Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,154 detections
Filters
Last updated
All Time
Detection languages
683
379
342
230
173
Contributors
630
378
354
145
119
Categories
841
831
746
393
348
Platforms
1,587
586
494
263
118
Products / Services
10,683
9,759
6,695
4,421
3,750
2,154
MITRE Techniques
655
561
383
337
286
CVEs
32
20
8
7
6
IDS Classtypes
65
32
23
19
14
IDS Protocols
47
38
30
30
12
Detects repeated restarts of vLLM pods (due to OOMKilled, CrashLoopBackOff, or other failure reasons) that are correlated with a burst of multimodal requests. This pattern can indicate a denial-of-service attack, resource exhaustion, or exploitation of vulnerabilities (such as CVE-2026-22778) targeting the vLLM service, potentially leading to service instability or compromise.
This rule detects command and control (C2) communication patterns associated with the Millenium RAT malware. It identifies suspicious traffic to 'api.telegram.org' utilizing the 'getUpdates' method initiated by processes that do not identify as standard web browsers, as well as traffic directed to the known proxy relay domain '75877.mcdir.me'.
Detects network activity associated with the DcRAT trojan as identified in Operation DragonReturn. This includes outbound network connections to hardcoded C2 port 2671, connections to known malicious IP addresses, and DNS resolutions of identified attacker-controlled C2 domains.
Detects anomalous network traffic patterns communicating with the Telegram Bot API (api.telegram.org) from non-official Telegram processes. The rule identifies potential command and control (C2) activity by analyzing request frequency, specific API method usage (e.g., getUpdates, sendMessage), and beaconing-like behavior.
Detects network traffic using the Generic Routing Encapsulation (GRE) protocol originating from or destined to external (non-private) IP addresses. GRE is often used for tunneling and can be abused to bypass network security controls.
Detects anomalous network traffic patterns indicative of two distinct techniques: P2P injection into Microsoft 365 Copilot search queries and Server-Side Request Forgery (SSRF) leveraging Bing's image search functionality for data exfiltration.
Detects network requests to Google image search containing an 'imgurl' parameter, which can be used by an attacker to exfiltrate data by forcing an external service to crawl a controlled URL containing sensitive information.
Identifies outbound C2 connections to domains generated by MLTBackdoor DGA.
This rule monitors network traffic for suspicious patterns indicating exploitation of LocalStack environments. It detects three primary malicious activities: Velocity Template Language (VTL) injection targeting reflection methods (e.g., ProcessBuilder) for RCE; unauthorized manipulation of API Gateway resources (e.g., creating or modifying deployments) accompanied by IAM scope bypass techniques; and direct execution of RCE-style API triggers against known LocalStack port 4566.
Detects outbound network connections to a known Djinn Stealer C2 IP address (96.126.130.126) on port 58942, utilizing the specific User-Agent 'telemetry-client/1.0' and 'application/octet-stream' content type. This behavior is indicative of data exfiltration of encrypted/compressed archives.
Detects outbound network connections to TCP port 4001, which is the hardcoded default C2 port for SystemBC (Coroxy) malware. The rule identifies suspicious proxy tunnel establishment from Windows workstations, often used by threat actors like Wizard Spider and FIN7 for pre-deployment staging.
Detects network activity associated with Djinn Stealer malware, identifying either direct connections to a known command-and-control (C2) server or HTTP exfiltration attempts using a characteristic User-Agent string and binary content type.
Detects network traffic associated with the EvilTokens phishing kit's 'killed' gate check mechanism. The kit GETs /api/device/gate/<PAGE_ID> with the ngrok-skip-browser-warning header. When the backend returns a killed flag, the phishing page wipes the DOM and renders a fake 'Page Not Found - Microsoft' error to evade analysis or block specific victims.
This rule detects potential cleartext leakage of usernames and passwords over FTP (port 21) by identifying HTTP requests containing common credential-related keywords in the URL, while explicitly excluding HTTPS traffic. This could indicate sensitive information being transmitted insecurely.
This rule detects unauthorized configuration of GRE tunnels on Cisco IOS-XE network devices, potentially indicating persistent command and control (C2) channel establishment via TCL injection or illicit configuration changes involving known attacker infrastructure (62.171.185.97). It correlates network traffic to the attacker IP with process-level activity involving suspicious configuration files, scripts, or device-specific command-line arguments.
Detects unusually large FTP responses containing 'LIST' or 'NLST' commands, potentially indicating an attempt to exploit the Squidbleed vulnerability or similar data exfiltration over FTP. The rule specifically looks for network events on port 21 (FTP) where the action type is 'NetworkSignatureInspected' and the RemoteUrl contains either 'LIST' or 'NLST' with a string length greater than 4000 characters.
Detects host-level evidence of DRAYN malware activity by correlating outbound network connections using a specific websocket-sharp User-Agent to a known command-and-control (C2) IP address with the execution of PowerShell commands performing system UUID fingerprinting (Win32_ComputerSystem).
Detects malicious network connections initiated by wscript.exe or cscript.exe, or file creation events involving known LCRYX malware payloads in the C:\Windows\ directory. It also includes network-level detection using DNS and firewall/proxy logs for known LCRYX malicious domains and IP addresses.
Detects unauthenticated network connections to the Peyara Remote Mouse service on TCP port 1313. This service is known to allow remote control of the host, and such unauthenticated Socket.IO connections are often leveraged by attackers to inject synthetic keyboard events, such as triggering the Windows Start menu.
Detects network traffic associated with DcRAT malware, specifically monitoring outbound connections on port 2671 to external non-private IP addresses, or directly to known malicious infrastructure (223.26.63.40). The rule also identifies potential beaconing behavior by analyzing connection intervals and standard deviation, and flags activity originating from specific autonomous system ranges (AS152194) linked to the threat actor's infrastructure.
Detects outbound network connections to specific cloud storage providers (Wasabi, Tebi, I3Storage) which are commonly leveraged by adversaries for data exfiltration.
Page 63 of 103