Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,989 detections
Filters
Last updated
All Time
Detection languages
1,774
868
397
195
188
Contributors
1,070
924
756
221
96
Categories
2,448
1,307
1,164
785
713
Platforms
2,415
1,310
658
528
133
Products / Services
1,307
886
808
561
337
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
3,989
CVEs
6
5
5
5
5
IDS Classtypes
564
275
11
8
6
IDS Protocols
537
174
64
64
12
This rule detects network connections to cloud storage services Koofr, IceDrive, and Filen (koofr.net, icedrive.net, filen.io, filen.net, filen-1.net, filen-2.net) from non-browser processes. This activity is indicative of potential command and control (C2) communication, as APT28 has been observed using these services for C2, with tools like Covenant Grunt and BeardShell communicating via their APIs. The rule specifically filters out connections originating from common web browsers (msedge.exe, chrome.exe, firefox.exe) to reduce false positives.
Detects the use of curl.exe to upload files to the temp.sh service while simultaneously passing the resulting temp.sh URL within the User-Agent string to a C2 server. This specific exfiltration and beaconing TTP was observed in the Notepad++ supply chain attack.
This query identifies URL access attempts that were blocked by CATO Networks security policies, based on logs in CommonSecurityLog. It allows for filtering by specific devices or target URLs.
Detects Windows VBScript (wscript.exe or cscript.exe) processes establishing network connections to AI/LLM API endpoints. This behavior is highly anomalous as VBScript is typically used for local automation and rarely makes HTTPS API calls to external services. This pattern is consistent with PROMPTFLUX malware and jailbroken LLM variants like WormGPT. PROMPTFLUX uses Gemini's API to dynamically rewrite and obfuscate its own VBScript code at runtime. WormGPT variants use jailbroken Grok (xAI) or Mixtral (Mistral AI) APIs with manipulated system prompts to bypass guardrails. The malware queries AI models to generate new obfuscated versions of itself, creating a "just-in-time" metamorphic capability that constantly evolves to bypass static signature-based detection. Sysmon Event ID 3 is the best way to detect this behavior on endpoints.
Chrysalis Backdoor Network IOCs
Cortex XDR
Detects network connections to known command and control (C2) infrastructure associated with the Lotus Blossom threat group and the Chrysalis Backdoor. This rule identifies suspicious outbound network activity to specific IP addresses and hostnames linked to this threat actor.
This rule identifies and aggregates blocked requests from Imperva WAF logs, grouping them by source IP address and then by the owning organization (ASN). It helps to detect and analyze potential attack campaigns or coordinated malicious activity originating from specific organizations or IP ranges. The rule focuses on security, session, and visitor blocks, providing details on attack names, query strings, referrers, and URLs.
Detects a behavioral sequence where an AI agent runtime (e.g., Node.js, Python) spawns a shell to execute a web request utility like curl or wget. This pattern is a strong indicator of automated data exfiltration, often resulting from a successful prompt injection attack that instructs the agent to steal and send data to an attacker-controlled server.
Detects instances where an AI agent process (e.g., Moltbot, ClawdBot) performs a web search or HTTP request containing suspicious internal identifiers (like API keys or project names) as URL parameters. This behavior is a hallmark of 'search-and-leak' exfiltration tactics, often triggered by indirect prompt injection.
Detects network connections to Polygon (MATIC) blockchain RPC endpoints. The DeadLock ransomware strain has been observed using smart contracts on the Polygon network to retrieve C2 proxy server addresses, making this a key indicator of compromise.
This rule detects network connections to known malicious IP addresses and domains, as well as the presence of files with known malicious hashes. It specifically looks for indicators associated with the Amatera Stealer, including specific domains, an IP address, and file hashes. The rule correlates network events (DeviceNetworkEvents) and file events (DeviceFileEvents) to identify these indicators of compromise (IOCs).
Detects network connections initiated by Microsoft Office applications that may indicate CVE-2026-21509 exploitation. The Shell.Explorer.1 embedded browser component can establish outbound connections to attacker-controlled servers without user awareness. This rule monitors for Office processes making HTTP/HTTPS connections, especially to non-Microsoft and non-CDN destinations.
Detects network traffic to known Tier One Command and Control (C2) domains used by IPIDEA-affiliated SDKs (PacketSDK, CastarSDK, EarnSDK, HexSDK) for device enrollment and tasking.
This rule detects the XenoRAT info stealer and Remote Access Trojan (RAT) by identifying specific strings related to its functionalities. It looks for configuration parameters like 'HostName', 'PortNumber', 'UserName', and 'Password' which are typically supplied at runtime for C2 communication. The rule also identifies strings associated with browser data exfiltration ('Local Extension Settings', 'Sync Extension Settings', 'chromium_plugins', 'logins.json', 'profiles.ini', 'IndexedDB', 'chrome-extension_'), crypto wallet theft ('ChainingModeGCM'), file grabbing capabilities ('%DRIVE_FIXED%', '%DRIVE_REMOVABLE%', 'File Grabber'), and HVNC-style desktop control ('Chrome_WidgetWinOperaWindowClass', 'CreateDesktopA', 'OpenDesktopA'). Additionally, it includes specific hashes of known XenoRAT samples for direct identification.
Detects execution of XenoRAT, an information stealer and remote access trojan targeting browser data, cryptocurrency wallets, file systems, and HVNC style remote desktop activity. Command and control parameters including hostname, port, username, and password are supplied at runtime. Detection uses known hashes and behavioural context, with higher confidence achieved by correlating with xenorat_stealer_file_access on the same host within 15 minutes.
Detects network connections to known Command and Control (C2) domains used by NetSupport RAT as delivered by the IClickFix framework.
Detects network connections to a known Amatera Stealer C2 IP address where the HTTP Host header is spoofed. This technique is used by the malware to masquerade its C2 traffic, often by using a legitimate-looking or unrelated domain in the Host header, while communicating directly with the malicious IP address.
Detects network traffic to fallback command and control (C2) domains generated by the 'Children Protection' malicious browser extension. The extension uses a Domain Generation Algorithm (DGA) based on the current date to provide resilient C2 infrastructure.
Detects network connections to the GitHub API attempting to fetch a 'command.txt' file. This behavior is characteristic of the GITSHELLPAD backdoor, which uses private GitHub repositories for command and control (C2) communication as seen in the Gopher Strike campaign.
Detects network connections to known infrastructure associated with the EncystPHP web shell campaign. This IP (45.234.176.202) was observed distributing the 'c' and 'k.php' droppers.
Esta detección identifica posibles conexiones relacionadas con el uso de VPNs dentro del entorno corporativo, correlacionando puertos asociados a protocolos VPN, dominios no habituales, procesos iniciadores y adaptadores de red virtuales o tunelizados. El objetivo es descubrir actividad de VPN no autorizada, conexiones cifradas ocultas dentro de tráfico HTTPS y el uso de extensiones de navegador que actúan como túneles tipo VPN.
La lógica de esta consulta aplica múltiples capas de filtrado para reducir falsos positivos:
- Filtra conexiones salientes hacia puertos característicos de IPsec, OpenVPN, WireGuard, L2TP y PPTP.
- Detecta túneles sobre puerto 443 cuando el proceso iniciador no corresponde a aplicaciones del sistema.
- Excluye ruido generado por procesos de Windows y dominios legítimos asociados a Microsoft, Google y servicios cloud corporativos.
- Identifica adaptadores TAP, TUN, Wintun, WireGuard, Tailscale o ZeroTier presentes en el host.
- Clasifica el tipo probable de VPN según el puerto utilizado y el proceso que inicia la conexión.
Esta detección permite encontrar:
- Clientes VPN instalados sin autorización.
- Extensiones de navegador que establecen túneles SSL-VPN encubiertos.
- Herramientas de túneles encubiertos como WireGuard stealth, Tailscale o ZeroTier.
- Actividad anómala desde navegadores que podría indicar proxies cifrados o VPNs embebidas.
La lógica de esta consulta aplica múltiples capas de filtrado para reducir falsos positivos:
- Filtra conexiones salientes hacia puertos característicos de IPsec, OpenVPN, WireGuard, L2TP y PPTP.
- Detecta túneles sobre puerto 443 cuando el proceso iniciador no corresponde a aplicaciones del sistema.
- Excluye ruido generado por procesos de Windows y dominios legítimos asociados a Microsoft, Google y servicios cloud corporativos.
- Identifica adaptadores TAP, TUN, Wintun, WireGuard, Tailscale o ZeroTier presentes en el host.
- Clasifica el tipo probable de VPN según el puerto utilizado y el proceso que inicia la conexión.
Esta detección permite encontrar:
- Clientes VPN instalados sin autorización.
- Extensiones de navegador que establecen túneles SSL-VPN encubiertos.
- Herramientas de túneles encubiertos como WireGuard stealth, Tailscale o ZeroTier.
- Actividad anómala desde navegadores que podría indicar proxies cifrados o VPNs embebidas.
This rule detects unsigned executables originating from the WindowsApps directory that are making network connections to IP lookup services. This behavior can indicate a potentially malicious application attempting to identify its external IP address, possibly for command and control communication or reconnaissance. Common browsers are excluded from this detection to reduce false positives.
Page 169 of 190