Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,651 detections
Filters
Last updated
All Time
Detection languages
1,772
374
351
273
255
Contributors
908
676
593
359
164
Categories
1,505
1,172
782
528
524
Platforms
39,954
7,270
6,537
3,867
3,651
Products / Services
809
512
432
340
300
MITRE Techniques
1,181
584
528
506
438
CVEs
17
16
9
8
7
IDS Classtypes
41
15
10
6
5
IDS Protocols
47
24
3
2
1
Detects when a Python process spawns a shell or a network utility. This behavior can be indicative of Remote Code Execution (RCE) vulnerabilities being exploited in AI/ML libraries (e.g., CVE-2025-23304, CVE-2026-22584) that allow attackers to execute arbitrary code when a malicious model file is loaded.
This query detects network communication to known Command and Control (C2) IP addresses used by the Medusa ransomware group, often via malicious SimpleHelp RMM servers.
This rule detects network connections from devices to a predefined list of known malicious domains. It identifies attempts by internal systems to communicate with command and control servers, phishing sites, or other infrastructure associated with threat actors.
This rule detects potential command and control (C2) activity by identifying devices that first query 'api.ipify.org' (often used by malware to determine external IP addresses) and then subsequently establish an outbound network connection on port 7712 to a non-private IP address. This sequence of events can indicate a compromised host attempting to beacon out to a C2 server after initial reconnaissance.
This rule detects network connections to the Telegram API endpoint (api.telegram.org) from processes other than common web browsers like Chrome or Edge. This activity could indicate the use of Telegram for command and control, data exfiltration, or other malicious purposes by malware or threat actors.
This rule detects suspicious Launch Daemons on macOS by looking for files created or modified in the `/Library/LaunchDaemons/` directory. It filters out known legitimate binaries and then flags any remaining files that have low global prevalence (less than 2500 instances) and were first seen more than 90 days ago. Additionally, it checks if the certificate is invalid or not signed by Microsoft, indicating potential malicious activity. This rule is intended for hunting and not for direct alerting due to the need for whitelisting.
Detects the installation of malicious npm packages associated with the Shai-Hulud 2.0 supply chain attack campaign.
Detects the DriverFixer0428 macOS credential stealer, attributed to the North Korean 'Contagious Interview' campaign. This rule identifies the malware based on unique internal strings, network IOCs related to Dropbox exfiltration, and social engineering text.
Detects the mass renaming or creation of files with the '.01flip' extension, which is characteristic of the 01flip ransomware. A high count of these files on a single host is a strong indicator of an active ransomware infection.
This rule detects the execution of known proxyware applications such as Infatica, Honeygain, and IPRoyal by looking for specific command-line arguments. Proxyware applications monetize unused internet bandwidth by routing traffic through the user's device, which can pose security and privacy risks.
Detects when a WebKit-based browser process on macOS spawns a shell or script interpreter. This is highly suspicious and can indicate successful exploitation of a browser vulnerability for initial code execution.
Detects the ransom note file 'How To Restore Your Files.txt' created by the RansomHouse 'Mario' encryptor.
Detects Indicators of Compromise (IOCs) associated with React2Shell (CVE-2025-55182) exploitation attempts. This includes network connections to known malicious IP addresses, DNS queries for attacker-controlled domains, process creations involving suspicious command-line arguments (often related to downloading or executing scripts/binaries), and file hashes of known malicious artifacts. The exploit activity is linked to C2 communication, data exfiltration, and potentially cryptomining activities.
This rule detects the presence and activity of the ShadyPanda malware campaign, specifically focusing on malicious Chrome extensions and their associated command and control (C2) and data exfiltration domains. It identifies the creation of files with known malicious Chrome extension IDs (ending in '.crx') and network connections to hardcoded C2 and exfiltration domains linked to the ShadyPanda campaign.
Detects installed Next.js versions < 16.0.7 vulnerable to CVE-2025-55182 (React Flight RCE)
This rule detects the presence and activity of the ShadyPanda malware campaign, specifically focusing on malicious Chrome extensions and their associated command and control (C2) and data exfiltration domains. It identifies the creation of files with known malicious Chrome extension IDs (ending in '.crx') and network connections to hardcoded C2 and exfiltration domains linked to the ShadyPanda campaign.
This rule detects network connections to or DNS requests for known malicious IP addresses and domains associated with phishing campaigns. The domains often mimic legitimate services like Zoom, Microsoft, and Google, indicating potential credential harvesting or malware distribution attempts.
Detects the installation of specific NPM packages that have been identified as compromised by the Shai-Hulud "Second Coming" worm. Installation of these packages can lead to credential theft and further propagation of the malware.
Extremely basic & rough KQL for the purpose of finding if these extension id's are in any folders across your estate.
This rule detects 3 types of suspicious activities: first, the presence of files matching a list of known malicious SHA256 hashes associated with Sha1-Hulud; second, suspicious process behavior involving file deletion commands and third traffic towards potential C2.
Detects network connections to a specific webhook.site URL known to be used by the Shai-Hulud worm for data exfiltration. The rule specifically looks for the URI path 'bb8ca5f6-4175-45d2-b042-fc9ebb8170b7' on webhook.site, which is a strong indicator of this particular threat.
Page 160 of 174