Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,989 detections
Filters
Last updated
All Time
Detection languages
1,774
868
397
195
188
Contributors
1,070
924
756
221
96
Categories
2,448
1,307
1,164
785
713
Platforms
2,415
1,310
658
528
133
Products / Services
1,307
886
808
561
337
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
3,989
CVEs
6
5
5
5
5
IDS Classtypes
564
275
11
8
6
IDS Protocols
537
174
64
64
12
Detects network communication behavior consistent with the TinyRCT backdoor. The rule identifies instances where a process named 'PerfWatson2.exe' attempts to establish HTTP GET or POST connections to a known malicious IP address (45.32.113.172), signaling potential C2 beaconing activity using an encrypted channel.
Detects outbound network connections initiated by the Windows Installer utility (msiexec.exe) to non-private (external) IP addresses over standard web ports (80/443). Msiexec.exe can be abused to download and execute malicious payloads or packages from remote locations.
Detects native Windows command and scripting interpreters (e.g., cmd.exe, powershell.exe, mshta.exe) initiating external network connections to multiple distinct IP addresses, which is often an indicator of automated C2 beaconing or lateral movement activity.
Detects outbound network connections to common Azure-related domains originating from suspicious file paths such as Temp, Downloads, or AppData subdirectories. This behavior is indicative of potential malware or unauthorized scripts executing from temporary user locations to reach out to cloud infrastructure.
Detects the usage of curl.exe routing traffic through a local SOCKS5 proxy on port 9050, a behavior observed in CryptoBandits malware communicating with a bundled Tor client to hide its Command and Control (C2) destination.
Detects suspicious PowerShell processes initiated by common non-terminal applications (e.g., browser, office, script hosts) that perform in-memory code execution (using commands like IEX or System.Reflection) and simultaneously establish rapid network connections to multiple distinct external IP addresses within a one-minute window. This behavior is indicative of a staged payload download or beaconing activity.
Detects network connection activity originating from a host to the hardcoded IP 62.102.148.212 on port 37393, which is identified as a command and control (C2) endpoint for Remcos RAT. This communication is often associated with process hollowing where the malware hides within legitimate browser processes.
Detects execution of processes originating from memory-only file descriptors (memfd) or the /proc/self/fd/ path, indicating fileless execution techniques often used by malware like MYRA RAT. This behavior is correlated with outbound network connections on port 4444 within a 2-minute window, which is indicative of command-and-control (C2) communication.
Detects outbound network connections to common MQTT ports (1883, 8883) initiated by living-off-the-land binaries, command interpreters, or unknown processes. This behavior may indicate an attacker using MQTT as a covert C2 channel to bypass network filtering by mimicking legitimate IoT protocol traffic.
This rule detects the execution and network activity of known Remote Monitoring and Management (RMM) tools such as AnyDesk, TeamViewer, and ScreenConnect. It assigns a risk score based on whether the activity occurs outside of defined business hours (8 AM - 6 PM) and whether the tool is initiating an outbound connection on port 443, a common pattern for C2 communication.
Detects instances where VS Code extension-related processes (such as amazonq-lsp or extensionHost) spawn shell processes (bash/sh) that subsequently initiate network activity via curl or wget. This pattern is indicative of potential exploitation where malicious workspace configuration files (e.g., .amazonq/mcp.json) are used to execute shell commands with unauthorized access to cloud credentials.
This rule detects suspicious WebSocket upgrade attempts targeted at Microsoft authentication endpoints, typically used by 'Bluekit' or similar Phishing-as-a-Service (PhaaS) platforms to establish a persistent connection or tunnel for credential harvesting via adversary-in-the-middle attacks. It flags traffic from non-private IP addresses that exhibit specific patterns associated with proxy usage or automated tooling (e.g., Python/curl) combined with WebSocket upgrade headers.
This rule monitors DeviceNetworkEvents for outbound network connections to a specific IP address (142.111.194.73), destination port (8640), or URL path (/dj5FZEiLnA/) associated with the 'GiftedCrook' command and control infrastructure.
This rule monitors DeviceNetworkEvents for outbound network connections to a specific IP address (142.111.194.73), destination port (8640), or URL path (/dj5FZEiLnA/) associated with the 'GiftedCrook' command and control infrastructure.
Detects potential browser fingerprinting and network reconnaissance behavior associated with Bluekit BitM PhaaS campaigns. The rule correlates large suspicious JavaScript file downloads (excluding common CDNs) with STUN server connectivity within a 10-minute window, a pattern often used by adversary-in-the-middle (AiTM) frameworks to fingerprint victims and establish WebRTC channels.
This rule detects suspicious WebSocket upgrade attempts targeted at Microsoft authentication endpoints, typically used by 'Bluekit' or similar Phishing-as-a-Service (PhaaS) platforms to establish a persistent connection or tunnel for credential harvesting via adversary-in-the-middle attacks. It flags traffic from non-private IP addresses that exhibit specific patterns associated with proxy usage or automated tooling (e.g., Python/curl) combined with WebSocket upgrade headers.
Detects network connection activity on common C2 ports from processes executing outside of standard system directories. The rule filters out known system paths on macOS and identifies processes that establish multiple connections to non-private IP addresses, assigning a risk score based on the volume of connections and the duration of the activity to identify potential command and control (C2) beaconing behavior.
Detects explorer.exe making DNS requests to Discord or Telegram, which is anomalous and indicates potential process injection for data exfiltration. This behavior is associated with information stealer malware like Phantom Stealer.
Detects various indicators associated with the SilverFox loader deploying the Sauron RAT, including registry markers, service creation, self-copying of svchost.exe, specific marker file artifacts, and known C2 communication.
Detects suspicious activity indicative of CryptoBandits malware, specifically JScript stealer polling the clipboard and beaconing actions. This rule identifies instances where wscript.exe or cscript.exe spawn clip.exe (for clipboard access), curl.exe (for C2 communication via Tor SOCKS5 with specific keywords like 'REPL', 'SEED', 'PKEY'), or cmd.exe within a staging directory like 'Public\Documents'. It also looks for specific filenames in the command line such as 'exefu.js', 'ofolu.js', 'words.txt', or 'ugate.exe'.
Detects suspicious WebSocket connections initiated by AutoGen Studio processes to localhost on ports 8080 or 8081, indicative of the AutoJack exploit chain bypassing loopback trust boundaries. This rule specifically looks for Python processes associated with 'autogenstudio' making these connections or for network events where the RemoteUrl contains 'ws://localhost', 'ws://127.0.0.1', '/api/mcp/ws/', or 'server_params='.
Page 142 of 190