Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,154 detections
Filters
Last updated
All Time
Detection languages
683
379
342
230
173
Contributors
630
378
354
145
119
Categories
841
831
746
393
348
Platforms
1,587
586
494
263
118
Products / Services
10,683
9,759
6,695
4,421
3,750
2,154
MITRE Techniques
655
561
383
337
286
CVEs
32
20
8
7
6
IDS Classtypes
65
32
23
19
14
IDS Protocols
47
38
30
30
12
This rule detects anomalous DNS query activity that may indicate command and control (C2) or data exfiltration over the DNS protocol. It monitors for three specific indicators: excessive query volume to a single domain family within a short timeframe, the use of abnormally long DNS subdomain labels, and the transmission of TXT record queries from endpoints not acting as designated DNS servers.
Detects periodic beaconing behavior associated with a Lambsys Go-based implant communicating with a specific C2 IP address (83.142.209.214) over HTTP. The rule identifies POST requests to specific paths ('/status.php' or '/setup_status.php') using the 'Go-http-client/1.1' User-Agent, with evidence of repeated connection attempts.
Malvertising loader delivering CastleStealer via malicious Google Ads
IoT botnet malware family used for DDoS and proxy infrastructure
Photo-themed ZIP phishing campaign dropping a Node.js implant
Stealthy backdoor MLTBackdoor linked to KongTuke ClickFix and ModeloRAT campaigns
Lightweight remote access trojan deployed in recruiter-themed social engineering
Cloud extortion group exploiting exposed credentials and storage
Latin American banking trojan using DLL side-loading and overlay attacks
Detects POST requests to vLLM multimodal inference endpoints that contain 'video_url' fields pointing to external resources or specific video file extensions (.jp2, .mov, .mp4). This activity is indicative of exploitation attempts related to CVE-2026-22778, where an attacker might try to inject malicious video URLs to trigger vulnerabilities in the vLLM service.
Banking trojan and loader using malicious Office macro delivery
Dridex C2Beacon
YARA
Banking trojan and loader using malicious Office macro delivery
Form-grabbing and credential stealing malware-as-a-service
Banking trojan and loader using malicious Office macro delivery
AI-powered phishing-as-a-service abusing device-code authentication
Credential and browser data stealer distributed via OXLOADER campaigns
Credential and browser data stealer distributed via OXLOADER campaigns
Detects network activity and DNS queries associated with known TA4922 command-and-control infrastructure, including specific domains and IP addresses. It also employs behavioral analysis to identify beaconing patterns from processes that are not identified as standard web browsers or authorized system/application utilities.
Detects DNS resolution attempts or direct network connections to the domain 'vtps.us', which is associated with TA4922 command and control (C2) infrastructure.
Detects instances where a non-standard browser process accesses sensitive browser credential files (e.g., Login Data, Cookies, key4.db) and simultaneously establishes a network connection to Discord or transmits data to a Discord webhook. This pattern is consistent with infostealer malware attempting to exfiltrate cached credentials via external services.
Detects the presence and activity of Tailscale VPN, including process execution, command-line arguments, network connections to Tailscale infrastructure, and communications within the Tailscale CGNAT address range (100.64.0.0/10). This rule identifies the potential use of Tailscale for tunneling or remote access, which may be unauthorized in some environments.
Page 60 of 103