Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,521 detections
Filters
Last updated
All Time
Detection languages
1,049
575
259
163
130
Contributors
536
485
323
178
133
Categories
1,256
974
852
701
406
Platforms
1,929
373
346
244
20
Products / Services
759
507
254
248
210
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
2,521
CVEs
7
5
4
4
4
IDS Classtypes
201
41
5
4
1
IDS Protocols
175
38
21
9
7
This rule detects unusual network connections from processes to legitimate service endpoints that are commonly abused for Command and Control (C2) activities (LOLC2). It specifically looks for connections to services like Telegram, Slack, Discord, GitHub, Google APIs, Pastebin, Dropbox, and others, originating from processes that are not recognized as legitimate applications for those services, and not from common system processes or standard program file paths. This helps identify potential adversary communication channels masquerading as legitimate traffic.
This rule detects unusual network connections from processes to legitimate service endpoints that are commonly abused for Command and Control (C2) activities (LOLC2). It specifically looks for connections to services like Telegram, Slack, Discord, GitHub, Google APIs, Pastebin, Dropbox, and others, originating from processes that are not recognized as legitimate applications for those services, and not from common system processes or standard program file paths. This helps identify potential adversary communication channels masquerading as legitimate traffic.
This rule detects unusual network connections from processes to legitimate service endpoints that are commonly abused for Command and Control (C2) activities (LOLC2). It specifically looks for connections to services like Telegram, Slack, Discord, GitHub, Google APIs, Pastebin, Dropbox, and others, originating from processes that are not recognized as legitimate applications for those services, and not from common system processes or standard program file paths. This helps identify potential adversary communication channels masquerading as legitimate traffic.
Detects the creation of the ValleyRAT configuration file 'bb.jpg' in the public download directory. This activity is actively associated with Silver Fox (Void Arachne) campaigns targeting South Asia.
On March 11, 2026, the global medical technology giant Stryker experienced a severe cyberattack when Iranian-linked hackers called Handala Hack affiliated with Iranian Ministry of Intelligence and Security (MOIS) used wiper malware to permanently erase data from its network. Based On the List of IOC’s seen from the previous attacks from the threat group I’ve done threat hunt.
Identifies execution of rundll32.exe with WebDAV functionality (davclnt.dll, DavSetCookie) and UNC paths using @port syntax. This behavior is indicative of remote DLL retrieval over HTTP and may be associated with ClickFix variants abusing LOLBins for payload delivery and execution.
This rule detects PolyShell webshell activity on Linux systems, specifically targeting Magento e-commerce platforms. It identifies processes executing from or targeting a suspicious media directory (`/var/www/prod/shared/pub/media/custom_options/quote/i/n/`) in conjunction with `curl` processes retrieving payloads from the `gsocket.io` C2 network. The detection logic combines indicators of webshell presence (execution from a specific directory) with C2 communication (curl to gsocket.io).
Detects the execution of a binary from the path /tmp/pglog, which is used as a
dropper location by the malicious sysmon.py script associated with the TeamPCP
Trivy supply chain malware.
dropper location by the malicious sysmon.py script associated with the TeamPCP
Trivy supply chain malware.
Detects when 'Cursor.exe' (a legitimate application) spawns common command-line utilities (cmd.exe, powershell.exe, pwsh.exe, curl.exe, wget.exe, certutil.exe, bitsadmin.exe) with command-line arguments indicative of downloading files from the internet (e.g., containing 'http://', 'https://', 'ftp://', '-o', '-OutFile', 'iwr', 'DownloadString', 'DownloadFile'). This could indicate malicious activity where 'Cursor.exe' is being abused to facilitate ingress tool transfer or execute malicious payloads.
This detection identifies network requests matching a URL pattern used by the Coruna iOS exploit kit to deliver encrypted binary payloads. The framework generates resource URLs using a 40-character hash and serves them as files ending in ".min.js".
Detects network connections to known LLM/AI API endpoints from processes that are not standard web browsers. This is indicative of the LAMEHUG malware used by APT28, which leverages these APIs to dynamically generate and execute commands.
Detects Cursor IDE spawning download utilities or LOLBins commonly used for
payload staging. Directly maps to the CursorJack technique where a malicious
MCP deeplink encodes a command that downloads and executes a remote payload.
Low false-positive rate — these child processes have no legitimate use when
launched directly by Cursor.
payload staging. Directly maps to the CursorJack technique where a malicious
MCP deeplink encodes a command that downloads and executes a remote payload.
Low false-positive rate — these child processes have no legitimate use when
launched directly by Cursor.
Detects PowerShell commands using Invoke-WebRequest to download and then execute an MSI file, a technique observed in campaigns deploying RMM tools like ScreenConnect and Tactical RMM. This is often done within a single command line or script block.
Detects the Cursor IDE process spawning shell interpreters or
network utilities. This behavior is associated with the CursorJack technique,
where a malicious Model Context Protocol (MCP) server configuration executes
commands for initial access or payload staging.
network utilities. This behavior is associated with the CursorJack technique,
where a malicious Model Context Protocol (MCP) server configuration executes
commands for initial access or payload staging.
Detects silent installation of Cloudflare tunnel client which may establish covert C2 channels
Detects execution of a binary from common staging directories shortly after
creation. Maps to the CursorJack PoC where run.bat drops p.exe to %TEMP%
before execution. Rule is parent-agnostic for broader coverage but should be
correlated with Cursor process activity for highest confidence.
creation. Maps to the CursorJack PoC where run.bat drops p.exe to %TEMP%
before execution. Rule is parent-agnostic for broader coverage but should be
correlated with Cursor process activity for highest confidence.
This file looks for the part of the TrustConnect campaign where a fake work-related app reaches out to download a remote access package. The language in the rule is kept close to the behavior from the report so it does not turn into a generic rule for every support tool. It focuses on a command that pulls a package with the ScreenConnect name while avoiding the official vendor address. That matters because many companies use remote support software for real work, and a broad rule would create too much noise. The point here is to catch the suspicious pattern where a disguised lure app is used to bring in hidden remote access, not to flag normal help desk activity. In plain language, this file tries to spot a download step that fits the fake workplace-software scam described by Microsoft, where something that looks safe or familiar is used to quietly place a control tool on the victim machine.
This rule detects network connections to or from known suspicious IP addresses and requests to known suspicious domains. These indicators are often associated with command and control (C2) activity, malware distribution, or other malicious infrastructure.
Detects the usage of the finger.exe utility with suspicious command line parameters. finger.exe is a legacy Windows tool that is rarely used in modern environments and is being leveraged by the HellsUchecker malware to download malicious batch commands.
Detects 'osascript' (AppleScript) executing 'curl' to download a second-stage payload. This updated rule is tuned to detect specific indicators from a known campaign, such as the use of silent/insecure flags, downloads to hidden script files (e.g., .ex.scpt), or connections to known malicious domains.
This rule detects files associated with two distinct malware chains, ShellFolder and LOTUSLITE, which have been observed in campaigns leveraging Middle East conflict themes as bait. The ShellFolder chain detection focuses on specific file names like 'ShellFolder.exe', 'ShellFolderDepend.dll', and 'BaiNetdisk', along with a unique decryption key '20260301@@@'. The LOTUSLITE downloader chain detection identifies specific DLLs ('libmemobook.dll', 'kugou.dll'), folder paths ('C:\ProgramData\CClipboardCm\', 'C:\ProgramData\WebFeatures\'), executable names ('WebFeatures.exe'), and hardcoded URLs/IP addresses ('www.e-kflower.com', '172.81.60.97') used for persistence and downloading next-stage malware. The rule aims to identify concrete indicators of compromise rather than broad patterns, focusing on the specific artifacts reported in related threat intelligence.
Page 90 of 121