Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,521 detections
Filters
Last updated
All Time
Detection languages
1,049
575
259
163
130
Contributors
536
485
323
178
133
Categories
1,256
974
852
701
406
Platforms
1,929
373
346
244
20
Products / Services
759
507
254
248
210
MITRE Techniques
18,116
15,638
12,587
8,397
6,227
2,521
CVEs
7
5
4
4
4
IDS Classtypes
201
41
5
4
1
IDS Protocols
175
38
21
9
7
This rule detects communication with known malicious domains and IP addresses, as well as the presence or execution of files with known malicious MD5 or SHA256 hashes. It correlates threat intelligence with network and endpoint telemetry to identify compromised devices or accounts.
This rule detects suspicious command-line activity, specifically file downloads using 'curl' initiated by a web browser. This behavior may indicate malicious JavaScript or HTML triggering command execution, a user being tricked into clicking a link that launches a command, or initial access/payload download in a phishing or drive-by attack.
Detects the PHP variant of the CORNFLAKE.V3 backdoor, which is often dropped as 'config.cfg' and used for C2 communications and payload execution.
This rule identifies file download events initiated by common web browsers such as Microsoft Edge, Internet Explorer, Google Chrome, and Mozilla Firefox. It can be used for hunting suspicious file downloads on devices, especially after an incident alert, or for general threat hunting.
Detects the CloudedHope malware, a 64-bit ELF RAT written in Golang. This malware is used by the China-nexus adversary MURKY PANDA and may be obfuscated with garble.
Detects the SHAMOS installer Bash script used to download and execute the main Mach-O payload. This script is often delivered via malvertising campaigns.
Detects payloads associated with the exploitation of GeoServer vulnerability CVE-2024-36401. This rule identifies both the initial shell script downloaders and the subsequent Dart-based ELF executables.
Detects the PipeMagic backdoor, a modular framework used by Storm-2460. The rule identifies specific hardcoded keys, configuration artifacts, and strings related to its C2 communication and module management.
Detects the NodeInitRAT NodeJS backdoor script used by the Mocha Manakin threat actor. This rule identifies specific strings related to C2 communication, persistence mechanisms, and command execution found within the script.
Detects potential Command and Control (C2) communication patterns based on ASIM-normalized network session data in Microsoft Sentinel. This detection covers three primary patterns:
1) Periodic beaconing with low jitter
2) Long-lived HTTP(S) long-polling sessions
3) Network traffic with very consistent payload sizes
Such patterns can indicate covert communication with compromised systems or malware infections.
1) Periodic beaconing with low jitter
2) Long-lived HTTP(S) long-polling sessions
3) Network traffic with very consistent payload sizes
Such patterns can indicate covert communication with compromised systems or malware infections.
Detects various Indicators of Compromise (IOCs) associated with UAT-7237 activity, including file hashes, IP addresses, domains, and URLs. This rule identifies suspicious process executions based on known malicious file hashes and network connections to malicious IP addresses or URLs.
Detects when the explorer.exe process makes a network connection over SMB to a remote host and subsequently creates an executable file. This behavior is indicative of CVE-2025-50154, where a specially crafted LNK file can cause explorer.exe to silently download a binary from a remote share without user interaction.
Detects suspicious SMB/NTLM activity triggered by explorer.exe following recent .lnk file creation by script engines. This behavior aligns with the CVE-2025-50154 bypass of Microsoft’s NTLM credential leak patch (CVE-2025-24054), allowing zero-click NTLM hash disclosure and remote binary staging without execution.
Detects CurlCat, a custom tool used by the Curly COMrades threat actor for C2 communications. It is characterized by its use of libcurl and a custom Base64 substitution alphabet.
Detects a malicious JavaScript file used in the DarkCloud campaign. This script uses WScript.Shell to execute an obfuscated PowerShell command, which downloads and executes a second-stage .NET payload.
Identifies Ingress Tool Transfer's.
Vidar is a sophisticated infostealer operating as Malware-as-a-Service (MaaS). Written in C++, it’s designed to harvest a wide range of sensitive data from infected systems and exfiltrate it to attacker controlled infrastructure.
🧬 Script Inception: PowerShell scripts nested within PowerShell scripts, layered with 2–3 rounds of Base64 encoding.
📦 RAR Payloads: Password protected RAR files downloaded via direct-to-IP HTTP requests over TCP port 80. Passwords are embedded in encoded scripts and passed via command line to a downloaded copy of "unrar.exe".
🧬 Script Inception: PowerShell scripts nested within PowerShell scripts, layered with 2–3 rounds of Base64 encoding.
📦 RAR Payloads: Password protected RAR files downloaded via direct-to-IP HTTP requests over TCP port 80. Passwords are embedded in encoded scripts and passed via command line to a downloaded copy of "unrar.exe".
Detects suspicious use of curl or wget on Linux systems to download content from external domains. The detection extracts target domains from the command line arguments and filters out known legitimate destinations (e.g., GitHub, Linux package mirrors).
Optionally, it enriches results with data from the ThreatIntelligenceIndicator table to highlight known malicious domains associated with malware, C2, or APT activity. This can be used to prioritize alerts or support automated scoring.
The detection is based on syslog and is designed to reduce noise while preserving high-value findings.
Optionally, it enriches results with data from the ThreatIntelligenceIndicator table to highlight known malicious domains associated with malware, C2, or APT activity. This can be used to prioritize alerts or support automated scoring.
The detection is based on syslog and is designed to reduce noise while preserving high-value findings.
This detection identifies when a user executes a potentially malicious command via the Windows Run dialog (Win+R). It monitors the RunMRU registry key for commands associated with living-off-the-land binaries (LOLBins) and scripting engines like PowerShell, MSHTA, Bitsadmin, and others. Such activity is often a sign of initial access, where an attacker has tricked a user into running a payload downloader or stager command
Detects instances where PowerShell is used to download content from external domains using common web request methods (Invoke-WebRequest, iwr, wget, DownloadFile, DownloadString). This behavior is frequently observed during the initial stages of malware delivery, including payload staging or C2 beaconing. The rule excludes known benign sources like slackb.com/error and chocolatey and filters out system-level accounts to reduce false positives.
This rule detects suspicious network connections to Dropbox API endpoints (api.dropboxapi.com or content.dropboxapi.com) originating from any executable that is not the legitimate Dropbox application. This behavior can indicate an adversary using a non-standard or malicious process to exfiltrate data or establish command and control via Dropbox.
Page 103 of 121