Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
6,223 detections
Filters
Last updated
All Time
Detection languages
2,420
1,435
704
406
354
Contributors
1,092
1,080
584
397
348
Categories
2,145
1,820
1,775
1,301
888
Platforms
4,250
1,450
901
581
181
Products / Services
1,571
855
774
655
512
MITRE Techniques
18,116
15,636
12,583
8,393
6,223
CVEs
9
9
9
9
7
IDS Classtypes
412
174
39
29
25
IDS Protocols
342
113
110
103
15
Detects endpoint and network activity matching known Indicators of Compromise (IOCs) associated with BPFDoor, AVERAT, and Rekoobe backdoors based on Rapid7 research. The query checks for specific file hashes, IP addresses, and domain names across process, file, image load, network, and DNS events.
Detects network connections to known Indicators of Compromise (IOCs) associated with the TraderTraitor campaign, including trojanized Terraform providers (FLATROOF/ROOFDECK malware families) using specific domains and URL paths.
Sweeps Defender XDR telemetry for known NEBULA / KNTRAT indicators (SHA256 hashes, C2 IP, decoy domain and URLs, burner publisher emails). Hash matching is scoped per table (execution hash only in process events), noisy tooling is excluded from command-line matches, network hits are limited to connection events, and results are aggregated per device and IOC.
Sweeps Defender XDR telemetry for known NEBULA / KNTRAT indicators (SHA256 hashes, C2 IP, decoy domain and URLs, burner publisher emails). Hash matching is scoped per table (execution hash only in process events), noisy tooling is excluded from command-line matches, network hits are limited to connection events, and results are aggregated per device and IOC.
Detects outbound network traffic associated with the Azazel operation, including connections to identified C2 infrastructure, open directory/upload listeners, domain-specific staging servers, and exfiltration attempts to MEGA cloud storage endpoints.
Detects repeated octet-stream POST polling of /window.rs (5+ in 20s, alerting once per window), matching the ~3s Mir0Auth session polling while the victim completes device login. SID de-duplicated from another rule.
Detects repeated octet-stream POST polling of /window.rs (5+ in 20s, alerting once per window), matching the ~3s Mir0Auth session polling while the victim completes device login. SID de-duplicated from another rule.
Detects bursts (3+ in 60s) of octet-stream POSTs to URI paths ending in .cs/.go/.rs, matching Mir0Auth XOR-obfuscated C2. Path must be a single short segment and the threshold is raised to cut noise from dev/API traffic.
Detects P7 DarkSword implant C2 beaconing: HTTP/1.0 JSON POSTs to /beacon, /event or /a with the hardcoded iPhone OS 18_5 Safari 18.5 User-Agent. Requires the full combination of protocol version, method, URI, UA and content type, and alerts only after 3 matching requests from one source within 120 seconds (detection_filter) to suppress one-off matches.
Detects endpoint connections to known DarkSword/Coruna exploit-host and C2 infrastructure. The shared AWS IP is only matched on C2 ports 8881/8882 to reduce collateral hits.
Detects endpoint connections to known DarkSword/Coruna exploit-host and C2 infrastructure. The shared AWS IP is only matched on C2 ports 8881/8882 to reduce collateral hits.
Detects devices reaching P7 DarkSword exploit-delivery hosts (cdn/js.gotoiphone.com, mzpo30.cam) and the agdx53.cc C2, with delivery-then-C2 chaining surfaced as the highest-confidence match. Matching is limited to the exact listed hosts and successful/attempted connection events.
Detects devices reaching P7 DarkSword exploit-delivery hosts (cdn/js.gotoiphone.com, mzpo30.cam) and the agdx53.cc C2, with delivery-then-C2 chaining surfaced as the highest-confidence match. Matching is limited to the exact listed hosts and successful/attempted connection events.
Detects HTTP, TLS, DNS, and TCP communication with known AhsayCBS campaign infrastructure and Alibaba OSS storage buckets used for payload delivery.
Detects network communication associated with the Bear C2 framework by identifying specific beacon URI patterns (/beacon?id=<uuid>) and connections to known non-standard listener ports (4321, 8080). The rule also monitors for process command lines containing specific hardcoded identifiers associated with this C2 implant.
This rule detects successful network connections to known malicious IP addresses or the domain 'forgitlab.com', which are associated with the Azazel malware threat infrastructure.
Detects outbound SMTP traffic associated withAVERAT malware, tracking the EHLO sequence, STARTTLS command negotiation, server acceptance, and subsequent custom TLS ClientHello patterns on port 25.
The following analytic detects the use of `bitsadmin.exe` with the `transfer` parameter to download a remote object. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process and command-line telemetry. This activity is significant because `bitsadmin.exe` can be exploited to download and execute malicious files without immediate detection. If confirmed malicious, an attacker could use this technique to download and execute payloads, potentially leading to code execution, privilege escalation, or persistent access within the environment. Review parallel and child processes, especially `svchost.exe`, for associated artifacts.
The following analytic identifies the use of Ldifde.exe, a command-line utility for creating, modifying, or deleting LDAP directory objects. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process execution and command-line arguments. Monitoring Ldifde.exe is significant because it can be used by attackers to manipulate directory objects, potentially leading to unauthorized changes or data exfiltration. If confirmed malicious, this activity could allow an attacker to gain control over directory services, escalate privileges, or access sensitive information within the network.
This detection identifies potentially suspicious usage of sqlcmd.exe, focusing on command patterns that may indicate data exfiltration, reconnaissance, or malicious database operations. The detection looks for both short-form (-X) and long-form (--flag) suspicious parameter combinations, which have been observed in APT campaigns targeting high-value organizations. For example, threat actors like CL-STA-0048 have been known to abuse sqlcmd.exe for data theft and exfiltration from compromised MSSQL servers. The detection monitors for suspicious authentication attempts, output redirection, and potentially malicious query patterns that could indicate unauthorized database access or data theft.
Detects P7 DarkSword implant C2 beaconing: HTTP/1.0 JSON POSTs to /beacon, /event or /a with the hardcoded iPhone OS 18_5 Safari 18.5 User-Agent. Requires the full combination of protocol version, method, URI, UA and content type, and alerts only after 3 matching requests from one source within 120 seconds (detection_filter) to suppress one-off matches.
Page 11 of 297