Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,989 detections
Filters
Last updated
All Time
Detection languages
1,774
868
397
195
188
Contributors
1,070
924
756
221
96
Categories
2,448
1,307
1,164
785
713
Platforms
2,415
1,310
658
528
133
Products / Services
1,307
886
808
561
337
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
3,989
CVEs
6
5
5
5
5
IDS Classtypes
564
275
11
8
6
IDS Protocols
537
174
64
64
12
Detects network connections from a trojanized "WorkFlowy.exe" process to a known command and control (C2) server. This behavior was observed in a ClickFix campaign where a legitimate Electron application was modified to act as a C2 beacon and dropper, communicating with the C2 every two seconds.
Detects potential DLL side-loading activity associated with the MuddyWater threat actor. The rule identifies the legitimate Fortemedia application, FMAPP.exe, initiating network connections while running from a non-standard or suspicious directory, such as C:\Users\Public\Downloads\. This behavior is indicative of a malicious FMAPP.dll being loaded for command-and-control (C2) communications.
This rule detects suspicious outbound network connections from devices that exhibit a consistent timing pattern (low standard deviation relative to the average time delta between connections) to public IP addresses. It specifically looks for connections that are not initiated by common browsers unless they are running in headless mode, or connections initiated by processes with low global prevalence or identified as Living Off The Land Binaries (LOLBAS). This pattern can indicate automated activity, command and control communication, or data exfiltration.
Detects network connections to known command-and-control (C2) domains used by malicious AI browser extensions for data exfiltration.
Detects HTTP POST requests to "/api/get_challenge" or "/api/get_credentials" on port 5000. This is the initial communication pattern of the TunnesshClient backdoor, a component of the BoryptGrab campaign, to retrieve SSH credentials from its C2 server before establishing a reverse SSH tunnel.
Detects the beaconing activity of the HeaconLoad Golang downloader, a component of the BoryptGrab campaign. This malware sends HTTP POST requests containing system information to the "/healthcheck" endpoint on port 8088.
Detects OAuth authorization requests to Microsoft or Google that use the 'prompt=none' parameter in combination with an intentionally invalid or missing 'scope'. This combination is used to force a silent error redirect to an attacker-controlled URI, bypassing some security filters.
New User Agent Per User
YARA-L
Detects when a user begins using a previously unseen HTTP user agent string. Uses 30-day metrics to baseline each user's known user agents. Fires when a new user agent appears for a user who has been active for at least 2 days, indicating possible tooling changes, unauthorized software, or adversary-introduced utilities.
This rule detects network connections from devices to a list of known malicious domains. These domains are often associated with command and control (C2) infrastructure or other malicious activities.
This is highly adjustable script that tells us whether HTTPS request was successful, the reason why it was blocked or not, and on top of that, it explains the error code. This is still a work-in-progress but it already does 99% of the job.
Detects the use of curl.exe where the User-Agent string contains a URL pointing to temp.sh. This specific TTP was observed in the Notepad++ supply chain attack (Chrysalis infection chain) to exfiltrate system information and signal the uploaded file's location to the C2 server.
Detects DNS queries for subdomains of 'trycloudflare.com' originating from suspicious processes, such as script interpreters and LOLBins.
Attackers, such as those behind the VOID#GEIST campaign, leverage Cloudflare Tunnels to host command and control (C2) infrastructure, and initiating these connections from script interpreters or LOLBins is a common TTP.
Attackers, such as those behind the VOID#GEIST campaign, leverage Cloudflare Tunnels to host command and control (C2) infrastructure, and initiating these connections from script interpreters or LOLBins is a common TTP.
Detects network connections to the primary C2 IP and port (103.106.67.63:1244) used across all modules of the StegaBin infostealer toolkit. This specific IP and port combination is highly indicative of StegaBin activity.
Detects network traffic matching patterns used by the Chrysalis backdoor for C2 communications. The malware was observed using the domain 'api.skycloudcenter.com' and mimicking DeepSeek AI API URL paths to evade detection.
UNC5142 CLEARSHORT - injected Web3 + BSC contract addresses in HTTP response
This rule detects HTTP user-agent strings that appear on multiple distinct source hosts over a time period with multiple total requests, after excluding empty/null user-agents and known bot/monitoring strings (Googlebot, bingbot, Slackbot, monitoring).
This rule set detects various activities associated with the Dohdoor malware campaign (UAT-10027). It includes detection for known malware hashes, suspicious network communication patterns such as DNS over HTTPS (DoH) to Cloudflare with specific user agents, staging URL patterns, and odd-cased infrastructure domains. Additionally, it identifies endpoint activities like curl downloading batch/command files and DLL sideloading attempts using specific DLL names and LOLBins executed from common public writeable directories. The intent is to provide strong leads for investigation into potential Dohdoor infections.
Identifies network connections to known command and control (C2) and dropper distribution infrastructure associated with the EncystPHP web shell campaign.
Detects outbound network traffic or DNS queries to the Yandex Cloud Functions domain (functions.yandexcloud.net). This domain was used as a C2 relay by the 'ambar-src' malicious npm package, indicating potential command and control activity.
Detects activity related to OpenClaw (aka Clawdbot or Moltbot) by searching for specific process command line strings, file path keywords, network listeners on port 18789, or scheduled tasks named 'OpenClaw'.
This rule detects activity associated with a developer-targeting campaign leveraging malicious Next.js repositories. It identifies suspicious network connections to known Vercel staging domains and C2 IPs/ports/paths, as well as suspicious process execution patterns involving Node.js or VS Code related processes, and file events related to specific repository artifacts or sensitive file access by developer-adjacent processes. The detection logic covers network communication, process execution, and file system activities indicative of this specific threat.
Page 163 of 190