Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,989 detections
Filters
Last updated
All Time
Detection languages
1,774
868
397
195
188
Contributors
1,070
924
756
221
96
Categories
2,448
1,307
1,164
785
713
Platforms
2,415
1,310
658
528
133
Products / Services
1,307
886
808
561
337
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
3,989
CVEs
6
5
5
5
5
IDS Classtypes
564
275
11
8
6
IDS Protocols
537
174
64
64
12
Detects known malicious file hashes associated with Miasma/Mini Shai-Hulud malware, as well as suspicious npm-lifecycle behaviors including binding.gyp shell execution, runtime staging of the Bun engine, and suspicious Bun-related downloads from GitHub.
Detects the execution of reconnaissance commands (whoami, ipconfig, net group) via PowerShell that also include either specific internal IP address patterns or curl-based exfiltration patterns, suggesting potential adversary activity.
Detects network activity initiated by PerfWatson2.exe communicating with known command-and-control (C2) IP addresses. PerfWatson2.exe is used as a masquerading process to blend in with legitimate Visual Studio telemetry traffic, a technique observed in TinyRCT C2 beaconing.
Detects potentially malicious activity involving the node.exe process. The rule identifies suspicious parent processes (PowerShell, cmd.exe, explorer.exe, wscript.exe), execution from non-standard user-writable directories (e.g., AppData, Temp), and network connections over non-standard C2 ports typically associated with TonRAT behavior.
This rule detects network connections to known malicious IP addresses or attempts to resolve specific domains associated with malicious activity. It monitors for outbound network traffic patterns identified as potential indicators of compromise (IOCs) linked to command and control (C2) servers.
This rule detects network activity involving connections to known malicious IP addresses or DNS domains ('govtop.one') and subsequent attempts to download specific suspicious file payloads, such as archives or image files often associated with malicious activity. This activity is indicative of potential command and control communication or initial malware ingress.
Detects endpoint activity associated with the Operation DragonReturn phishing campaign, including DNS resolution of known malicious domains, download of specific malicious ZIP archives, execution of extracted dropper files, and network communication with identified command-and-control infrastructure.
Identifies network connections made by Python immediately after loading safetensors or pickle files, indicating a potential supply chain payload phoning home. The rule joins file events where specific model file types (.safetensors, .pkl, .pth) are loaded with network connection events from the same initiating process within one minute of the file load. It specifically excludes local loopback connections.
Detects a phishing page upgrading to WebSocket or polling transport with Socket.IO event framing during authentication. This behavior is indicative of an adversary-in-the-middle (AiTM) attack, specifically associated with the 'Tycoon' threat activity.
Detects network connections where the user-agent string contains 'NSIS_InetLoad' and 'Mozilla', often indicative of a staged downloader. The rule also checks if the principal process is an executable and attempts to capture the user-agent from the URL or process command line.
Detects the deployment of MeshCentral remote management agents and associated outbound communication to suspicious C2 infrastructure, identified in environments compromised by ShinyHunters. This rule monitors for specific process execution patterns involving meshctrl.js and meshagent, alongside network connections to known C2 domains and IP addresses.
Detects a multi-stage npm supply chain compromise, often associated with Operation Friday Harvest or PostCSS typosquatting campaigns. The rule monitors for a sequence of 4 out of 5 behavioral stages on a single host within a 30-minute window: malicious postinstall script execution (npm/node spawning shells), staging of malicious payloads in temp directories, network connections to known command-and-control (C2) or payload-hosting infrastructure (e.g., GitHub, Telegram), execution of dropped binaries, and unauthorized access to sensitive credential files.
Identifies potential Neo-reGeorg webshell execution by correlating HTTP POST requests to Java Server Pages (.jsp/.jspx) with reflection events (defineClass) in system logs. This specific mechanism is utilized by Operation Escaneo (MexicanMafia) to load AES-encrypted, base64/BLV-encoded payloads in memory.
Detects use of Discord webhooks for covert C2 or data exfiltration
This rule detects network requests for specific URI paths and filenames ('css.js' or 'cf.js') known to be used by the ErrTraffic malware distribution framework for delivering ClickFix payloads. It identifies potential command and control (C2) infrastructure by grouping requests based on client IP, source IP, domain, destination IP, and URL.
This rule detects macOS.Gaslight C2 communication by identifying repeated HTTPS connections to api.telegram.org from non-browser processes. It specifically looks for patterns consistent with the Rust-based implant's getUpdates polling loop, as well as sendMessage and botattach patterns. The detection logic is split into EDR-side (DeviceNetworkEvents) and NDR-side (CommonSecurityLog) components, requiring a minimum of 3 connections/flows within an hour to trigger.
Correlates processes executing commands containing 'megalodon' with outbound network connections to a specific C2 IP address (216.126.225.129). This rule aims to detect data exfiltration or command and control communication associated with the Megalodon malware.
Identifies web server processes initiating network connections to the credential-stealing generate.2faplugin.org domain. This activity is indicative of a supply chain compromise targeting ShapedPlugin, where backdoored pro plugins are distributed via official channels, leading to data exfiltration.
Correlates the execution of the initial dropper script (setup.cjs) to the hardcoded C2 IPs, indicating potential compromise by the Mastra NPM malware.
Detects the execution of 'sysuu2etiprun.js', which is identified as the ChainShell blockchain C2 agent. This activity indicates potential command and control communication using a blockchain-based mechanism.
Detects outbound network connections to 'filev2.getsession.org', a known Miasma payload hosting and exfiltration domain. This domain has been associated with Miasma malware for command and control and data exfiltration activities.
Page 146 of 190