Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,989 detections
Filters
Last updated
All Time
Detection languages
1,774
868
397
195
188
Contributors
1,070
924
756
221
96
Categories
2,448
1,307
1,164
785
713
Platforms
2,415
1,310
658
528
133
Products / Services
1,307
886
808
561
337
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
3,989
CVEs
6
5
5
5
5
IDS Classtypes
564
275
11
8
6
IDS Protocols
537
174
64
64
12
Detects automated scraping of staff and employee directory pages
Detects potential WordPress malware activity that abuses Steam Community profile comments as a command-and-control (C2) channel. The malware retrieves encoded payloads hidden in Steam profile comments using invisible Unicode characters, decodes malicious URLs, and downloads additional JavaScript payloads. This rule identifies outbound connections from WordPress servers to Steam Community URLs or known malicious infrastructure associated with this campaign.
Detects connections to domains associated with observed ACR Stealer command-and-control infrastructure.
Flags HarborWatch RAT C2 traffic from mysql.exe to known malicious IPs.
This rule identifies web traffic containing the custom User-Agent string 'HarborWatchAgent', which is indicative of Command and Control (C2) communication by the HarborWatch Agent. It searches both endpoint network events and network appliance/proxy logs for this specific User-Agent string.
Privnote DNS Resolution
Cortex XDR
Identifies endpoints resolving privnote.com, a self-destructing message service abused by UNC3753 to transmit malicious installation links while bypassing chat and email filtering.
cURL Request to Raw IP for Installer
Cortex XDR
Detects cURL making direct HTTP requests to raw IPv4 addresses specifically seeking 'installer' binaries. This staging pattern is utilized by UNC3753 to deploy RMM payloads on victim machines.
Detects HTTP requests utilizing a specific, highly verbose, and legacy Internet Explorer 8 User-Agent string. This exact hardcoded string is utilized by a fileless .NET loader (originating from a malspam campaign) to download subsequent payload stages from its staging server.
Flags HarborWatch RAT C2 traffic from mysql.exe to known malicious IPs.
Detects outbound network activity to the known malicious domain sfrclak.com or IP address 142.11.206.73. This behavior may indicate malware beaconing, command-and-control communication, or interaction with attacker-controlled infrastructure.
Detects unusual network traffic over TCP port 886, which is specifically used by Atlas RAT for command and control check-ins and encrypted data exfiltration in recently observed TA4922 campaigns.
This rule detects high-volume data exfiltration attempts over common HTTPS ports (443 or 8443). It identifies network connections where more than 1MB of data is sent in a single connection, then aggregates these connections over one-hour intervals per device and remote IP. Finally, it flags any device that has sent a total of 50MB or more within that hour to a specific remote IP, indicating potential data exfiltration to a command and control server.
Detects the use of curl to download files from Telegram to local temp folder, which may indicate initial malware staging.
Detects network connections to the hardcoded GammaSteel fallback C2 IP address (165.22.170.129) and domain (justsstop.ru). These hardcoded IOCs are used as a failsafe when primary S3 exfiltration fails or DDR configurations are lost, indicating an active data theft operation.
Detects network connections to the '.cfd' TLD originating from common web browsers. This cheap TLD is increasingly abused by attackers to host phishing redirect pages delivered via malicious SVG files.
Detects web defacement attempts via HTTP PUT requests to web server content files
Detects junk data padding in HTTP requests used to obfuscate C2 communications
Detects compromised websites being abused as C2 relay infrastructure
Detects compromised host participating in botnet C2 beaconing
Detects network traffic to known Command and Control (C2) IP addresses and ports associated with the ClickFix Python RAT.
Detects an unusually high volume (100 or more within an hour) of API calls (POST, DELETE, PUT methods to URIs containing 'api') originating from a single IP address. This activity could indicate various malicious behaviors such as brute-force attacks, credential stuffing, web application attacks, or a denial-of-service attempt against the API endpoint.
Page 154 of 190