Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,989 detections
Filters
Last updated
All Time
Detection languages
1,774
868
397
195
188
Contributors
1,070
924
756
221
96
Categories
2,448
1,307
1,164
785
713
Platforms
2,415
1,310
658
528
133
Products / Services
1,307
886
808
561
337
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
3,989
CVEs
6
5
5
5
5
IDS Classtypes
564
275
11
8
6
IDS Protocols
537
174
64
64
12
Identifies network connections to specific Azure-hosted authentication brokers used by the jupyter-powerdev malware to retrieve Graph API tokens for its SharePoint C2 channel. This rule specifically looks for connections to known malicious broker domains or a known associated IP address.
This rule detects potential Trickbot malware command and control (C2) communication by identifying network connections to specific remote URLs and ports commonly associated with Trickbot activity. It looks for multiple connections within an hour from the same device to these indicators.
This rule detects instances where 'wscript.exe' or 'cscript.exe' (VBScript interpreters) initiate processes that attempt to download files from the internet (HTTP, HTTPS, FTP) or from network shares, or execute common system utilities often used for file transfer or execution like 'net.exe', 'certutil.exe', or 'bitsadmin.exe'. This pattern is indicative of multi-stage VBScript loaders often used in phishing campaigns to retrieve and execute further malicious payloads.
Detects C2 traffic impersonating legitimate service protocols
Detects upload of offensive security tools to cloud storage for staging
This rule detects an unusually high number of downloads of files identified as 'octet-stream' or 'executable' from a single IP address within a one-hour window, based on W3CIISLog data. This behavior could indicate various malicious activities, including the distribution of malware, data exfiltration, or the use of a compromised web server for command and control.
SniperDz Domain IOCs
Cortex XDR
Detects network connections or DNS queries to known domain names associated with the SniperDz core monetization and redirection infrastructure. This rule specifically looks for traffic to 'win.feezossl.xyz', 'win.anababayala.com', 'aff.bnaosf1he.shop', and 'offer.raviral.com' in DNS query names or HTTP network metadata.
This rule detects PowerShell processes attempting to retrieve or execute remote .rtf resources via web requests. It specifically looks for `powershell.exe` or `pwsh.exe` in the process path combined with command-line arguments indicating `Invoke-WebRequest`, `iwr`, `DownloadString`, `Invoke-Expression`, or `iex` targeting a URL ending in `.rtf`.
Targets JSON-RPC eth_call usage by a non-browser process for dynamic command or address resolution. The UDM rule retains principal and target context for correlation.
Targets JSON-RPC eth_call usage by a non-browser process for dynamic command or address resolution. The UDM rule retains principal and target context for correlation.
Detects highly obfuscated PowerShell command lines that utilize various encoding and execution techniques, often indicative of malicious activity. The rule scores different obfuscation methods (XOR, Hex, Base64), execution methods (ScriptBlock, IEX), and payload indicators (URLs, download functions). A high total score and specific thresholds for execution and obfuscation trigger the alert. It also considers suspicious parent processes like browsers or scripting hosts.
Blockchain eth_call Command Resolution
Cortex XDR
This rule detects JSON-RPC 'eth_call' usage originating from a non-browser process, which could indicate dynamic command or address resolution related to blockchain interactions. The XQL view retains actor and causality fields to aid in investigation.
Token and tick payload URL structure
Cortex XDR
This rule detects network connections where the URL or remote IP address matches a specific pattern indicative of short-lived downloader URLs. These URLs typically contain paired tokens, numeric ticks, and a signature timestamp, often associated with malware distribution ecosystems. The rule leverages XQL to retain actor and causality fields for further investigation.
Generalized advanced detection for DLL sideloading from unprotected directories (Downloads, Temp, Public) followed by network beaconing. This rule identifies specific DLLs (autorun.dll, UnityPlayer.dll, UpdateChecker.dll, uevmonitor.dll) being loaded from these suspicious locations and then initiating network connections.
Detects PowerShell initiating web requests specifically for .jpeg files, a core component of the staging phase of the SilentCanvas operation.
Detects curl.exe spawned by the batch dropper fetching data.json from known C2 endpoints. This rule correlates process creation events for curl.exe with network connection events to specific C2 domains (kak.is, goingg.is) when 'data.json' is present in the command line.
Correlates the execution of the dropped Synaptics.exe with active outbound network connections, indicative of DarkKomet malware beaconing.
This rule detects PowerShell processes executing 'Invoke-WebRequest' (IWR) or 'IEX' (Invoke-Expression) commands that establish network connections to the domain 'wigetticks.com'. This combination indicates potential adversary activity involving downloading and executing malicious content from a specific attacker-controlled infrastructure, as identified in the SmartApeSG campaign.
This rule detects a sequence of events where a network connection to a specific URL pattern ('ey.php') is followed within one hour by the execution of a process named 'Synaptics.exe'. This behavior is indicative of the Steam Wallpaper malware, where an initial C2 ping by a wrapper leads to the execution of a subsequent payload.
Correlates the execution of a JavaScript file with a 24-hex-character name (e.g., 'a1b2c3d4e5f6a7b8c9d0e1f2.js') with an active outbound network connection to the 23.254.164.x subnet. This pattern is indicative of the Mastra NPM supply chain compromise, where malicious JavaScript is executed and attempts to communicate with a command and control server.
This rule detects the execution of 'pythonw.exe' from the AppData\Local folder, which then initiates network connections to known Vidar C2 domains (brokeapt.com, pan.ssffaa19.xyz, pan.rongtv.xyz). This behavior is indicative of the Vidar stealer malware, often distributed via social engineering campaigns leveraging AI brands as bait.
Page 151 of 190