Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,989 detections
Filters
Last updated
All Time
Detection languages
1,774
868
397
195
188
Contributors
1,070
924
756
221
96
Categories
2,448
1,307
1,164
785
713
Platforms
2,415
1,310
658
528
133
Products / Services
1,307
886
808
561
337
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
3,989
CVEs
6
5
5
5
5
IDS Classtypes
564
275
11
8
6
IDS Protocols
537
174
64
64
12
This rule identifies and blocks TLS connections using JA4 fingerprints without SNI, as they may indicate suspicious, potentially malicious encrypted traffic.
This rule detects command and control (C2) communication associated with the Lazarus Group's ScoringMathTea Remote Access Trojan (RAT). It specifically looks for HTTP traffic where the User-Agent header matches a known string used by this malware: 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.42'. This User-Agent string attempts to masquerade as a legitimate Microsoft Edge browser.
This rule monitors AWS Network Firewall for HTTP and TLS connections to domains with uncommon TLDs to identify anomalous behavior without blocking traffic, providing visibility rather than specific threat detection.
This rule blocks connections made directly to IP addresses instead of domain names, a technique often used by malware to evade detection, leveraging AWS Network Firewall and Suricata.
This rule provides a preventive configuration for AWS Network Firewall that blocks outbound HTTP and TLS connections to domains using high-risk country-code top-level domains (ccTLDs) like .ru and .cn.
This rule blocks HTTP and TLS connections to domains with high-risk TLDs like .xyz, .info, and .top due to their frequent association with malicious activities.
Detects the Visual Basic Compiler (vbc.exe) initiating DNS queries. This is highly anomalous behavior, as vbc.exe is a compiler and should not be making network connections. This technique is used by malware like Lokibot for defense evasion after process injection.
Detects large HTTP responses for URLs containing keywords associated with F5 BIG-IP configuration or archive files. This could indicate an attacker exfiltrating sensitive system configurations.
IOCs and behavior from Danabot version 669
This rule detects network connections to external hosts exhibiting a specific JARM fingerprint (27d40d40d00040d00042d43d00041df04c41293ba84f6efe3a613b22f983e6) that has been associated with a phishing campaign, specifically targeting Harbor Freight. JARM fingerprints are used to identify unique TLS server configurations, and this particular hash indicates a known malicious infrastructure.
Detects outbound HTTP GET requests consistent with Lumma Stealer's browser fingerprinting activity. This activity involves contacting a C2 endpoint at '/api/set_agent' with specific URL parameters ('id', 'token', 'description') to register the victim and gather system information.
This rule detects Command and Control (C2) communication associated with the Amatera Stealer malware. It specifically looks for TLS traffic where the Server Name Indication (SNI) field contains the string "aether100pronotification.table.core.windows.net". This SNI is considered bogus and indicative of Amatera Stealer's C2 activity.
Detects network connections to Pastebin.com from a Python process. This behavior is associated with the InvisibleFerret malware, as part of the 'Contagious Interview' campaign, which retrieves additional payloads from Pastebin.
Detects network connections from Node.js to specific JSON storage services known to be abused by the 'Contagious Interview' campaign. Threat actors host malicious code on these services, which is then fetched and executed by trojanized applications as part of a social engineering scheme.
Detects outbound network connections to a specific .onion domain associated with the 'Tsunami Payload' component of the 'Contagious Interview' campaign, which uses the Tor network for command and control (C2) communications.
Detects the macOS Script Editor (`Script Editor.app`) launching child processes or initiating network connections. This behavior can indicate the execution of a malicious AppleScript used to download secondary payloads or execute arbitrary commands, as seen in campaigns delivering stealers like MacSync and Odyssey.
Detects execution of Node.js from unusual locations or associated with network connections to known C2 infrastructure, as seen in campaigns distributing backdoors disguised as legitimate software.
PwnDrp Access
Sigma
Detects downloads from PwnDrp web servers developed for red team testing and most likely also used for criminal activity
Detects network connections to Command and Control (C2) servers associated with the LANDFALL Android spyware. LANDFALL communicates over HTTPS, often on non-standard ports.
APT User Agent
Sigma
Detects suspicious user agent strings used in APT malware in proxy logs
Detects suspicious user agent strings used by crypto miners in proxy logs
Page 173 of 190