNS queries, and network connections, assigning a higher risk score when multiple indicators are present, particularly when evidence suggests exfiltration of keystroke or search data via web requests.
Detects the installation of a Microsoft Edge extension followed by an outbound network connection to known StegoAd C2 infrastructure after a 3-5 day dormancy period, a behavior characteristic of time-gated sandbox evasion.
Detects automated scraping of company location and headquarters pages
Detects a module changing protocol, destination class, or cloud service after repeated failed connections on its primary channel. This behavior is indicative of malware like Kazuar attempting to establish C2 communication through alternative means when its initial attempts fail.
This rule detects potential command and control (C2) activity associated with a known npm RAT, identified by network connections to specific C2 infrastructure (95.216.92.207:8080) or DNS resolution of 'nvidiadriver.net'. The rule specifically flags these events when performed by common execution tools like 'python.exe' or 'chost.exe', or when the process image is running from a temporary directory, which is a common persistence or execution indicator for malware.
Detects DNS queries for 14-character alphanumeric .org domains characteristic of Bumblebee malware's Domain Generation Algorithm (DGA).
Detects outbound HTTP requests exhibiting a User-Agent string hardcoded to mimic Firefox 20.0 (Mozilla/5.0 (Windows NT 6.2; rv:20.0) Gecko/20121202 Firefox/20.0), which is characteristic of the Adaptix C2 framework. This pattern is commonly used by adversaries for command-and-control communication.
Identifies anomalous requests to Microsoft TURN relays, potentially requesting anonymous visitor tokens. This rule looks for a high volume of network connections to 'turn.teams.microsoft.com' or 'relay.teams.microsoft.com' from processes other than the legitimate Microsoft Teams application, indicating potential abuse of the Teams infrastructure for malicious traffic tunneling.
Detects anomalous network communication patterns and file system changes indicative of SoftEther VPN usage, particularly when linked to processes masquerading as VMware or communicating with known malicious C2 infrastructure. The rule monitors for network connections on common SoftEther ports, connections to specific command-and-control IP addresses, and the creation of SoftEther configuration files like 'hamcore.se2' or 'vpn_bridge.config'.
This rule monitors for network connections that occur over non-standard ports (STUN, MQTT) or to specific suspicious IP addresses and domains, while excluding known legitimate user-facing applications. The detection aims to identify potentially malicious command and control (C2) communication or unauthorized network activity performed by non-standard processes.
Detects outbound network communication and DNS queries to cloud service endpoints (Google Cloud Pub/Sub, Azure MQTT, AWS IoT) originated by non-browser and non-cloud processes, which is a technique used by Grandoreiro banking trojan variants that side-load modules to tunnel command-and-control traffic.
Detects behavior patterns associated with the Grandoreiro banking trojan, specifically the use of wscript.exe or cscript.exe to execute VBScript files that perform geolocation checks against ip-api.com, followed by the dropping of an executable file in the user's AppData\Local directory.
Detects a web process modifying a .php file within WooCommerce paths, immediately followed by a DNS resolution for the 'generate.2faplugin.org' domain. This activity is indicative of the ShapedPlugin supply chain compromise where backdoored plugins are distributed, leading to file modification and subsequent communication with a malicious 2FA plugin domain.
Detects the execution of Nishang's Invoke-PowerShellTcp reverse shell payload. This rule monitors for PowerShell processes (powershell.exe or pwsh.exe) that execute suspicious command-line strings associated with the payload, or common obfuscation/execution patterns like iex/Invoke-Expression, accompanied by an outbound network connection to a non-standard port and non-internal IP address.
This rule detects outbound TLS connections to identified C2 infrastructure associated with the UAC-0226 threat actor and the GIFTEDCROOK malware, specifically by monitoring the certificate subject name 'NextGen Fusion'.
This rule detects potentially suspicious network connections originating from processes residing in common Git development directories (e.g., node_modules, temp, workspace) shortly after a Git clone, pull, or fetch operation. The detection logic filters for successful connections to non-private, non-whitelisted remote endpoints, which may indicate an adversary leveraging legitimate developer tools and environments for command-and-control (C2) or payload exfiltration.
Detects instances where PowerShell scripts execute code patterns indicative of AMSI (Antimalware Scan Interface) bypass techniques, followed closely (within 5 minutes) by a non-standard network connection (excluding ports 80/443) from the same process. This behavior is strongly associated with the execution of obfuscated payloads, such as reverse shells, attempting to evade security detection.
Page 141 of 190