Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,989 detections
Filters
Last updated
All Time
Detection languages
1,774
868
397
195
188
Contributors
1,070
924
756
221
96
Categories
2,448
1,307
1,164
785
713
Platforms
2,415
1,310
658
528
133
Products / Services
1,307
886
808
561
337
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
3,989
CVEs
6
5
5
5
5
IDS Classtypes
564
275
11
8
6
IDS Protocols
537
174
64
64
12
Detects Node.js initiating network connections over port 2222. This activity is associated with the Miasma botnet, which uses port 2222 as a fallback C2/SSH channel when standard ports are blocked.
Detects network traffic to the malicious domain web-telegram[.]ug, which is indicative of Command and Control (C2) communication.
This rule detects network connections where the remote URL contains keywords commonly associated with financial transactions or sensitive financial information, such as 'neft', 'rtgs', 'imps', 'gst', 'pan', and 'ifsc'. This could indicate data exfiltration, unauthorized access to financial systems, or other malicious activities targeting financial data.
Detects unusual FTP command sequences where common file listing commands (LIST, NLST, MLSD) are used without specifying a filename parameter, and the RemoteUrl length is unusually short, potentially indicating reconnaissance or an attempt to exploit a vulnerability like Squidbleed. The rule specifically excludes common file extensions to reduce false positives.
This rule detects network connections from devices to a list of known malicious domains. These domains are associated with various threats including phishing, C2 beacons, data exfiltration, ransomware, cryptominers, and credential harvesting. The rule aggregates connections by remote URL and time, flagging any domain with at least one connection.
Detects Sliver C2 framework based on default TLS certificate
This rule detects PowerShell processes attempting to retrieve or execute remote .rtf resources via web requests. It specifically looks for `powershell.exe` or `pwsh.exe` in the process path combined with command-line arguments indicating `Invoke-WebRequest`, `iwr`, `DownloadString`, `Invoke-Expression`, or `iex` targeting a URL ending in `.rtf`.
NSIS InetLoad downloader user agent
Cortex XDR
This rule detects the distinctive 'NSIS_InetLoad Mozilla' user-agent string, which is commonly used by staged downloaders. It specifically targets network events where the process image name ends with '.exe' and either the event subtype or the remote IP contains the 'NSIS_InetLoad Mozilla' string. The rule aims to identify the initial stages of malware delivery and execution, providing causality fields for investigation.
Detects suspicious execution of command-line tools like curl, wget, or PowerShell to query OAuth/token-related endpoints (e.g., /token, oauth, access_token). The rule filters out expected parent processes (e.g., shells, IDEs, common build tools) to identify potentially malicious attempts to steal application access tokens.
Detects outbound network connections to common MQTT ports (1883, 8883) initiated by living-off-the-land binaries, command interpreters, or unknown processes. This behavior may indicate an attacker using MQTT as a covert C2 channel to bypass network filtering by mimicking legitimate IoT protocol traffic.
This rule detects outbound network connections to 'minemine.gleeze.com' on port 8443 originating from specific .NET utility processes (InstallUtil.exe, RegAsm.exe, MSBuild.exe). This activity is indicative of cryptojacking, specifically a campaign abusing ScreenConnect and .NET utilities for GPU mining, as described in the referenced Microsoft blog.
Detects the disguised SoftwareLicencing.exe reaching out to external networks rather than internal KMS servers, as observed in the 'Screening Serpens' campaign attributed to Iranian APT groups.
Identifies network traffic to the attacker logging server endpoint ey.php initiated by the wrapper ._cache_GAME1.exe, which is associated with malicious Steam wallpapers.
This rule detects continuous C2 beaconing activity associated with Matanbuchus malware. It specifically looks for network connections originating from 'svchost.exe' or 'dllhost.exe' to common web ports (80, 443, 8080) with a high frequency (more than 10 beacons) within a 5-minute window. This behavior is indicative of a hollowed process establishing command and control communication.
Detects outbound network connections to common MQTT ports (1883, 8883) initiated by living-off-the-land binaries, command interpreters, or unknown processes. This behavior may indicate an attacker using MQTT as a covert C2 channel to bypass network filtering by mimicking legitimate IoT protocol traffic.
End-to-end correlation: Fake AI installer executes -> Drops pythonw.exe -> Network connection to Vidar C2.
This rule detects the creation of a '.pkg_history' file, which is a known indicator of the Mastra NPM supply chain compromise, followed by a network connection to specific command and control (C2) IP addresses (23.254.164.123 or 23.254.164.92) within a 5-minute window on the same device. This correlation aims to identify successful exploitation and subsequent C2 communication by the Mastra NPM malware.
Identifies HTTP connections exhibiting Kazuar's distinct long, deeply nested URL path structures mimicking legitimate API endpoints. The rule specifically looks for URLs matching the pattern /api/v[1-3]/[a-z]+/[a-z]+/[a-f0-9]{32}/, which indicates a versioned API path followed by two alphabetical segments and a 32-character hexadecimal string, characteristic of Kazuar C2 beaconing.
Detects the secondary PowerShell payload establishing a persistent WebSocket connection to a randomly generated endpoint structure.
Detects a module changing protocol, destination class, or cloud service after repeated failed connections on its primary channel. This behavior is indicative of malware like Kazuar attempting to establish C2 communication through alternative means when its initial attempts fail.
This rule monitors for indicators associated with MiniUpdate/MiniJunk V2 RAT and general .NET AppDomainManager hijacking. It detects suspicious registry keys (AppDomainManagerAssembly/Type) or environment variable manipulation used to hijack .NET application execution flow. Additionally, it identifies .NET host processes loading DLLs from user-writable directories (e.g., AppData, Temp) and tracks suspicious beaconing patterns to known Azure CDN domains often used by these threats for Command and Control.
Page 147 of 190