Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,989 detections
Filters
Last updated
All Time
Detection languages
1,774
868
397
195
188
Contributors
1,070
924
756
221
96
Categories
2,448
1,307
1,164
785
713
Platforms
2,415
1,310
658
528
133
Products / Services
1,307
886
808
561
337
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
3,989
CVEs
6
5
5
5
5
IDS Classtypes
564
275
11
8
6
IDS Protocols
537
174
64
64
12
This rule detects suspicious network activity related to Tailscale mesh VPN and DuckDNS, specifically looking for resolutions of 'tailscale.com', 'wawsenti.duckdns.org', or 'duckdns.org' via DNS events, and network flow to known C2 IPs (217.154.217.139, 217.154.162.45), or traffic on UDP port 41641 within the Tailscale IP range (100.64.0.0/10). It also flags connections to 'wawsenti.duckdns.org' or any 'duckdns.org' domain in network flow data. The rule aims to identify potential C2 communications or unauthorized use of VPN services.
Detects suspicious network connections originating from processes within the AppData\Roaming folder to common web ports (80, 443), or any connection to the domain 'birdeemusic.com'. This pattern is often associated with malware establishing command and control (C2) communication or data exfiltration, especially when originating from non-browser processes.
This rule detects network connections initiated by VBScript (wscript.exe or cscript.exe) to external IP addresses. This behavior can be indicative of malicious VBScript execution attempting to communicate with command and control servers or exfiltrate data, often associated with phishing attacks.
This rule correlates multiple suspicious activities indicative of ransomware or destructive attacks. It detects a combination of volume shadow copy deletion, bulk file modifications, creation of suspicious scheduled tasks, and network connections occurring during periods of high file write activity. The rule triggers when multiple signals are observed or when specific high-fidelity destructive indicators are present.
Detects a specific beaconing pattern associated with Fog Ransomware, characterized by a non-browser process making OAuth2 token requests to Google accounts followed by Drive/Sheets API calls, correlated with the deletion of volume shadow copies (VSS) for recovery inhibition.
This rule detects potentially suspicious outbound network connections or DNS queries to known Generative AI service domains (OpenAI, Anthropic, Google, Mistral, Cohere) from non-browser and non-developer processes. It also triggers on suspicious Windows binaries (e.g., PowerShell, bitsadmin, mshta) initiating external connections to these domains or other destinations over port 443, helping identify potential data exfiltration or automated abuse of LLM APIs.
This rule detects a specific typosquatting pattern used by the EvilTokens phishing kit. It looks for HTTP traffic where the host contains 'workers.dev' and matches a regular expression for 'viewdoc[a-z0-9\-]+\.workers\.dev'. This indicates an attempt to mimic legitimate Cloudflare Workers domains for phishing purposes, specifically targeting the 'viewdoc' pattern often seen in document-sharing lures.
This rule detects network connections to known IP addresses associated with FortiBleed activity, including C2, pentest labs, credential validation, and sniffer nodes. It identifies both successful connections and connection attempts.
This rule detects network communication associated with the 'easy-day-js Mastra npm Supply Chain' compromise. The first alert identifies C2 exfiltration attempts over TLS to a specific IP address (23.254.164.123) on port 443. The second alert identifies a stage-2 payload download from another specific IP address (23.254.164.92) on port 8000, specifically looking for the URI '/update/49890878'. These indicators are linked to the 'protocal.cjs' and 'setup.cjs' malware, respectively, and are part of a supply chain attack.
This rule detects network activity associated with the Hashtopolis agent. Specifically, it looks for the string "hashtopolis" within the HTTP User-Agent header of traffic flowing from a client to a server. This activity is linked to the 'FortiBleed campaign', which involves distributed offline cracking of SHA-256 FortiGate administrator credential hashes.
This rule detects potentially malicious software supply chain attacks by identifying suspicious child processes spawned by package managers (pip, npm) or Python scripting engines within a short timeframe. It specifically looks for shells (cmd, powershell, bash, etc.) being invoked immediately after a package installation or script execution, and correlates this activity with suspicious outbound network connections originating from these processes.
Detects HTTP network connections to the specific URI path and parameters used by the OnyxC2 stealer for C2 beaconing and data exfiltration.
Detects network connections where the user-agent string contains 'NSIS_InetLoad' and 'Mozilla', often indicative of a staged downloader. The rule also checks if the principal process is an executable and attempts to capture the user-agent from the URL or process command line.
This rule detects continuous outbound HTTPS beaconing from the TiFlux RMM agent to its central cloud infrastructure. It identifies processes with names matching 'tiflux.*.exe' making frequent connections to domains ending in '.tiflux.com', '.tiflux.io', or '.tiflux.net' on port 443, with more than 10 beacons within a 10-minute window.
Detects potential Cobalt Strike Beacon behavior where a process originating from AppData or ProgramData injects into a legitimate Windows process (e.g., svchost.exe, explorer.exe, notepad.exe, msiexec.exe). This is followed by the injected host process establishing an outbound HTTPS network connection to an external, non-RFC1918 IP address within 60 seconds.
Detects the SNOWLIGHT dropper creating a malicious Windows Service masquerading as the legitimate 'Windows Update Service' (wusvc), followed by outbound TLS network connections to non-Microsoft infrastructure within a 2-minute window. This behavior is indicative of C2 communication from a compromised system.
This rule detects anomalous network communication patterns that might indicate Command and Control (C2) activity. It identifies devices making at least 5 connections within a 10-minute window to common web/HTTPS ports (443, 8443, 8080) where the initiating process is not a standard web browser (chrome.exe, firefox.exe, iexplore.exe, msedge.exe). This pattern can suggest non-browser applications establishing frequent connections to C2 servers.
Detects network connection activity originating from the Windows Update service process (wusvc.exe) to a known C2 IP address (38.60.253.35) on port 8084. This pattern is indicative of VSHELL RAT communication, potentially using masquerading to hide its network activity.
Detects anomalous network connections to HTTP/S ports (80, 443, 8080) by suspicious processes (e.g., Python, Netcat, Socat) or those executing known tunneling/web shell scripts (Neo-reGeorg, Chisel). This rule identifies potential egress-blocked environment bypass attempts by monitoring for high-frequency outbound connections that deviate from standard browser or signed-application behavior.
Detects outbound network connections to specific known malicious egress IP addresses associated with Operation Escaneo, utilizing the Wget user agent to request the '/pwned' resource over port 8888, indicative of SOCKS5-tunneled data exfiltration.
Detects HTTP network connections to the specific URI path and parameters used by the OnyxC2 stealer for C2 beaconing and data exfiltration.
Page 143 of 190