Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,154 detections
Filters
Last updated
All Time
Detection languages
683
379
342
230
173
Contributors
630
378
354
145
119
Categories
841
831
746
393
348
Platforms
1,587
586
494
263
118
Products / Services
10,683
9,759
6,695
4,421
3,750
2,154
MITRE Techniques
655
561
383
337
286
CVEs
32
20
8
7
6
IDS Classtypes
65
32
23
19
14
IDS Protocols
47
38
30
30
12
Detects recurring network connections (beaconing) to domains ending in 'azurewebsites.net' over HTTPS (port 443). The rule identifies potential command and control (C2) behavior by aggregating counts of connections and distinct destination IPs per process and host over time, flagging activity that exhibits regular, repeating patterns.
This rule detects potential DNS hijacking or redirection by comparing the returned IP address from a DNS query against a known list of authoritative IP addresses for specific domains. If an internal DNS resolver returns an IP address that does not match the authoritative record, it flags the event as a potential DNS response mismatch. It includes risk scoring based on the number of distinct affected hosts.
This rule detects network connections to a predefined list of known Microstealer malicious domains. These domains are often associated with malware command and control (C2) infrastructure, phishing, or other malicious activities. Monitoring connections to such domains can help identify compromised systems or active malware infections.
This rule detects network connections or DNS queries to a specific Internet Computer Protocol (ICP) domain and canister ID (tdtqy-oyaaa-aaaae-af2dq-cai.raw.icp0.io or tdtqy-oyaaa-aaaae-af2dq-cai). This pattern is associated with command and control (C2) activity, where compromised systems communicate with an adversary-controlled server.
This rule detects potential enumeration of ServiceNow API endpoints or unauthorized access attempts from a known malicious IP address. It monitors HTTP header events specifically for common ServiceNow API patterns, aggregating requests to identify high-volume activity or interactions with sensitive endpoints like 'related_list_edit'.
Detects an internet-facing host in the DMZ that receives an inbound connection from an external non-RFC1918 address and subsequently authenticates to an internal RFC1918 host within a one-hour window. This behavior is indicative of a compromised DMZ host being used as a pivot point for lateral movement into the internal network.
Detects high-frequency network requests from a single process to potentially sensitive targets such as cloud metadata services (169.254.169.254, metadata.google.internal) or using URL traversal patterns (../, %2e%2e, %2f). This behavior is characteristic of Server-Side Request Forgery (SSRF) attempts, where an attacker tries to access internal resources by forcing an application to make unauthorized requests.
Detects anomalous network traffic patterns from SOHO/IoT and edge devices indicative of Tor-based C2 communication, including DNS queries for .onion domains, outbound connections to known Tor relay ports, and high-volume encrypted traffic over non-standard high-range ports.
Detects high-velocity port scanning bursts from a single source IP address targeting multiple destinations, often indicative of botnet reconnaissance activity such as the JDY botnet used to identify edge devices vulnerable to specific exploits like CVE-2026-35616.
Detects anomalous bulk configuration data collection from Cisco vManage via REST API endpoints typically used by UAT-8616. The rule identifies repeated HTTP GET requests to critical configuration, device, and system information endpoints on port 8443, which may indicate an attacker attempting to export SD-WAN configuration data following an exploitation event.
Correlates phishing email delivery with subsequent communication to attacker-controlled domains.
This rule detects network connections to or from known suspicious IP addresses and requests to known suspicious domains. These indicators are often associated with command and control (C2) activity, malware distribution, or other malicious infrastructure.
This rule detects network connections to a predefined list of known Microstealer malicious domains. These domains are often associated with malware command and control (C2) infrastructure, phishing, or other malicious activities. Monitoring connections to such domains can help identify compromised systems or active malware infections.
Detects a suspected exploitation of CVE-2026-35616 on edge/SOHO devices, followed within 5 minutes by the download of an architecture-specific MIPS dropper via curl or wget, a behavior consistent with known threat activity such as the Volt Typhoon/JDY Botnet.
Detects malicious browser extensions associated with the StegoAd campaign fetching steganographic payloads (WebP/PNG) from known C2 infrastructure. The detection identifies requests originating from a browser extension context (via Referer header) that target specific image files commonly used by the malware for post-compromise staging and execution guardrail fingerprinting.
Detects anomalous bulk GET requests directed at Cisco SD-WAN (vManage) REST API endpoints, specifically targeting topology information, device lists, and configuration templates. This pattern of activity is indicative of reconnaissance or exfiltration attempts against the SD-WAN fabric management interface.
Detects the execution and network activity of known reverse tunneling and proxy tools such as Chisel, Ngrok, and FRP. These tools are commonly abused by adversaries to establish persistence, bypass firewalls, and facilitate command and control (C2) communication. The rule monitors for specific process names, command-line arguments, and DNS requests related to these services.
This rule detects outgoing TCP traffic that initiates a SOCKS5 handshake (indicated by the byte sequence |05 01 00|) on destination ports other than standard web ports (80, 443, 8080, 8443). This behavior is characteristic of TOR client traffic attempting to establish an anonymous connection to an external TOR relay or node via non-standard network ports.
Detects outbound FTP STOR (Store) commands directed to external networks. This indicates that a host inside the local network is attempting to upload data to an external server. The rule uses a threshold to filter out isolated commands, triggering when 3 or more STOR commands are detected within 120 seconds, which is characteristic of data exfiltration or staging behavior.
Detects anomalous ICMP traffic patterns, specifically ICMP Echo Request packets with unusually large payload sizes (dsize > 64) and specific byte signatures consistent with known ICMP tunneling tools such as icmpsh or ptunnel, which are used to establish covert C2 channels.
This rule detects potential command and control (C2) beaconing activity using DNS by identifying high-frequency, long, and random subdomain queries. It monitors for DNS requests that exceed 40 bytes in size, feature complex alphanumeric subdomains, and exceed a defined threshold of 10 requests within a 60-second window, which is indicative of DNS tunneling or command-and-control exfiltration.
Page 54 of 103