Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,152 detections
Filters
Last updated
All Time
Detection languages
683
377
342
230
173
Contributors
630
378
354
145
119
Categories
839
831
746
393
348
Platforms
1,585
586
494
263
118
Products / Services
10,665
9,758
6,693
4,421
3,749
2,152
MITRE Techniques
655
561
383
337
286
CVEs
32
20
8
7
6
IDS Classtypes
65
32
23
19
14
IDS Protocols
47
38
30
30
12
This rule detects outbound network connections from a Linux system to known Monero crypto mining pools. The detection is based on a predefined list of destination hostnames associated with various Monero mining operations. This activity is indicative of resource hijacking, where a system's computational resources are illicitly used for cryptocurrency mining.
Detects exploitation attempts targeting the TerraMaster TOS vulnerability CVE-2020-28188. This rule specifically looks for GET requests to '/include/makecvs.php' with a '?Event=' parameter, combined with common command injection payloads such as 'curl', 'wget', '.py', '.sh', 'chmod', or '_GET' in the URI query.
Detects Baby Shark C2 Framework default communication patterns
Detects strings used in command execution in DNS TXT Answer
Detects WebDav DownloadCradle
Detects an executable initiating a network connection to "ngrok" tunneling domains.
Attackers were seen using this "ngrok" in order to store their second stage payloads and malware.
While communication with such domains can be legitimate, often times is a sign of either data exfiltration by malicious actors or additional download.
Attackers were seen using this "ngrok" in order to store their second stage payloads and malware.
While communication with such domains can be legitimate, often times is a sign of either data exfiltration by malicious actors or additional download.
Detects suspicious DNS queries known from Cobalt Strike beacons
Detects suspicious DNS queries to api.telegram.org used by Telegram Bots of any kind
Ensure that all account usernames and authentication credentials are transmitted across networks using encrypted channels.
Ensure that an encryption is used for all sensitive information in transit. Ensure that an encrypted channels is used for all administrative account access.
Ensure that an encryption is used for all sensitive information in transit. Ensure that an encrypted channels is used for all administrative account access.
Detects User Agent strings that end with an equal sign, which can be a sign of base64 encoding.
Page 103 of 103