Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
6,225 detections
Filters
Last updated
All Time
Detection languages
2,421
1,435
704
406
354
Contributors
1,092
1,080
584
397
348
Categories
2,147
1,820
1,777
1,302
888
Platforms
4,250
1,450
902
582
182
Products / Services
1,571
855
774
655
512
MITRE Techniques
18,116
15,638
12,585
8,395
6,225
CVEs
9
9
9
9
7
IDS Classtypes
412
174
39
29
25
IDS Protocols
342
113
110
103
15
This detection identifies potentially suspicious usage of sqlcmd.exe, focusing on command patterns that may indicate data exfiltration, reconnaissance, or malicious database operations. The detection looks for both short-form (-X) and long-form (--flag) suspicious parameter combinations, which have been observed in APT campaigns targeting high-value organizations. For example, threat actors like CL-STA-0048 have been known to abuse sqlcmd.exe for data theft and exfiltration from compromised MSSQL servers. The detection monitors for suspicious authentication attempts, output redirection, and potentially malicious query patterns that could indicate unauthorized database access or data theft.
Detects P7 DarkSword implant C2 beaconing: HTTP/1.0 JSON POSTs to /beacon, /event or /a with the hardcoded iPhone OS 18_5 Safari 18.5 User-Agent. Requires the full combination of protocol version, method, URI, UA and content type, and alerts only after 3 matching requests from one source within 120 seconds (detection_filter) to suppress one-off matches.
Detects outbound network traffic associated with the Azazel operation, including connections to identified C2 infrastructure, open directory/upload listeners, domain-specific staging servers, and exfiltration attempts to MEGA cloud storage endpoints.
This rule detects anomalous outbound SMTP (port 25) traffic originating from a NetScaler ADC or Gateway appliance. Since these appliances have no legitimate business requirement to initiate outbound SMTP communication, such traffic is a strong indicator of post-compromise activity, potentially used for command and control or data exfiltration.
Detects TLS connections to a specific, potentially adversary-controlled ScreenConnect relay infrastructure endpoint. Adversaries frequently abuse legitimate remote access tools like ScreenConnect for command and control purposes.
This rule monitors network traffic from CommonSecurityLog data to detect bidirectional communication between NetScaler appliances and known malicious infrastructure associated with the CVE-2026-88772 campaign, which is indicative of command-and-control activity.
Detects TLS connections to a specific, potentially adversary-controlled ScreenConnect relay infrastructure endpoint. Adversaries frequently abuse legitimate remote access tools like ScreenConnect for command and control purposes.
This rule detects successful network connections to known malicious IP addresses or the domain 'forgitlab.com', which are associated with the Azazel malware threat infrastructure.
This rule detects successful network connections to known malicious IP addresses or the domain 'forgitlab.com', which are associated with the Azazel malware threat infrastructure.
Detects outbound network traffic associated with the Azazel operation, including connections to identified C2 infrastructure, open directory/upload listeners, domain-specific staging servers, and exfiltration attempts to MEGA cloud storage endpoints.
Detects anomalous HTTP GET requests to the Microsoft Teams trap-exp/tokens endpoint that do not carry the expected 'Teams' user-agent string. This pattern is indicative of the DragonForce backdoor attempting to illicitly request Skype authentication tokens.
This rule detects potential DNS tunneling or beaconing activity by monitoring DNS queries for patterns commonly associated with command and control traffic. It flags anomalous DNS behavior including excessively long query strings, usage of TXT or NULL record types, frequent NXDOMAIN responses, or high volumes of such queries from a single host, which are indicative of data exfiltration or C2 communication via the DNS protocol.
Detects TLS connections to a specific, potentially adversary-controlled ScreenConnect relay infrastructure endpoint. Adversaries frequently abuse legitimate remote access tools like ScreenConnect for command and control purposes.
Detects outbound HTTP POST requests that contain a JPEG file signature ('FF D8 FF') in the body but lack a 'Content-Type' header. This pattern is indicative of potential C2 communication from a loader or malware family attempting to exfiltrate or receive data disguised as an image file while bypassing basic header-based inspection.
This rule monitors network traffic from CommonSecurityLog data to detect bidirectional communication between NetScaler appliances and known malicious infrastructure associated with the CVE-2026-88772 campaign, which is indicative of command-and-control activity.
Detects the execution of known Remote Monitoring and Management (RMM) tools from common staging directories (e.g., Temp, Downloads, AppData) or using command-line arguments indicative of a silent or hidden installation, which is a common pattern for initial access and persistence by adversaries.
This rule detects outbound TLS traffic to the domain 'trace-flow.ru', which is associated with Max Messenger covert telemetry beaconing behavior. The rule inspects the Server Name Indication (SNI) field in the TLS handshake for the specific domain string.
Detects outbound network connections to common TOR entry, guard, or client service ports, or the execution of TOR-related processes. This behavior may indicate an adversary establishing C2 communication channels or attempting to perform anonymized data exfiltration.
Detects network traffic matching the default HTTP check-in pattern of Mythic C2 agents. This rule monitors for POST requests using a specific hardcoded User-Agent string and Content-Type header commonly used in default Mythic agent configurations, indicating a potential active command-and-control session.
Detects specific markers in UDP traffic on ports 3478, 5349, and 443 that are associated with the DragonForce malware's TRN1 C2 beaconing protocol. The rules identify session initiation, task polling, task acknowledgment, and result uploading behaviors.
Detects TLS connections to a specific, potentially adversary-controlled ScreenConnect relay infrastructure endpoint. Adversaries frequently abuse legitimate remote access tools like ScreenConnect for command and control purposes.
Page 12 of 297