Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,989 detections
Filters
Last updated
All Time
Detection languages
1,774
868
397
195
188
Contributors
1,070
924
756
221
96
Categories
2,448
1,307
1,164
785
713
Platforms
2,415
1,310
658
528
133
Products / Services
1,307
886
808
561
337
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
3,989
CVEs
6
5
5
5
5
IDS Classtypes
564
275
11
8
6
IDS Protocols
537
174
64
64
12
This rule detects artifacts associated with the RenEngine, HijackLoader, and Lumma campaigns. It identifies these threats through a combination of specific MD5 hashes, high-signal domain markers (both distribution and C2 domains), and unique filenames. The rule triggers if a file's MD5 hash matches one of the known malicious hashes, or if it contains at least one specific filename in conjunction with at least one domain marker, or if it contains at least two distinct domain markers (either distribution or C2).
This rule detects activity associated with the DYNOWIPER malware. It identifies the malware through specific SHA256 file hashes, known filenames (dynacom_update.exe, source.exe, schtask.exe, dynacon_update.ps1, exp.ps1), and process names (dynacom_update.exe, source.exe, schtask.exe, powershell.exe). Additionally, it flags network connections to or from a set of known malicious IP addresses (185.200.177.10, 31.172.71.5, 193.200.17.163, 185.82.127.20, 72.62.35.76) which are associated with VPN logins or exfiltration reverse proxies used by DYNOWIPER.
Detects processes associated with Dohdoor malware making network connections to Cloudflare's DNS-over-HTTPS service for C2 domain resolution.
This will show clearly the daily successful traffic for each day of the week, and then it will project the peak hours, medium and low hours of each day. And in the last column, it shows the Imperva rule that it hit, which also indicates if an attack was successful.
This rule detects HTTPS requests that should have been blocked but are not, for example:
Query Strings with malicious traits like 1=1, attempt to enter <script> in the URL,
URL containing ../ indicating Directory Traversal attempt, and so on.
Query Strings with malicious traits like 1=1, attempt to enter <script> in the URL,
URL containing ../ indicating Directory Traversal attempt, and so on.
Detects periodic network traffic (beaconing) from browser processes to external domains, which may indicate automated data exfiltration by a malicious extension like the ChatGPT Stealer. This threat is known to exfiltrate data at approximately 30-minute intervals.
This rule detects outbound network connections to known Command and Control (C2) and exfiltration domains associated with the SANDWORM_MODE campaign. These domains are used to exfiltrate stolen credentials and other sensitive data.
This rule detects network connections from common web browsers to known command and control (C2) domains associated with the ChatGPT Stealer campaign. These domains are used to exfiltrate stolen AI session tokens and conversation data.
This rule detects the presence of a fake Windows 11 malvertising installer, specifically 'ms-update32.exe', which is known to be distributed via malicious advertisements. It correlates network connections to suspicious domains (including lookalike domains and GitHub hosting) with process execution from user-writeable paths or the presence of 'LunarApplication' artifacts, and registry modifications to the 'TIP\AggregateResults' key, indicating persistence. The rule requires at least two independent signals (registry write plus one or more supporting signals) within a 30-minute pivot window to reduce false positives.
Detects network connections to identified command and control (C2) infrastructure for both the original TrustConnect malware and its successor, DocConnect. This rule specifically looks for connections to known suspicious domains and IP addresses associated with these malware families.
KQL to detect suspicious HTTP requests
This rule detects network connections to malicious infrastructure associated with a supply chain attack targeting dYdX npm and PyPI packages. The infrastructure is used for credential exfiltration and as a C2 for a RAT.
Detects outbound HTTPS traffic to specific URI paths and User-Agent strings hardcoded in MIMICRAT's malleable C2 profiles. These profiles impersonate legitimate web analytics traffic.
Detects network requests to specific URI endpoints associated with the DOMOAuth2_ and IRAOAuth2.0 malicious NuGet packages. These packages exfiltrate ASP.NET Identity data to a local C2 proxy. The rule specifically looks for traffic to these URIs on localhost via port 7152.
This rule identifies network connections to known command and control (C2) infrastructure and typosquatted domains associated with the ValleyRAT malware, specifically those used in the Huorong impersonation campaign. It looks for connections to a hardcoded malicious IP address or a list of malicious domains.
Detects network traffic to local proxy on port 7152 associated with malicious NuGet package C2 behavior.
This rule set detects various stages of the OysterLoader malware activity, including its registration and login attempts to a command and control (C2) server, specific C2 communication patterns via HTTP URIs, and connections to known OysterLoader C2 domains and IP addresses. The rules look for specific HTTP URI paths like "/reg" and "/login" combined with distinct User-Agent strings ("WordPressAgent" and "FingerPrint"), as well as specific API paths under "/api/" and hardcoded C2 domains and IP addresses.
Detects network traffic to a local proxy on port 7152, a behavior associated with a malicious NuGet package campaign involving NCryptYo, DOMOAuth2_, IRAOAuth2.0, and SimpleWriter_. This traffic is characterized by communication to a loopback address (127.0.0.1 or ::1) or 'localhost' on the suspicious port, specifically targeting '/api/auth/' endpoints.
This is a broad hunting query to find Indicators of Compromise (IOCs) associated with the Notepad++ supply-chain attack attributed to the Lotus Blossom actor and the Chrysalis backdoor. It searches for known file hashes, file paths, network indicators (IPs, domains, URLs), and user-agents across multiple event types.
This rule detects outbound network connections from Ivanti EPMM appliances to known Out-of-Band (OOB) interaction services and tunneling platforms. This activity is often associated with automated reconnaissance and exploitation verification for vulnerabilities like CVE-2026-1281.
This rule detects various activities associated with the FoxKitsune malware, including network staging, suspicious file drops in SysWOW64, unusual svchost execution, service persistence, and attempts to tamper with Windows Defender. It correlates these events to identify potential FoxKitsune infections.
Page 165 of 190