Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,989 detections
Filters
Last updated
All Time
Detection languages
1,774
868
397
195
188
Contributors
1,070
924
756
221
96
Categories
2,448
1,307
1,164
785
713
Platforms
2,415
1,310
658
528
133
Products / Services
1,307
886
808
561
337
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
3,989
CVEs
6
5
5
5
5
IDS Classtypes
564
275
11
8
6
IDS Protocols
537
174
64
64
12
Detects potential RondoDox botnet infection attempts by monitoring for the execution of common command-line tools (wget, busybox, curl) using specific flags (-qO-, -s) to download and pipe remote scripts from the known C2 IP 45.92.1.50 directly into a shell interpreter for execution.
Detects Python transmitting a newly created archive or JSON collection through requests, urllib, aiohttp, or a custom socket. This behavior is associated with the InvisibleFerret malware.
Detects outbound network connections to 'seed1.getsession.org', a known Miasma Command and Control domain. This rule specifically looks for network events where the remote URL contains this domain, indicating potential C2 communication.
Detects a proxy process constructing forwarder-client identifiers and asynchronous queues for bidirectional web socket tunnelling, indicative of WormSocket or similar malware activity.
Detects Graph API or SharePoint activity interacting with specific lists or a site GUID used by the jupyter-powerdev backdoor for Command and Control (C2) operations. This activity is indicative of the jupyter-powerdev malware leveraging SharePoint as a C2 channel.
Analyzes HTTP request headers to detect GammaLoad's unique User-Agent beacon containing the computer name and date format string.
Detects unique INFINITERED marker strings in process command lines or event metadata. The indicators include the upgrade-code GUID delimiter, its Base64 representation, the stolen-session identifier prefix, and the custom file-download command tag. These values are specific to the reported malware and should be treated as high-confidence evidence when present.
This rule detects network connections to AzureWebsites (specifically '.azurewebsites.net') where the URI path matches patterns used by the Nimbus Manticore implant for command and control polling or initialization. The patterns include '/agent/poll?token=' or '/agent/init' or '/agent/result'. This indicates potential communication with a Manticore implant hosted on an Azure web app.
Detects modern systems generating HTTP traffic using a hardcoded, outdated Internet Explorer 8 User-Agent string, a static artifact of the loader's C2 channel. This specific User-Agent string is 'MSIE 8.0; Windows NT 6.0; WOW64; Trident/4.0'.
Uses regex to identify CastleLoader's highly specific URI structure, which utilizes hardcoded UUIDs mapped to t#, scr#, or callback# task endpoints.
Detects the legitimate Microsoft .NET build component MSBuild.exe initiating outbound network connections to public IP addresses. This activity is a known LOLBin technique for establishing command and control (C2) or exfiltrating data. Threat actors have been observed abusing MSBuild.exe for host reconnaissance data exfiltration and C2 communications.
This rule detects network connections from common user applications (explorer.exe, outlook.exe, word.exe) to specific remote ports (8080, 443, 445) where the remote URL contains known Emotet indicators. This helps identify potential Emotet malware command and control (C2) or dropper activity.
Detects outbound network connections to the attacker-controlled infrastructure
used in the June 2026 Mastra npm supply chain attack (easy-day-js campaign).
IP 23.254.164.92 served the second-stage payload; 23.254.164.123 was the C2
exfiltration server for the cross-platform infostealer.
used in the June 2026 Mastra npm supply chain attack (easy-day-js campaign).
IP 23.254.164.92 served the second-stage payload; 23.254.164.123 was the C2
exfiltration server for the cross-platform infostealer.
Detects several related module processes on one host while a single process accounts for all external network connections. This behavior is indicative of the Kazuar malware, which uses a botnet-like structure where one 'leader' process handles C2 communications.
Detects network connections initiated by 'RunSearch.exe' on port 443, which is indicative of Potemkin malware using cpp-httplib for command and control (C2) communication.
Detects outbound network connections initiated by Electron or Node.js processes that are launched from non-standard subdirectories within the AppData\Local path. This rule specifically excludes common legitimate applications like Microsoft programs, Slack, and Discord. The detection aims to identify potentially malicious Electron or Node.js applications attempting C2 communication or other unauthorized network activity from an unexpected location.
Detects outbound network connections initiated by Electron or Node.js processes that are launched from non-standard subdirectories within the AppData\Local path. This rule specifically excludes common legitimate applications like Microsoft programs, Slack, and Discord. The detection aims to identify potentially malicious Electron or Node.js applications attempting C2 communication or other unauthorized network activity from an unexpected location.
Udm Mail Raw Ip Https
YARA-L
This rule detects network connections made by processes commonly associated with mail collection, archiving, or data export (e.g., mail, archive, collector, export, rclone, winscp, curl executables). The detection specifically looks for these processes making HTTPS connections where the command line contains keywords related to email data files (.pst, .ost) or email processing (aspose.email, mailbox). The rule aims to identify potential exfiltration or collection of email data over HTTPS.
Detects Cobalt Strike beacon default HTTP checkin pattern
Detects transmission of a bitmask representing environment checks to the C2.
This rule detects network connections from devices to a list of known malicious domains. These domains are associated with various threats including phishing, C2 beacons, data exfiltration, ransomware, cryptominers, and credential harvesting. The rule aggregates connections by remote URL and time, flagging any domain with at least one connection.
Page 149 of 190