Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
260 detections
Filters
Last updated
All Time
Detection languages
141
60
21
18
11
Contributors
80
44
20
19
11
Categories
77
69
67
49
37
Platforms
203
56
30
13
11
Products / Services
10,683
9,759
6,695
4,421
3,750
260
MITRE Techniques
75
73
53
41
40
CVEs
8
4
4
3
3
IDS Classtypes
4
1
1
1
IDS Protocols
4
1
Detects network connections to known C2 servers and payload delivery URLs associated with a PureRAT campaign. This activity is linked to a Vietnamese threat actor using AI to generate their toolset.
Detects high-volume vulnerability and spyware threat activity originating from external (UNTRUSTED) sources targeting public-facing IP addresses.
This detection identifies potential exploitation attempts, scanning activity, and malicious payload delivery by monitoring PAN-OS threat logs where severity is not informational and the subtype indicates vulnerability or spyware.
The rule triggers when:
A source IP generates ≥100 reset-both actions within 1 hour (indicative of blocked exploit or aggressive scanning), or
A source IP generates ≥10 non-reset actions within 1 hour (indicative of potentially successful or partially successful attempts)
Enrichment includes ASN, country, organization, and city to support attribution, threat hunting, and blocking decisions.
This detection identifies potential exploitation attempts, scanning activity, and malicious payload delivery by monitoring PAN-OS threat logs where severity is not informational and the subtype indicates vulnerability or spyware.
The rule triggers when:
A source IP generates ≥100 reset-both actions within 1 hour (indicative of blocked exploit or aggressive scanning), or
A source IP generates ≥10 non-reset actions within 1 hour (indicative of potentially successful or partially successful attempts)
Enrichment includes ASN, country, organization, and city to support attribution, threat hunting, and blocking decisions.
Detects a distinctive User-Agent string used by the initial RedLoader DLL for command and control (C2) communications. This activity is associated with the GOLD BLADE threat group (also known as RedCurl).
Detects the unique User-Agent string "A WinHTTP Example Program/1.0" used by the MuddyViper backdoor for C2 communications, as reported in the MuddyWater campaign.
This rule detects the use of common file transfer and remote access protocols (SSH, FTP, SMB, TELNET, FTPS, SMB.v3) communicating over non-standard ports. Adversaries often use non-standard ports to bypass firewall rules, evade detection, or obscure their command and control (C2) traffic. The rule specifically excludes the standard ports for these protocols to focus on anomalous behavior.
This detection rule identifies hosts where data archiving using 7-Zip is closely followed by network traffic to the temp.sh file-sharing service. This correlation suggests a potential data staging and exfiltration sequence, a TTP observed in the Lynx Ransomware campaign.
Detects HTTP/HTTPS POST requests to known Lumma Stealer C2 domain
This query identifies an anomalous pattern associated with behavior performed using the PhaaS platform with adversary-in-the-middle (AiTM) capabilities, Tycoon2FA.
This query identifies an anomalous pattern associated with behavior performed using the PhaaS platform with adversary-in-the-middle (AiTM) capabilities, DadSec.
This detection identifies network traffic to domains explicitly listed as associated with recent phishing campaigns. It specifically looks for these domains within the RequestURL field of logs from Palo Alto Networks or Cato Networks firewalls/proxies.
Detects potential exploitation attempts of Citrix NetScaler vulnerability CVE-2025-5777 (CitrixBleed 2). This involves malformed or unusually large HTTP POST requests to the /p/u/doAuthentication.do endpoint, a technique used by groups like Earth Estries.
Detects communication to known Command and Control (C2) servers associated with the Equation Group, as identified in the operational notes from the ShadowBrokers leak. This rule specifically looks for network connections to or from the hardcoded IP addresses linked to Equation Group C2 infrastructure.
The following analytic detects the use of default or publicly known named pipes associated with Cobalt Strike. It leverages Sysmon EventID 17 and 18 to identify specific named pipes commonly used by Cobalt Strike's Artifact Kit and Malleable C2 Profiles. This activity is significant because Cobalt Strike is a popular tool for adversaries to conduct post-exploitation tasks, and identifying its named pipes can reveal potential malicious activity. If confirmed malicious, this could indicate an active Cobalt Strike beacon, leading to unauthorized access, data exfiltration, or further lateral movement within the network.
Detects potential exploitation of Cisco SNMP vulnerability (CVE-2025-20352) by identifying shell command patterns within SNMP traffic, indicative of remote code execution attempts as seen in Operation Zero Disco.
This analytic detects suspicious data transfer activities involving the use of the `split` syscall with the `-b` option, which specifies the size of each output file. This technique can be used by attackers to evade detection by breaking large files into smaller parts, bypassing size-based security controls, and facilitating covert exfiltration of sensitive data. By monitoring for unusual or unauthorized use of the `split` syscall with a specified block size, this analytic helps identify potential data exfiltration attempts.
This analytic identifies the bulk creation of ransomware notes (e.g., .txt, .html, .hta files) on an infected machine. It leverages Sysmon EventCode 11 to detect multiple instances of these file types being created within a short time frame (10 seconds). A detection is triggered if 15 or more unique readme paths are observed. This activity is a strong indicator of an active ransomware attack, where the attacker is notifying the victim of the encryption. If confirmed malicious, this behavior could lead to widespread data encryption, rendering critical files inaccessible and potentially causing significant operational disruption.
The following analytic detects suspicious attempts to find credentials stored in password stores, indicating a potential attacker's effort to access sensitive login information. Password stores are critical repositories that contain valuable credentials, and unauthorized access to them can lead to significant security breaches. By monitoring for unusual or unauthorized activities related to password store access, this analytic helps identify potential credential theft attempts, allowing security teams to respond promptly and prevent unauthorized access to critical systems and data.
The analytic detects attempts to exploit the Fortinet FortiNAC CVE-2022-39952 vulnerability. It identifies HTTP POST requests to the URI configWizard/keyUpload.jsp with a payload.zip file. This activity indicates an attempt to exploit a known vulnerability, potentially leading to remote code execution. If confirmed malicious, attackers could gain control over the affected system, schedule malicious tasks, and establish persistent access via a remote command and control (C2) server.
The following analytic identifies the execution of RAR utilities to archive files on a system. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names, GUIDs, and command-line arguments. This activity is significant as threat actors, including red-teamers and malware like DarkGate, use RAR archiving to compress and exfiltrate collected data from compromised hosts. If confirmed malicious, this behavior could lead to the unauthorized transfer of sensitive information to command and control servers, posing a severe risk to data confidentiality and integrity.
Detects HTTP responses containing JavaScript associated with ClickFix phishing kits. These kits manipulate the DOM to mimic browser verification pages and trick users into copying and executing malicious commands.
Detects Acreed infostealer's cryptocurrency clipper activity. This rule identifies when a host first communicates with a known Acreed C2 domain (`trustdomainnet.live`) to fetch malicious wallet addresses, and then communicates with a QR code generation API (`api.zile42o.dev`) used to replace legitimate QR codes with malicious ones.
Page 7 of 13