Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,989 detections
Filters
Last updated
All Time
Detection languages
1,774
868
397
195
188
Contributors
1,070
924
756
221
96
Categories
2,448
1,307
1,164
785
713
Platforms
2,415
1,310
658
528
133
Products / Services
1,307
886
808
561
337
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
3,989
CVEs
6
5
5
5
5
IDS Classtypes
564
275
11
8
6
IDS Protocols
537
174
64
64
12
Detects DNS query requests to Devtunnels domains. Attackers can abuse that feature to establish a reverse shell or persistence on a machine. Devtunnels can be used for command and control or data exfiltration by tunneling traffic over legitimate-looking DNS requests.
Detects anomalous system behavior that could indicate sophisticated threats deviating from normal activity. This includes unusual process-parent relationships, unexpected network connections from scripting engines, and attempts to modify registry keys related to AMSI or ETW configuration.
Detects CurlCat, a custom tool used by the Curly COMrades threat actor for C2 communications. It is characterized by its use of libcurl and a custom Base64 substitution alphabet.
This rule detects attempts by scripting language interpreters (Node.js, Python, PowerShell) to access sensitive browser credential files such as 'Login Data', 'Web Data', and 'Cookies' from Chrome and Brave browser user data directories. It also includes specific file paths that might be associated with known browser extensions or malware that target these files. This activity is indicative of credential dumping or information stealing.
Vidar is a sophisticated infostealer operating as Malware-as-a-Service (MaaS). Written in C++, it’s designed to harvest a wide range of sensitive data from infected systems and exfiltrate it to attacker controlled infrastructure.
🧬 Script Inception: PowerShell scripts nested within PowerShell scripts, layered with 2–3 rounds of Base64 encoding.
📦 RAR Payloads: Password protected RAR files downloaded via direct-to-IP HTTP requests over TCP port 80. Passwords are embedded in encoded scripts and passed via command line to a downloaded copy of "unrar.exe".
🧬 Script Inception: PowerShell scripts nested within PowerShell scripts, layered with 2–3 rounds of Base64 encoding.
📦 RAR Payloads: Password protected RAR files downloaded via direct-to-IP HTTP requests over TCP port 80. Passwords are embedded in encoded scripts and passed via command line to a downloaded copy of "unrar.exe".
This analytic leverages alerts from Splunk AppDynamics SecureApp to identify and monitor exploit attempts targeting business applications. It specifically looks for vulnerabilities in web applications, including injection attacks (SQL, API abuse), deserialization vulnerabilities, remote code execution attempts, LOG4J, and zero-day attacks. These attacks typically aim to gain unauthorized access, exfiltrate sensitive data, or disrupt application functionality. Splunk AppDynamics SecureApp provides real-time detection by analyzing application-layer events and correlating attack behavior with known vulnerability signatures, categorizing attack severity, providing visibility into attacker tactics, and generating risk-based scoring and contextual alerts.
Detects possible prompt injection or abuse of AI models like LLMs via unusual process and API call patterns
Detects network communication patterns associated with Scattered Spider threat group, including known C2 domains, IP addresses, and characteristic domain patterns used for phishing and command and control operations.
Detects DNS requests to Cloudflared tunnels domains.
Attackers can abuse that feature to establish a reverse shell or persistence on a machine.
Attackers can abuse that feature to establish a reverse shell or persistence on a machine.
Detects DNS query requests to Devtunnels domains. Attackers can abuse that feature to establish a reverse shell or persistence on a machine.
Detects the use of curl to silently download a file from a remote server, often initiated by a command-line interpreter. This technique is used by adversaries, such as in the Epsilon Red ransomware campaign, to fetch payloads without user interaction.
Detects components of the KimJongRAT PE variant, including the orchestrator (NetworkService.dll), loader (sys.dll/baby.dll), and stealer (dwm.dll), based on unique strings, PDB paths, and network communication artifacts.
This rule detects PowerShell scripts that utilize web request cmdlets (Invoke-WebRequest, Invoke-RestMethod, irm, iwr) along with the '-UserAgent' parameter. Adversaries often modify user agents to mimic legitimate traffic or specific applications, blending in with normal network activity to evade detection while communicating with command and control servers or exfiltrating data.
Detects the use of encoded or obfuscated IP addresses (hex, octal, etc.) within a URL in conjunction with common download commands. This technique is often used by adversaries to evade simple network-based detections or to obscure their infrastructure.
Catches outgoing network connections to external IPs from command-line tools spawned by browsers, indicating potential command-and-control communication in ClickFix attacks.
Detects highly unusual network connections initiated by notepad.exe. This behavior is suspicious because notepad.exe is a simple text editor not designed for network communication. This technique has been observed in campaigns where threat actors inject shellcode into a suspended notepad.exe process to establish command and control (C2) connections.
This detection identifies network traffic to domains known to be used as command and control (C2) infrastructure in recent SharePoint exploitation campaigns. Communication with these domains is a strong indicator of compromise.
This rule detects the creation of a suspicious file named 'spinstall0.aspx' or similar in a specific SharePoint template directory, which is indicative of a potential compromise related to CVE-2025-49704, CVE-2025-49706, or CVE-2025-53770. Additionally, it identifies network connections to known malicious IP addresses associated with these vulnerabilities.
This detection identifies network traffic to or from IP addresses known to be associated with command and control (C2) infrastructure or active exploitation in recent SharePoint vulnerability campaigns. Communication with these IPs is a strong indicator of either an attempted attack or an existing compromise.
This rule detects the execution of PowerShell with suspicious command-line arguments (such as base64 encoded strings, Invoke-Expression, or encoded commands) when the parent process is a web browser. This behavior is often indicative of drive-by downloads, malicious advertisements, or exploitation of browser vulnerabilities leading to the execution of malicious PowerShell scripts.
This detection identifies outbound SSL connections where the certificate issuer or subject matches suspicious strings associated with PureRAT infrastructure.
Page 178 of 190