Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,605 detections
Filters
Last updated
All Time
Detection languages
495
433
214
119
105
Contributors
403
350
248
92
65
Categories
20,427
11,813
5,871
5,145
4,864
1,605
Platforms
860
775
236
213
66
Products / Services
469
348
348
319
208
MITRE Techniques
726
541
453
167
163
CVEs
6
5
2
2
2
IDS Classtypes
235
83
34
19
18
IDS Protocols
283
56
51
16
12
Detects Python processes (python.exe, python3.exe, pythonw.exe) performing DNS resolution for Microsoft identity, device login, or Graph API endpoints. This activity is consistent with automated tooling, such as python-requests, performing device-code flow polling or API token authentication within an environment.
Detects network activity (DNS queries, TLS SNI, and HTTP requests) associated with identified 'ShipmentsFree' scam domains. These domains are typically used in phishing or credential harvesting campaigns to trick users into visiting fake account or tracking pages.
Detects network activity (DNS queries, TLS SNI, and HTTP requests) associated with identified 'ShipmentsFree' scam domains. These domains are typically used in phishing or credential harvesting campaigns to trick users into visiting fake account or tracking pages.
Detects network activity (DNS queries, TLS SNI, and HTTP requests) associated with identified 'ShipmentsFree' scam domains. These domains are typically used in phishing or credential harvesting campaigns to trick users into visiting fake account or tracking pages.
Detects DNS queries, HTTP requests, and TLS SNI traffic directed towards the domain 'cloudflare-check.net', which is associated with 'ClickFix' social engineering campaigns used to deceive users into executing malicious code.
This rule detects DNS queries, TLS Server Name Indication (SNI) lookups, and HTTP Host header requests directed towards a list of known domains associated with 'Exvicy' malicious activities (lure domains).
This rule detects DNS queries for domains that are categorized as Newly Registered Domains (NRD) or Newly Observed Domains (NOD) and are using specific Cloudflare nameserver pairs (randy.ns.cloudflare.com and stevie.ns.cloudflare.com). These specific nameservers have been identified as part of the infrastructure used by the Exvicy malware distribution framework to manage its disposable, short-lived domain portfolio.
Detects network activity associated with shellcode staging, specifically requests to the domain 'deadhub.org' or its specific IP address using hardcoded paths that mimic static UI assets. This activity is indicative of a loader fetching malicious fragments for in-memory execution.
This rule monitors endpoint telemetry for known indicators of compromise associated with the Casbaneiro/Ousaban banking trojan. It identifies activity across network connections (IPs and domain patterns), DNS queries for specific C2 domains, and the presence or execution of known malicious file hashes (e.g., PDF lures, HTA, AutoIt scripts, and payload binaries).
Detection of network traffic associated with VelvetCake (Konni) malware, identifying communication with known hardcoded C2 infrastructure, domain lookups, and exfiltration attempts via HTTP/TLS and raw TCP protocols.
Detection of network traffic associated with VelvetCake (Konni) malware, identifying communication with known hardcoded C2 infrastructure, domain lookups, and exfiltration attempts via HTTP/TLS and raw TCP protocols.
This rule detects network activity associated with known command-and-control (C2) infrastructure. It monitors for connections to specific malicious domains, IP addresses, or URI paths combined with unique HTTP headers or request body markers indicative of C2 beacons or data exfiltration.
Detects outbound network traffic (TLS and DNS queries) directed towards AWS S3 endpoints, which may indicate the use of s5cmd or similar tools for unauthorized data exfiltration to cloud storage.
Detects network and DNS activity associated with the SideCopy threat group, specifically monitoring for connections to known C2 domains, C2 IP addresses, or the usage of port 5863 typically associated with the ReverseRAT backdoor.
This rule monitors for user interactions with specific domains and URLs known to be associated with suspicious or malicious activity. It aggregates data from multiple sources, including email clicks (UrlClickEvents), device network activity (DeviceNetworkEvents), device browser events (DeviceEvents), and DNS queries (DnsEvents), to identify potential exposure to these indicators of compromise.
This rule monitors for DNS queries and TLS certificate attributes associated with the SilkParasite threat actor. The rule specifically targets domains that impersonate Central Asian government entities and monitors for suspicious TLS certificate issuers and subjects, indicating potential C2 infrastructure or phishing activity.
Detects network communication associated with the SilkParasite campaign. This includes detection of TLS traffic using self-signed LokiDev certificates (CN=localhost, O=LokiDev), direct connections to known malicious C2 IP addresses, and DNS queries for the domain normativ.dushanbeidc.org, which is linked to the LokiDev infrastructure.
Detects potential cross-family Command and Control (C2) activity by correlating multiple network infrastructure indicators associated with the SilkParasite threat actor. The rule identifies source hosts that interact with at least two distinct indicator sets (specific malicious domains, shared TLS certificates, or cloned homepage content hashes) within a one-hour timeframe.
Detects network communication to known SpiceRAT Command and Control (C2) IP addresses and DNS queries for known SpiceRAT-related domains. The rule identifies potential compromise by flagging outbound traffic or DNS resolutions associated with SpiceRAT infrastructure.
Identifies network communication to known malicious infrastructure used by the SilkParasite threat actor. The rule specifically monitors DNS queries and destination connections to subdomains associated with 'hoster-kg.com' and 'tdtu.org', which are linked to the operation of SpiceRAT, NodeEdgeRAT, and NomadRAT malware.
This rule detects network and email activity associated with a list of known suspicious or 'ghost' domains. It monitors email sender and recipient addresses, email URL links, and DNS query logs for matches against the predefined domain list, identifying potential spearphishing or command-and-control communication.
Page 20 of 77