Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
6,223 detections
Filters
Last updated
All Time
Detection languages
2,420
1,435
704
406
354
Contributors
1,092
1,080
584
397
348
Categories
2,145
1,820
1,775
1,301
888
Platforms
4,250
1,450
901
581
181
Products / Services
1,571
855
774
655
512
MITRE Techniques
18,116
15,636
12,583
8,393
6,223
CVEs
9
9
9
9
7
IDS Classtypes
412
174
39
29
25
IDS Protocols
342
113
110
103
15
Detects one internal host repeatedly triggering DNS threat blocks. A single block is
routine background noise; the same host blocked repeatedly means something on it
keeps trying to reach hostile infrastructure, which indicates a persistent infection
rather than a passing click.
The block itself is not reassuring: it tells you the host is compromised, only that
this particular channel failed.
Onboarding: INFOBLOX is ingested via Syslog (CEF) (Bloo extractor 155).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=threat where sourcename='INFOBLOX' and action='THREAT_BLOCKED'
| duration 1h
| groupby srcip
| select srcip, count(*) as cnt
| having cnt > 10
routine background noise; the same host blocked repeatedly means something on it
keeps trying to reach hostile infrastructure, which indicates a persistent infection
rather than a passing click.
The block itself is not reassuring: it tells you the host is compromised, only that
this particular channel failed.
Onboarding: INFOBLOX is ingested via Syslog (CEF) (Bloo extractor 155).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=threat where sourcename='INFOBLOX' and action='THREAT_BLOCKED'
| duration 1h
| groupby srcip
| select srcip, count(*) as cnt
| having cnt > 10
Detects commands or file-write activity that configures a Tor ExitPolicy matching distinctive policy templates (Policy A or Policy B), indicating potential Tor relay or bridge deployment.
Detects commands or file-write activity that configures a Tor ExitPolicy matching distinctive policy templates (Policy A or Policy B), indicating potential Tor relay or bridge deployment.
Detects the execution of potential tunneling tools from temporary directories (/tmp, /dev/shm, /var/tmp) using characteristic CLI arguments such as --listen, --token, --obfs, and --ws-path, or the known binary name 'ingredi_ws'.
The following analytic identifies ICMP traffic to external IP addresses with total bytes (sum of bytes in and bytes out) greater than 1,000 bytes.
It leverages the Network_Traffic data model to detect large ICMP packet that aren't blocked and are directed toward external networks. We use All_Traffic.bytes in the detection to capture variations in inbound versus outbound traffic sizes, as significant discrepancies or unusually large ICMP exchanges can indicate information smuggling, covert communication, or command-and-control (C2) activities.
If validated as malicious, this could signal ICMP tunneling, unauthorized data transfer, or compromised endpoints requiring immediate investigation.
It leverages the Network_Traffic data model to detect large ICMP packet that aren't blocked and are directed toward external networks. We use All_Traffic.bytes in the detection to capture variations in inbound versus outbound traffic sizes, as significant discrepancies or unusually large ICMP exchanges can indicate information smuggling, covert communication, or command-and-control (C2) activities.
If validated as malicious, this could signal ICMP tunneling, unauthorized data transfer, or compromised endpoints requiring immediate investigation.
Detects potential data exfiltration activity where a device first exhibits usage of a remote monitoring and management (RMM) tool, followed by the execution of known data transfer or exfiltration utilities such as WinSCP or Rclone.
Detects SSH clients launched with reverse (-R) or dynamic (-D) port
forwarding flags, a hallmark of tunnel establishment used to pivot into internal
networks or expose internal services through a compromised host. The Blinder
Tunnel campaign leverages SSH tunneling to encapsulate C2 and lateral movement
traffic inside an allowed protocol.
forwarding flags, a hallmark of tunnel establishment used to pivot into internal
networks or expose internal services through a compromised host. The Blinder
Tunnel campaign leverages SSH tunneling to encapsulate C2 and lateral movement
traffic inside an allowed protocol.
Detects instances where package managers (pacman, makepkg, yay, paru) or their children spawn a root shell that downloads and executes external scripts via curl or wget.
Detects PowerShell processes spawned by common managed file transfer (MFT) or web service processes (such as Serv-U, GoAnywhere, MOVEit, Cleo, Tomcat, etc.) performing remote system discovery or ingress tool transfer activities.
Detects the AdFection multi-stage infection chain where a device sequentially contacts advertising infrastructure, Candiru validator servers, exploit servers, and Candiru Command and Control domains within a short time window.
Sweeps DNS, endpoint network and proxy/firewall telemetry for BraZetsu C2, panel and shop domains using exact or subdomain matching. The apex installscenter.com remains active on Cloudflare with wildcard certificates.
Detects network, file, process, and email interactions associated with known IOCs related to Power BI phishing and rogue ScreenConnect campaigns over a 30-day lookback period.
Detects endpoint connections to known DarkSword/Coruna exploit-host and C2 infrastructure. The shared AWS IP is only matched on C2 ports 8881/8882 to reduce collateral hits.
Detects the execution of potential tunneling tools from temporary directories (/tmp, /dev/shm, /var/tmp) using characteristic CLI arguments such as --listen, --token, --obfs, and --ws-path, or the known binary name 'ingredi_ws'.
The following analytic detects potential reverse shell activity by identifying connections involving ports commonly associated with remote access tools, shell listeners, or tunneling utilities.
It leverages Cisco Secure Firewall Threat Defense logs and monitors destination ports against a list of non-standard, high-risk port values often used in post-exploitation scenarios.
Adversaries frequently configure tools like netcat, Meterpreter, or other backdoors to listen or connect over uncommon ports such as 4444 or 2222 to bypass standard monitoring and firewall rules.
It leverages Cisco Secure Firewall Threat Defense logs and monitors destination ports against a list of non-standard, high-risk port values often used in post-exploitation scenarios.
Adversaries frequently configure tools like netcat, Meterpreter, or other backdoors to listen or connect over uncommon ports such as 4444 or 2222 to bypass standard monitoring and firewall rules.
Detects network connections to known Indicators of Compromise (IOCs) associated with the TraderTraitor campaign, including trojanized Terraform providers (FLATROOF/ROOFDECK malware families) using specific domains and URL paths.
Sweeps proxy, firewall and endpoint network telemetry for requests to the three published BraZetsu Pastebin dead-drop raw URLs used to retrieve the XOR-encrypted C2 config.
Detects network, file, process, and email interactions associated with known IOCs related to Power BI phishing and rogue ScreenConnect campaigns over a 30-day lookback period.
Detects the Shai-Hulud tensorlake payload pattern of fetching a platform-specific HackBrowserData binary and then executing it on the same host to dump browser-stored credentials. Anchored on tool behavior (download then execution on one host) rather than a single sample hash or the rotating C2 domain.
Detects network, DNS, email, and URL click events matching known IOC domains associated with AdFection, Candiru, and Discover-Tech threat intelligence reports.
Detects process execution where a shell (such as bash, zsh, cmd, or powershell) is spawned by a skill or openclaw process, and subsequently performs download activities (e.g., using curl, wget, invoke-webrequest) or establishes persistence (e.g., via cron, systemd, registry run keys, schtasks).
Page 6 of 297