Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,605 detections
Filters
Last updated
All Time
Detection languages
495
433
214
119
105
Contributors
403
350
248
92
65
Categories
20,427
11,813
5,871
5,145
4,864
1,605
Platforms
860
775
236
213
66
Products / Services
469
348
348
319
208
MITRE Techniques
726
541
453
167
163
CVEs
6
5
2
2
2
IDS Classtypes
235
83
34
19
18
IDS Protocols
283
56
51
16
12
Detects DNS resolutions for Microsoft Graph API endpoints (graph.microsoft.com) initiated by processes other than standard, expected Microsoft applications (e.g., Outlook, Teams, OneDrive). This behavior may indicate unauthorized processes or potential beaconing/C2 activity masquerading as legitimate Microsoft cloud service traffic.
Detects network activity and HTTP traffic associated with the Iron Man System kit, specifically targeting hardcoded C2 infrastructure (IP-based) and lure domain patterns involving specific brand tokens combined with disposable TLDs.
Detects DNS queries, HTTP host headers, and TLS SNI traffic associated with the SilverFox relay and dispatch infrastructure. These indicators are commonly used by the SilverFox malware for command and control (C2) communications.
Detects outbound network communication attempts by the SilverFox malware to known Cloudflare Workers relay infrastructure, specifically targeting hostnames associated with 'noah-relay' instances. The rule monitors DNS lookups, TLS SNI headers, and HTTP Host headers to identify potential Command and Control (C2) traffic.
Detects DNS queries and TLS SNI traffic directed towards known phishing domains associated with credential harvesting campaigns (specifically those attributed to Storm-3121/Storm-3032). These domains are used to lure users into providing credentials under the guise of SSO or passkey setup.
This rule monitors network traffic, DNS queries, and user web clicks to detect interactions with known malicious domains associated with credential harvesting and phishing campaigns, specifically those impersonating security or SSO portals.
This rule detects DNS queries for suspicious domains that mimic MFA or passkey registration portals. Such domains are often used in phishing campaigns to lure users into registering their credentials or security tokens on adversary-controlled infrastructure.
This rule detects activity associated with the 'Ghostcode' threat campaign by monitoring multiple telemetry sources. It identifies connections to known malicious IP addresses and domains, patterns consistent with phishing kit hosting, and specific URL structures used in credential harvesting or payload delivery. The rule correlates sign-in logs, device network events, DNS queries, and email telemetry to identify potential compromise.
Detects network activity associated with the DarkMe RAT, including DNS lookups for its known C2 domain 'thatawful.boutique' and outbound TCP connections to a hardcoded non-standard port (7712) at a known malicious C2 IP address.
This rule monitors for DNS queries and network traffic directed toward specific domains and subdomains identified as associated with the SpiceRAT, NodeEdgeRAT, and NomadRAT malware infrastructure. It correlates data from DNS events and general security/network logs to detect potential command and control (C2) communication patterns, regardless of specific source IP overlap.
Detects network communication associated with the Casbaneiro (Metamorfo) banking trojan, specifically identifying DNS queries, TLS SNI headers, HTTP Host headers, and direct IP connections to known malicious C2 infrastructure.
Detects network communication associated with the Casbaneiro (Metamorfo) banking trojan, specifically identifying DNS queries, TLS SNI headers, HTTP Host headers, and direct IP connections to known malicious C2 infrastructure.
This rule monitors endpoint telemetry for known indicators of compromise associated with the Casbaneiro/Ousaban banking trojan. It identifies activity across network connections (IPs and domain patterns), DNS queries for specific C2 domains, and the presence or execution of known malicious file hashes (e.g., PDF lures, HTA, AutoIt scripts, and payload binaries).
This rule monitors for user interactions with specific domains and URLs known to be associated with suspicious or malicious activity. It aggregates data from multiple sources, including email clicks (UrlClickEvents), device network activity (DeviceNetworkEvents), device browser events (DeviceEvents), and DNS queries (DnsEvents), to identify potential exposure to these indicators of compromise.
Detects DNS queries, TLS SNI headers, and HTTP host headers associated with identified C2 infrastructure for NetSupport Manager malware, specifically domains themed around 'GTA6'. These indicators are used by attackers for command and control communication.
Detects network DNS queries to known SpiceRAT-associated hostnames that resolve to specific C2 IP addresses. The rule identifies suspicious network activity by aggregating resolution counts and monitoring for connections to multiple dispersed IPs, which is consistent with command-and-control behavior.
Detects anomalous DNS query patterns where a single host resolves multiple unique subdomains associated with Dahua or QuickDDNS services. This behavior is indicative of passive reconnaissance, often used to map public-facing IoT devices such as cameras and DVRs.
Detects network traffic associated with SilkParasite SpiceRAT malware, including direct IP connections, DNS queries for known malicious domains, and corresponding TLS SNI or HTTP Host header metadata indicating command-and-control (C2) activity.
Detects DNS queries originating from internal hosts to subdomains of 'hoster-kg.com' or 'tdtu.org'. These parent domains are identified as hosting C2 infrastructure for various malware families, including SpiceRAT, NodeEdgeRAT, and NomadRAT, and are likely used to facilitate adversary command and control activities.
Detects network traffic (DNS queries, TLS SNI, and HTTP Host headers) targeting the domain 'expresshost.cloud', which is identified as hosting VPS infrastructure commonly used for scanning and malicious activities.
Detection rules identifying suspicious communication patterns associated with Dahua P2P Cloud Relay devices, including WSSE authentication attempts and device probing to known cloud relay endpoints. These patterns are consistent with reconnaissance and exploitation activity against IoT devices within the context of Operation CameraSwarm.
Page 22 of 77