Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,989 detections
Filters
Last updated
All Time
Detection languages
1,774
868
397
195
188
Contributors
1,070
924
756
221
96
Categories
2,448
1,307
1,164
785
713
Platforms
2,415
1,310
658
528
133
Products / Services
1,307
886
808
561
337
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
3,989
CVEs
6
5
5
5
5
IDS Classtypes
564
275
11
8
6
IDS Protocols
537
174
64
64
12
Identifies active command and control or exfiltration connections associated with the recent AMOS Stealer campaign delivered via AI agents by matching known C2 infrastructure IP addresses.
Detects network connections, DNS requests, and HTTP traffic to known Tropic Trooper C2 infrastructure, indicating potential AdaptixC2 or Cobalt Strike beaconing from compromised endpoints.
This rule detects instances where a 'node.exe' process initiates an outbound network connection over HTTPS (port 443) to a domain within the '.vercel.app' top-level domain. This could indicate development activity, but also potential malicious use of Node.js applications for command and control or data exfiltration to cloud services.
Detects DNS requests to the known DinDoor and CastleLoader C2 domain serialmenot[.]com, which is a multi-tenant infrastructure used by Iranian APT actors.
This rule detects suspicious processes (winupdate.exe, windows.exe, svchost.exe, system32.exe) initiating network connections from unusual directories (Downloads, Public, System32) to known cloud storage providers (Amazon AWS, DigitalOcean, Azure Blob Storage) or over port 443. This behavior could indicate data exfiltration, command and control activity, or malware communication.
Detects network connections to known malicious infrastructure domains and IP addresses associated with the Checkmarx supply chain compromise. The compromised KICS images and mcpAddon.js payload use these hardcoded endpoints to exfiltrate stolen credentials and tokens.
Detects network connections to the known command and control (C2) server and port associated with the compromised axios package payload. This rule specifically looks for network connections or DNS requests to 'sfrclak.com' or connections to IP address '142.11.206.73' on port 8000.
Detects network requests to known malicious domains associated with the fake RedAlert Android malware campaign used by pro-Iranian actors, acting as a payload host or C2 endpoint.
Detects HTTP POST requests to /panel.php. This endpoint is frequently used by the BlobPhish campaign for backend C2 interaction or validation checks, often accompanied by an empty request body and a specific JSON error response.
Detects curl commands using user-agent strings that Sapphire Sleet uses as campaign tracking identifiers in their macOS intrusion chain. Each stage of the cascading payload delivery uses a distinct UA (mac-cur1 through mac-cur5) to route requests to different server paths serving AppleScript payloads or ZIP archives containing malicious .app bundles.
This rule detects the specific command and control check-in format used by the PhantomPull loader to retrieve the final PhantomPulse payload. It monitors for the URL pattern '/v1/updates/check?build=payloads' within process command lines on Windows systems, indicating communication with the PhantomPulse C2 infrastructure.
This rule detects DNS requests to domains known to be associated with malicious browser extensions. These extensions often perform command and control (C2) or data exfiltration activities by communicating with these domains. The rule uses a regex to match both the primary domains and their subdomains, aggregating results by host and domain to identify repetitive beaconing.
Detects cobalt strike malleable profiles patterns (URI, User-Agents, Methods).
Monitors for the specific URL pattern used by the PhantomPull loader to fetch the final PhantomPulse payload via WinHTTP. This behavior is associated with the REF6598 campaign.
Detects network connections to Masjesu's hardcoded fallback command and control IP addresses over port 443. This rule is critical for detecting mature infections where Masjesu actively falls back to a set of hardcoded IP addresses if domain resolution fails.
Detects DNS resolution requests for known Masjesu botnet command and control (C2) domains. Masjesu relies on multiple failover domains to fetch its secondary payload and receive DDoS commands.
Detects DNS requests directed to the cloudapi[.]stream domain, which is associated with a widespread malicious Chrome extension campaign involving over 100 extensions. Monitoring for this specific domain allows defenders to identify compromised hosts regardless of the specific extension ID.
Detects network connections to the primary staging server IP address (195.3.222.251) used to host the intermediate PowerShell script and the PhantomPull loader associated with the REF6598 campaign and the PhantomPulse RAT.
This rule detects the specific command and control check-in format used by the PhantomPull loader to retrieve the final PhantomPulse payload. It monitors for a unique URL pattern in process command lines, indicating communication with the PhantomPulse C2 server.
Detects HTTP requests containing the VS/PL/AN parameter combination used by JanelaRAT for C2 beaconing. The beacon reports malware version (VS), profile level (PL), and presence of banking security software (AN). JanelaRAT targets Latin American financial institutions (Brazil, Mexico). Note: C2 uses port 443 WITHOUT TLS encryption.
Provides high-fidelity detection of the initial infrastructure used by the threat actor to deliver the PhantomPulse RAT. This rule specifically detects network connections to a known PhantomPulse staging server IP address.
Page 159 of 190