Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
301 detections
Filters
Last updated
All Time
Detection languages
119
80
68
11
9
Contributors
87
39
27
26
22
Categories
136
107
105
84
44
Platforms
133
127
29
28
16
Products / Services
113
105
39
30
24
MITRE Techniques
18,119
15,639
12,589
8,399
6,227
CVEs
2
2
2
1
1
IDS Classtypes
78
36
3
1
1
IDS Protocols
74
30
11
2
Detects outbound network connections to known blockchain API endpoints originating from developer scripting runtimes (e.g., node.exe, python.exe). This pattern is consistent with attackers using blockchain transactions as a dead-drop mechanism for retrieving encrypted second-stage payloads, a technique observed in supply chain attacks targeting developers.
Detects DNS resolutions for major AI/LLM provider domains (e.g., OpenAI, Anthropic, Google AI) originating from processes that are not common, known browsers or development tools. This behavior is indicative of potentially malicious applications or malware using AI APIs for automated tasks, such as content exfiltration or sophisticated C2 communication.
Detects low-and-slow password spraying activity against Entra ID by identifying a single source IP generating authentication failures (AADSTS50126) across multiple distinct accounts within a short window. This technique is used to obtain valid credentials for subsequent Microsoft Graph token abuse via hidden Conditional Access policy exclusions (CVE-2025-0309).
This rule detects potential Conditional Access bypass attempts where a Primary Refresh Token (PRT) is exchanged for an Azure Active Directory (AAD) Graph token. The detection specifically looks for successful sign-ins to 'Windows Azure Active Directory' or 'Microsoft Graph' resources from devices marked as 'compliant' but with 'Unknown' ownership or no prior device registration history in Audit Logs. This could indicate an adversary using a compromised PRT on an unregistered or untrusted device to gain access to resources that should be protected by Conditional Access policies.
Detects anomalous outbound TCP network connections on port 8084 originating from non-browser processes to known CDN providers (Akamai, Microsoft). This behavior is characteristic of VSHELL RAT C2 beaconing using domain blending techniques to mask communications within expected network noise.
Detects DNS resolution to attacker-controlled AWS S3 buckets masquerading as Outlook/OneDrive service pages used by UNC6692 for phishing delivery, SNOWBELT C2, and credential exfiltration. The rule specifically looks for DNS queries to S3 domains with patterns indicative of spoofed Outlook/OneDrive service pages or specific known malicious S3 bucket names.
Detects non-browser HTTP POST requests containing both 'access_token' and step-style parameters (e.g., 'step', 'stage', 'counter' followed by a number) in proxy or firewall telemetry. This rule specifically targets patterns associated with malware communication, such as SessionGate, Remus, or AnimateClipper, by excluding common browser user agents.
This rule detects command-and-control (C2) communication patterns associated with the Kimsuky threat group (specifically NUKESPED malware). It identifies network traffic to specific Fastly CDN IP addresses or domains related to the National Health Insurance Service (nhis.or.kr) originating from known malicious or suspicious execution processes like wscript.exe, cscript.exe, powershell.exe, or zlrenu8.exe.
This rule detects HTTP GET requests containing '/api/device/gate/' and the 'ngrok-skip-browser-warning' string in either the AdditionalExtensions, RequestClientApplication, csUriQuery, or csUserAgent fields. This pattern is indicative of traffic associated with ngrok, a legitimate reverse proxy tool that can be leveraged by threat actors for various malicious purposes, including C2, data exfiltration, or bypassing network restrictions. The rule consolidates logs from CommonSecurityLog, W3CIISLog, and DeviceNetworkEvents to identify such activity.
This rule detects an unusually high number of network connections made by common package managers (npm, nuget, pip) to their respective repositories. A high volume of connections within a short period (1 hour) could indicate automated activity, potential supply chain compromise, or an adversary attempting to download numerous packages for reconnaissance, staging, or malicious purposes.
This rule detects processes making a high volume of successful network connections to GitHub's raw content (raw.github.com). This behavior can be indicative of an adversary downloading tools, scripts, or other malicious content from GitHub, potentially as part of a command and control (C2) channel or for staging purposes. The rule counts connections per hour per initiating process filename and flags if the count exceeds 5.
Detects a non-cloud client process issuing API-style requests associated with object listing, content upload, or content download to a cloud storage service. The rule specifically targets processes with names matching patterns like 'bird', 'rok', 'game', or 'update' followed by '.exe', and command lines containing API-related keywords ('files/list', 'files/upload', 'files/download', 'oauth', 'bearer', 'api') in conjunction with cloud storage service names ('dropbox', 'pcloud', 'cloud'). This behavior is indicative of malware using legitimate cloud services for command and control or data exfiltration.
Detects a malicious browser extension (ID: flkebkiofojicogddingbdmcmkpbplcd) that masquerades as Perplexity AI. The rule identifies the extension installation followed by a two-hop network redirect sequence: the browser is first directed to a malicious domain (perplexity-ai.online) which logs user metadata, then immediately redirected to a ZIP file download lure on a different domain. This behavior is correlated within a 30-minute window for a specific browser process.
This rule query identifies likely post‑exploitation activity associated with React2Shell (CVE-2025-55182) in which Part 1 identifies web servers spawning unusual child processes (such as command shells or system utilities) combined with suspicious command-line patterns, which may indicate post-exploitation behavior following a compromise. and part 2 detects web servers making outbound network connections to known malicious IPs or hostnames, or to domains associated with tunneling services (e.g., trycloudflare.com), suggesting potential command-and-control activity or data exfiltration.
This rule detects outbound network requests to the Filemail API (specifically '2117.filemail.com/api/file/get') followed by the dropping of a ZIP archive within a 10-minute window by the same initiating process on the same device. This behavior is indicative of the 'Screening Serpens' threat activity, where adversaries use legitimate web services like Filemail to deliver malicious payloads.
Detects Bun beaconing to the checkmarx or kosche C2s, followed immediately by dropping a new .js or .mjs file. This behavior is indicative of a supply chain attack where a compromised Bun package might be attempting to establish C2 communication and then deploy malicious JavaScript files.
Correlates a non-browser headless runtime (Node/Bun) querying the GitHub API for the specific commit 'OhNoWhatsGoingOnWithGitHub'. This could indicate a supply chain attack where malicious code within a Node.js or Bun.js application attempts to communicate with a GitHub dead drop for command and control or data exfiltration.
Detects network traffic to the malicious domain web-telegram[.]ug, which is indicative of Command and Control (C2) communication.
Detects device code authentication via Microsoft Authentication Broker targeting Microsoft Graph, which is a known indicator of Adversary-in-the-Middle (AiTM) attacks or device code phishing.
This rule detects outbound HTTP connections to Cloudflare Workers URLs that match the dynamic, date-derived campaign folder parameters used by the GammaDrop malware. Specifically, it looks for URLs ending with a pattern like '/[A-Za-z0-9-]+/[a-z]+/[0-9]{2}.[0-9]{2}.[0-9]{3}/[0-9]+.(tif|bmp)'. This pattern is indicative of GammaDrop's command and control (C2) communication.
Detects non-Discord processes downloading from Discord CDN attachment endpoints (cdn.discordapp.com/attachments or media.discordapp.net). This activity is often associated with malware families like Lumma and AsyncRAT using Discord CDN to host and deliver stage-2 payloads.
Page 9 of 15