Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,989 detections
Filters
Last updated
All Time
Detection languages
1,774
868
397
195
188
Contributors
1,070
924
756
221
96
Categories
2,448
1,307
1,164
785
713
Platforms
2,415
1,310
658
528
133
Products / Services
1,307
886
808
561
337
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
3,989
CVEs
6
5
5
5
5
IDS Classtypes
564
275
11
8
6
IDS Protocols
537
174
64
64
12
Tracks browser network events fetching the dynamic malicious payload pipiteimosa.extension.js, specifically when initiated by Chrome or Microsoft Edge browsers. This activity is associated with the UnregStealer malware, which targets Brazilian banking credentials.
Detects PowerShell IEX validating the human-operated kill switch at the lnk1.txt endpoint, which is characteristic of the UnregStealer malware's communication with its C2 server.
Tracks browser network events where chrome.exe or msedge.exe are fetching a dynamic extension script named 'whitelist.extension.txt'. This activity is associated with the UnregStealer malware, which is known for human-operated browser credential theft.
This rule detects network connections initiated by 'bun.exe' to specific IP address ranges (94.154.172.0/24 or 91.195.240.0/24) that have been identified as malicious command and control (C2) infrastructure. This indicates potential compromise of a system where 'bun.exe' is being used for malicious communication.
Detects connections to a known XenoRAT C2 IP address (185.235.137.106) originating from processes other than common web browsers (mshta.exe, chrome.exe, msedge.exe). This aims to identify potentially injected shellcode or RAT processes establishing command and control communications.
This rule detects suspicious network connections originating from specific processes (DbgView64.exe or VirtualBox.exe) to Microsoft Teams TURN relay servers, where the RemoteUrl does not start with "teams.microsoft.com". This indicates potential protocol tunneling or an attempt to exfiltrate data or establish command and control through an unexpected channel, possibly leveraging Microsoft Teams infrastructure in an unauthorized manner. The use of DbgView64.exe or VirtualBox.exe as initiating processes for such connections is highly unusual and indicative of malicious activity.
Detects pythonw.exe establishing a connection to the Vidar C2 domains and sending a significant byte count, confirming credential exfiltration.
Detects network connections to known SmartApeSG backend domains (wigetticks.com, wizzleticks.com) or specific regex pattern 'okendo-reviews.js$' associated with SmartApeSG C2 infrastructure.
Detects C2 traffic using raw TCP/UDP without application layer protocols
Detects high-volume use of AI APIs potentially for generating attack content
Detects Sliver C2 framework based on default TLS certificate
Detects serverless function deployments used as C2 infrastructure
Detects a loader requesting a PHP payload with a generated host identifier and then writing a marker that prevents repeat delivery. This rule specifically looks for network connections initiated by executables like 'powershell', 'cmd', 'loader', or 'update' that include command-line arguments indicative of a PHP payload request with a unique identifier and a marker for single delivery.
This rule detects network traffic containing keywords commonly associated with Indian payment gateways and financial transactions (NEFT, RTGS, IMPS, GST, PAN, IFSC). This could indicate data exfiltration or suspicious activity involving financial information, potentially related to malware like Remcos RAT.
Detects HTTP C2 communication patterns associated with Remcos RAT loader by monitoring network events for specific URLs and known malicious IP addresses. This rule identifies outbound network connections to hardcoded malicious IPs and specific URL paths often used for command and control by Remcos.
This rule detects secondary Command and Control (C2) communication associated with the Remcos RAT loader. It identifies suspicious network connections to specific IP addresses, domains (including those often used by malicious actors like .bit, .onion, .su, .cc), and remote ports commonly utilized by Remcos.
This rule detects network connections made by Python or Node.js processes to known webhook API endpoints for Telegram or Discord. This behavior is often associated with command and control (C2) communication, where attackers use legitimate messaging platforms to control compromised systems or exfiltrate data.
Detects outbound HTTP communication using specific Tencent-themed API impersonation URI structures, which may indicate TencShell activity.
Inspects network connection URIs for the SKS= or MAP= parameters, which are used by the Showboat malware to initialize proxy tunnels. This rule specifically looks for these parameters in HTTP connection events.
Identifies the compromised ScreenConnect.ClientService.exe initiating network traffic to a known malicious command and control (C2) server associated with cryptojacking activities. The detection specifically looks for connections to 'directdownload.icu' or the IP address '193.42.11.108'.
This rule detects suspicious network connections originating from specific processes (DbgView64.exe or VirtualBox.exe) to Microsoft Teams TURN relay servers, where the RemoteUrl does not start with "teams.microsoft.com". This indicates potential protocol tunneling or an attempt to exfiltrate data or establish command and control through an unexpected channel, possibly leveraging Microsoft Teams infrastructure in an unauthorized manner. The use of DbgView64.exe or VirtualBox.exe as initiating processes for such connections is highly unusual and indicative of malicious activity.
Page 150 of 190