Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,605 detections
Filters
Last updated
All Time
Detection languages
495
433
214
119
105
Contributors
403
350
248
92
65
Categories
20,427
11,813
5,871
5,145
4,864
1,605
Platforms
860
775
236
213
66
Products / Services
469
348
348
319
208
MITRE Techniques
726
541
453
167
163
CVEs
6
5
2
2
2
IDS Classtypes
235
83
34
19
18
IDS Protocols
283
56
51
16
12
This rule detects anomalous DNS query activity that may indicate command and control (C2) or data exfiltration over the DNS protocol. It monitors for three specific indicators: excessive query volume to a single domain family within a short timeframe, the use of abnormally long DNS subdomain labels, and the transmission of TXT record queries from endpoints not acting as designated DNS servers.
Detects various pre-execution and environment fingerprinting behaviors indicative of the Grandoreiro banking trojan. This includes WMI-based security product enumeration, execution of unsigned payloads from suspicious AppData paths, detection of security analysis/debugging tools, virtualization environment checks, and C2 communication attempts via geolocation services.
This rule detects DNS queries containing an exceptionally long subdomain label (50 or more characters). Such patterns are often indicative of DNS tunneling techniques where data is encoded within the subdomain portion of a DNS query to bypass network security controls or establish command-and-control channels.
Detects DNS queries with exceptionally long request strings (30 characters or more), which is a common indicator of DNS tunneling or command and control (C2) communication. Adversaries often encode data within the subdomain portion of a DNS query to bypass network security controls.
Detects suspicious behaviors during npm package lifecycle events, specifically node.exe spawning command-line interpreters (cmd.exe, powershell.exe, etc.) or initiating network connections to known malicious or suspicious domains typically associated with npm supply chain attacks.
Detects potential command and control (C2) activity from node.exe to known malicious domains associated with the Polymarket Trap / wshu.net campaign. Additionally, it monitors for suspicious child process spawning by node.exe, including usage of downloader utilities (curl, wget, PowerShell) or execution of downloaded scripts/archives (npm, .tgz files) indicative of malicious post-exploitation activity.
Detects high-entropy algorithmically generated domain names used for C2
Detects instances where a process not typically associated with web browsing performs a DNS request for Telegram (telegram.me) or Steam Community (steamcommunity.com) domains, potentially indicating command and control (C2) or unauthorized data exfiltration activity.
This rule detects network communication (connections, DNS queries, or proxy logs) between endpoints and a list of known malicious domains and IP addresses associated with Mistic and Woodgnat/KongTuke threat families. It identifies these activities across network event logs, DNS queries, and security logs.
Detects DNS queries for domains that are visually or phonetically similar to popular software package registry domains (such as PyPI or npm). These are often used in typosquatting campaigns to trick users or automated systems into downloading malicious packages.
Detects network connections to Zoho WorkDrive or Zoho Accounts from non-standard or suspicious processes. The rule identifies potential unauthorized data exfiltration or cloud access by flagging processes running from temporary or user-writable directories (e.g., AppData, ProgramData), processes known to be associated with specific threats, or processes exhibiting signs of binary sideloading based on their parent process ancestry.
This rule detects potential Bluekit PhaaS C2 infrastructure by identifying fast-flux DNS behavior. It monitors DNS queries for domains associated with Bluekit phishing campaigns and flags instances where a single hostname resolves to a high number of distinct IP addresses (3 or more) within a one-hour window, which is indicative of domain rotation for evasion.
Detects network connection attempts or DNS queries to a set of specific domains ('holabrief.com', 'loopedin.io') that are known to be associated with suspicious activity or potential command and control infrastructure.
This rule detects network connections or DNS requests to the domain 'mitarchive.info', which is associated with known malicious activity. Monitoring for traffic to this domain can help identify hosts that may be compromised or attempting to communicate with an attacker-controlled infrastructure.
Detects DNS resolution and network connections to known infrastructure associated with the StegoAd campaign, including exfiltration (mitarchive.info) and C2 (liveupdt.com, dealctr.com, ipaglov.com) domains. The rule monitors activity from common browser and scripting engine processes.
Detects potential Adversary-in-the-Middle (AiTM) activity by monitoring for suspicious browser process spawning scripting child processes (powershell.exe, wscript.exe, etc.), unusual DNS requests to Microsoft login/Graph API endpoints from scripting hosts, and direct non-browser access to browser cookie database files.
Detects DNS resolution to attacker-controlled AWS S3 buckets masquerading as Outlook/OneDrive service pages used by UNC6692 for phishing delivery, SNOWBELT C2, and credential exfiltration. The rule specifically looks for DNS queries to S3 domains with patterns indicative of spoofed Outlook/OneDrive service pages or specific known malicious S3 bucket names.
This rule detects anomalous network connections or DNS queries to known Ethereum RPC infrastructure providers (Infura, Alchemy, Cloudflare-eth) or ports/domains associated with Ethereum mainnet activity. It specifically targets processes other than common browsers or known blockchain clients, as well as Java-based processes performing DNS lookups for these domains. This behavior is indicative of potential 'EtherHiding' techniques where malicious code or data is hidden within blockchain transactions or distributed via blockchain infrastructure.
Detects DNS queries originating from endpoints to common URL shortening services such as bit.ly, goo.gl, and others. These services are frequently abused by adversaries for C2 communications, distributing malware, or phishing, as they can mask malicious destination URLs.
Detects DNS queries and network connection attempts to a set of known malicious domains associated with the threat actor UNC1151 (Ghostwriter). This rule monitors both DNS resolutions and direct network connection attempts to these indicators of compromise (IOCs), which are commonly used in spearphishing campaigns.
Detects suspicious command execution patterns, including reverse shell techniques (/dev/tcp, bash -i), DNS-based C2 communication (axiom-config, m100.cloud), and fileless payload retrieval (dig TXT queries). It specifically highlights commands initiated by common AI developer tools or runtimes (claude, node, python) that correlate with known adversarial setup scripts or potential prompt injection outcomes.
Page 42 of 77