Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,594 detections
Filters
Last updated
All Time
Detection languages
2,463
65
36
12
11
Contributors
991
707
594
140
61
Categories
2,159
1,453
1,273
576
444
Platforms
2,418
272
203
71
63
Products / Services
10,683
9,759
6,695
4,421
3,750
2,594
MITRE Techniques
808
512
383
246
210
CVEs
18
12
12
12
10
IDS Classtypes
1,144
447
282
188
105
IDS Protocols
1,378
413
318
209
34
Detects network communication associated with the Casbaneiro (Metamorfo) banking trojan, specifically identifying DNS queries, TLS SNI headers, HTTP Host headers, and direct IP connections to known malicious C2 infrastructure.
Detects network activity associated with the SloppyRAT malware, specifically identifying C2 authentication attempts via HTTP POST requests containing specific headers and user-agent strings, as well as TLS connections to known malicious domains and IP addresses.
Detects periodic outbound HTTP POST requests consistent with C2 beaconing behavior associated with the Latrodectus malware. The rule identifies multiple POST requests occurring within a 10-minute window, a pattern often used by Latrodectus for command-and-control heartbeats.
Detects outbound TCP traffic originating from internal hosts to known command and control infrastructure associated with the SilkParasite campaign and the SpiceRAT malware family.
Detects repeated authentication login attempts (opcode 0xA0) against Dahua Easy4IP devices over TCP port 37777, indicative of a brute-force or credential stuffing attack.
Detects Remote Desktop Protocol (RDP) traffic occurring over non-standard high ports (64350, 64330, 65535, 65111, 61256), which is indicative of SilkParasite C2 activity or potentially malicious lateral movement attempting to bypass standard port monitoring.
Detects network traffic involving TLS certificates that impersonate the Uzbekistan state railway authority, specifically using certificates issued by 'TLC DV TLS CA' or specific known malicious certificate fingerprints. This activity is attributed to the threat actor SilkParasite.
Detects network traffic associated with exploitation attempts against Dahua P2P relay services. The rules monitor for specific URI patterns ('/online/p2psrv/' and '/probe/device/') used to probe the device, as well as traffic containing a hardcoded AES-OFB initialization vector, which indicates attempts to exploit CVE-2025-31702.
Detects network activity associated with the SilkParasite actor's NodeEdgeRAT malware, including DNS queries, TLS SNI, HTTP Host headers, and direct IP connections to the identified command-and-control infrastructure 'hoster-kg.com'.
This rule detects DNS queries for domains associated with the SilkParasite campaign, which leverages typosquatting to impersonate Central Asian government, energy, and telecommunications entities for potential malicious activity.
Detects a sequence of events where a host connects to 'speedtest.net' followed by a burst of outbound SYN packets to TCP port 37777. This pattern may indicate an adversary using legitimate web traffic to calibrate their scanning rate or bypass network controls before performing a targeted scan.
Detects network packets targeting the Dahua SDK service (port 37777) that match the signature of a crafted login request, specifically checking for the 0xFF/0x00 magic header and the 0x00/0xA0 opcode. This pattern is commonly associated with unauthorized authentication attempts, including brute-force attacks or exploitation of known authentication bypass vulnerabilities in Dahua devices.
Detects network traffic and DNS queries associated with the SilkParasite command-and-control (C2) infrastructure. This rule monitors for established RDP-over-TLS connections using non-standard, high-numbered ports and identifies associated DNS lookups for known C2 hostnames.
Detects command-and-control (C2) communication patterns associated with the Graphalgo framework, which utilizes the Arbitrum Sepolia blockchain for dead-drop resolution and task orchestration. The rules monitor for specific JSON-RPC method calls ('eth_call', 'setCPubKey') and repeated polling of contract functions ('serviceData') characteristic of this threat actor's network behavior.
Detects network traffic to GitHub API endpoints that matches patterns indicative of RUSTYSHADE malware communicating with a private repository for command and control. The rule specifically looks for access to repository content paths related to commands, results, heartbeats, screenshots, or information files, coupled with the inclusion of an Authorization token in the HTTP header.
This rule detects network traffic indicative of the SCKIT MemTensor worm establishing a command-and-control (C2) beacon. The detection identifies TLS connections where the Server Name Indication (SNI) matches a specific pattern of a 12-character hexadecimal string followed by .skyleen.fr.
This rule detects network traffic indicative of the SCKIT MemTensor worm establishing a command-and-control (C2) beacon. The detection identifies TLS connections where the Server Name Indication (SNI) matches a specific pattern of a 12-character hexadecimal string followed by .skyleen.fr.
This rule detects network traffic indicative of the SCKIT MemTensor worm establishing a command-and-control (C2) beacon. The detection identifies TLS connections where the Server Name Indication (SNI) matches a specific pattern of a 12-character hexadecimal string followed by .skyleen.fr.
Detects malicious activities associated with the SilkParasite campaign targeting Redis servers. The rules identify the initiation of a 'SLAVEOF' command to a rogue replication host, subsequent handshake (PSYNC/REPLCONF) with an external attacker-controlled node, and the modification of server configuration ('CONFIG SET dbfilename') to potentially facilitate unauthorized file persistence or data exfiltration through the Redis replication mechanism.
This rule detects network traffic patterns associated with the Sauron Loader malware family. It specifically identifies outbound HTTPS beaconing to known malicious C2 domains using the TLS SNI (Server Name Indication) field.
Detects anomalous HTTP POST requests to a suspected C2 endpoint ('/beacon/pre-register') on a typosquatted domain ('thecovnresation') characterized by an application/octet-stream content type, which is indicative of encrypted C2 beacon registration activity.
Page 42 of 124