Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,989 detections
Filters
Last updated
All Time
Detection languages
1,774
868
397
195
188
Contributors
1,070
924
756
221
96
Categories
2,448
1,307
1,164
785
713
Platforms
2,415
1,310
658
528
133
Products / Services
1,307
886
808
561
337
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
3,989
CVEs
6
5
5
5
5
IDS Classtypes
564
275
11
8
6
IDS Protocols
537
174
64
64
12
Detects outbound network connections to remote URLs containing keywords associated with blockchain, cryptocurrency, or Web3 technologies. This behavior may indicate an adversary utilizing blockchain services or decentralised infrastructure for command and control (C2) communication, exfiltration, or proxying.
Detects network traffic associated with known Cobalt Strike Beacon request URI patterns. This rule utilizes network signature inspection to flag outbound connections containing URI fragments commonly used by Cobalt Strike default profiles.
Detects processes attempting to exfiltrate data over a Telegram C2 channel by making network connections to api.telegram.org or t.me, excluding legitimate Telegram client binaries and common web browsers. This behavior is characteristic of Vidar Stealer and other Malware-as-a-Service (MaaS) stealers.
Detects a DAEMON Tools helper process launching cmd.exe and PowerShell with WebClient or DownloadFile methods. The process ancestry is unusual for disk-emulation software and matches the compromised update chain.
Detects outbound web requests to Bing's 'Search by Image' endpoint where the embedded image URL points to a non-Microsoft domain. This mechanism is used in the SearchLeak attack (CVE-2026-42824) to bypass CSP and exfiltrate data from Microsoft 365 Copilot.
This rule detects network connections from endpoints to a list of known malicious domains. The detection is further refined by looking for specific URL paths such as '/wlc/', '/load/', or 'success/', which are commonly associated with command and control (C2) communication or data exfiltration activities by malware. This indicates potential compromise and active communication with adversary infrastructure.
Detects HTTP C2 communication patterns associated with Remcos RAT loader by monitoring network events for specific URLs and known malicious IP addresses. This rule identifies outbound network connections to hardcoded malicious IPs and specific URL paths often used for command and control by Remcos.
This rule detects network connections from common user applications (explorer.exe, outlook.exe, word.exe) to specific remote ports (8080, 443, 445) where the remote URL contains known Emotet indicators. This helps identify potential Emotet malware command and control (C2) or dropper activity.
Detects Node.js initiating connections over port 2222. This is used by the Miasma botnet as a fallback C2/SSH channel when standard ports are blocked.
Detects node.exe spawning curl or wget pointing directly to the hardcoded C2 IPs (94.154.172.43, 91.195.240.123) indicating stage 2 download.
Detects VS Code Remote Tunnel being abused as a covert C2 channel
Detects browser connections to the Bing Search by Image endpoint, which can be exploited as an SSRF proxy to bypass Content Security Policies (CSP) and exfiltrate data, as seen in the SearchLeak attack.
Google Threat Intelligence Group (GTIG) has identified a sophisticated campaign attributed to UNC6508, a People's Republic of China (PRC)-nexus threat actor, targeting institutions in the North American academic, medical, and military research community. While remaining undetected for over a year, the threat actor compromised externally facing web applications, deployed bespoke malware, pivoted to sensitive internal systems, and abused enterprise administrative tools for covert data exfiltration. The threat actor had broad collection aspirations, including sensitive defense intelligence related to national security, Indo-Pacific command operations, artificial intelligence, uncrewed vehicle systems, cyber offensive programs, and medical research.
Detects the use of PowerShell with 'Invoke-WebRequest' to download trojanized installers (MicrosoftEdgeSetup.exe, ChromeSetup.exe, MSTeamsSetup.exe) from malicious domains like 'apple-online.shop' or 'trycloudflare.com', as observed in Interlock activity leveraging JunkFiction.
Detects outbound network communication originating from potential VILE ransomware processes. The rule monitors for suspicious Go-based HTTP clients using specific User-Agents (Go-http-client/2.0 or 1.1) initiating network connections to remote ports 80 or 443 with JSON payloads, while explicitly excluding common web browsers and internal RFC-1918 network ranges.
EchoCreep Sends an Up Success Check-In
Cortex XDR
Detects a Go backdoor or renamed service process emitting the distinctive 'Up Success' runtime message used during Discord channel check-in. This rule specifically looks for network events where the process name matches common system processes (searchapp, service, update) and the command line contains 'Up Success'.
Detects an iox-derived proxy process generating a key and initialisation vector while configuring hard-coded forwarding settings. This behavior is indicative of the SmuxProxy malware, which is known to use these techniques for encrypted communication and data forwarding.
Detects network activity initiated by the 'PerfWatson2.exe' process, which is associated with the TinyRCT .NET backdoor, communicating with a known malicious C2 IP address (45.32.113.172). The rule monitors for network connections from this specific binary to the identified infrastructure, indicative of beaconing or command and control activity.
Detects the execution of the XDRAgent process with command-line arguments indicative of a reverse shell connection to a specific remote IP address and port.
Detects anomalous execution of the Bun runtime on CI/CD infrastructure, often associated with the 'Miasma/Mini Shai-Hulud' campaign. The rule monitors for unauthorized Bun process creation spawned by Node.js package management tools (likely via binding.gyp lifecycle hooks), execution using specific campaign-related command-line arguments, or network activity initiated by Bun on non-standard paths, which may indicate build-time compromise and subsequent C2 communication.
Detects anomalous network communication with a known C2 domain associated with the Miasma worm, or attempts by JavaScript runtime processes (node, bun) to access sensitive developer-related files (SSH keys, cloud credentials, browser data) without an authorized IDE parent process.
Page 145 of 190