Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,989 detections
Filters
Last updated
All Time
Detection languages
1,774
868
397
195
188
Contributors
1,070
924
756
221
96
Categories
2,448
1,307
1,164
785
713
Platforms
2,415
1,310
658
528
133
Products / Services
1,307
886
808
561
337
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
3,989
CVEs
6
5
5
5
5
IDS Classtypes
564
275
11
8
6
IDS Protocols
537
174
64
64
12
This rule detects network connections and DNS queries to known command and control (C2) infrastructure associated with Lumma Stealer malware. It leverages a regularly updated external list of indicators of compromise (IOCs) including IP addresses and domains to identify malicious communication attempts.
Detects network connections to IP addresses known to be involved in the exploitation of SharePoint vulnerability CVE-2025-53770.
Detects the HazyBeacon backdoor, which leverages AWS Lambda URLs for C2 communication and uses custom tools for data exfiltration. The rule identifies known malicious file hashes, suspicious tool drops in C:\ProgramData, specific service creation commands for persistence, and network connections from the sideloaded host process (mscorsvw.exe) to AWS Lambda URLs.
This detection looks for activity associated with the Redirection ad-jacking campaign. It detects network connections to known malicious C2 domains and the installation of malicious browser extensions identified by their extension IDs.
This query identifies when a suspicious SVG file, linked to known threat intelligence, is downloaded via a browser. This technique is often used for SVG smuggling, where attackers embed malicious JavaScript or links within the SVG's structure to bypass traditional content filters or sandboxing. Once rendered in the browser, the embedded content may redirect the victim to a malicious site or initiate further malicious activity.
Detects TTPs associated with the HazyBeacon backdoor, used by the threat cluster CL-STA-1020. This rule identifies the creation of a specific persistence service and the execution of custom exfiltration tools from the C:\ProgramData directory. This threat also uses C2 communication via AWS Lambda URLs (e.g., *.lambda-url.*.on.aws) from the mscorsvw.exe process, which should be monitored via network logs.
Detects execution of the Interlock RAT PHP variant and associated activity by looking for specific execution parameters, initial download commands, and known malicious file hashes, domains, and IP addresses.
Detects HTTP POST requests containing suspicious parameters or headers used by GoldMelody's in-memory IIS modules. Attackers leverage ASP.NET ViewState deserialization to execute payloads in memory, often passing commands and data via non-standard HTTP parameters and headers within POST requests.
This analytic detects outbound connections from Cisco Secure Firewall Threat Defense to commonly abused file sharing and pastebin-style hosting domains. It specifically looks for allowed connections where the URL matches a predefined list of known data hosting or temporary storage services. These platforms are frequently used by adversaries for malware delivery, data exfiltration, command and control (C2) beacons, or staging of encoded payloads. Identifying such connections can indicate potential abuse of legitimate infrastructure as part of an attacker's kill chain, suggesting tool staging, credential dumping, or outbound data leaks over HTTP(S).
Detects the persistence mechanism and command and control (C2) communication used by the Atomic macOS Stealer (AMOS) backdoor. This includes the creation of a LaunchDaemon, download of a helper binary, and C2 task polling.
This analytic detects outbound network connections initiated by command-line tools such as `curl` or `wget` as observed in Cisco Secure Firewall Threat Defense logs. It specifically looks for allowed connections where the `EVE_Process` or `ClientApplication` fields indicate the use of these utilities. While these tools have legitimate uses, adversaries frequently abuse them to download malicious payloads, retrieve additional tools, or establish staging infrastructure on compromised systems. Detection of this activity may indicate the download phase of an attack chain or the retrieval of command-and-control utilities.
Detects network connections to Cloudflare's trycloudflare.com domain by processes commonly abused by threat actors for payload delivery or command and control (C2), indicating potential misuse of Cloudflare Tunnels.
Detects potential misuse of TryCloudflare tunnels for malware delivery or C2 communication by monitoring command-line arguments of common scripting and download tools. Adversaries leverage legitimate services like TryCloudflare to host malicious payloads and evade detection.
KQL Query
Generic rule content from file: LOLBAS - Execution - Outbound Traffic to Suspicious TLD
Detects components of the Atomic macOS Stealer (AMOS) malware, specifically the backdoor and persistence artifacts described in a July 2025 report.
Detects the misuse of TryCloudflare tunnels for malware delivery, often involving the download and execution of malicious scripts or payloads. Threat actors abuse the temporary tunnel feature to host and deliver malware.
Detects the execution of the NightEagle APT group's Chisel-based malware, SynologyUpdate.exe, with specific command-line arguments indicating C2 communication and proxy functionality. This malware is used for internal network penetration and data exfiltration.
KQL Query
KQL Query
KQL Query from file: The Hunt for QR Phisher
Page 179 of 190