Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,605 detections
Filters
Last updated
All Time
Detection languages
495
433
214
119
105
Contributors
403
350
248
92
65
Categories
20,427
11,813
5,871
5,145
4,864
1,605
Platforms
860
775
236
213
66
Products / Services
469
348
348
319
208
MITRE Techniques
726
541
453
167
163
CVEs
6
5
2
2
2
IDS Classtypes
235
83
34
19
18
IDS Protocols
283
56
51
16
12
Detects Python scripts or interpreters executing network connections while residing in or interacting with non-standard, potentially suspicious directories or domains. This rule specifically monitors for Python processes (python.exe, pythonw.exe) associated with 'Traiolx Custom Utils', paths within 'AppData\Roaming\python', or network interactions with 'birdeemusic.com' and a specific hardcoded IP address, which are indicative of potential beaconing or command and control activity.
Detects activity associated with a specific phishing campaign distributing 'Distribution Settlement Agreement' PDF lures. The rule monitors for file creation or execution of files matching this naming pattern, as well as network connection attempts to domains identified as related to the threat actors: 'gasparinutrition.com' and 'gappssmtp.com'.
This rule detects potential command and control (C2) activity by identifying specific DNS queries to known malicious domains or suspicious network-related processes executing on an endpoint. It flags DNS requests for 'birdeemusic.com' and network connections initiated by processes with names indicative of custom or potentially malicious payloads like '_socket.pyd' or 'Traiolx Custom Utils'.
Detects the presence or activity of a known malicious Chromium-based browser extension (Perplexity AI imposter, ID: flkebkiofojicogddingbdmcmkpbplcd) through monitoring file system changes in browser directories, registry modifications, or network communication with identified command-and-control infrastructure.
Detects specific suspicious processes (MediumInstStart.exe or pcl2bmp.exe) initiating network connections or DNS requests to identified malicious IP addresses (188.208.141.177) or domains (couldinstallup.com, workdrive.zoho.com, zohoapis.com) within a one-hour window. These processes are indicative of potential malware or unauthorized C2 activity.
Detects malicious network connections initiated by wscript.exe or cscript.exe, or file creation events involving known LCRYX malware payloads in the C:\Windows\ directory. It also includes network-level detection using DNS and firewall/proxy logs for known LCRYX malicious domains and IP addresses.
Detects outbound network connections to specific cloud storage providers (Wasabi, Tebi, I3Storage) which are commonly leveraged by adversaries for data exfiltration.
Detects network traffic to Cloudflare-hosted services (trycloudflare.com, workers.dev) potentially indicative of C2 communication, especially when initiated by common scripting or proxy processes like powershell.exe, wscript.exe, cscript.exe, mshta.exe, or cloudflared.exe.
This rule monitors network traffic for DNS queries directed at domains associated with known malicious browser extensions, specifically targeting Adblock for YouTube and Adblock for Chrome malicious variants. It correlates these connections with process command line evidence that matches the extension IDs of these malicious components.
This rule detects network connections and DNS requests to specific domains associated with Unistream SDK and other known BadBlocker malware infrastructure, often linked to malicious browser extensions such as Adblock for YouTube and related variants.
Detects DNS resolutions for major AI/LLM provider domains (e.g., OpenAI, Anthropic, Google AI) originating from processes that are not common, known browsers or development tools. This behavior is indicative of potentially malicious applications or malware using AI APIs for automated tasks, such as content exfiltration or sophisticated C2 communication.
Detects suspicious execution of command-line tools like curl, wget, or PowerShell to query OAuth/token-related endpoints (e.g., /token, oauth, access_token). The rule filters out expected parent processes (e.g., shells, IDEs, common build tools) to identify potentially malicious attempts to steal application access tokens.
Detects DNS queries to known StegoAd command-and-control domains 'liveupdt.com' and 'dealctr.com'. These domains are used by the StegoAd campaign to deliver steganographic payloads and push malicious JavaScript to compromised browser extensions.
This rule detects DNS requests initiated by common web browsers (chrome, msedge, brave, chromium) to a known malicious domain 'perplexity-ai.online', which is often indicative of C2 callback activity.
Detects activity associated with the StegoAd browser extension campaign. This rule monitors for the registration of new browser extensions in Chrome or Edge, followed by suspicious browser-based network activity including DNS queries to known C2 infrastructure or the loading of specific WebP files used for steganographic payload delivery.
This rule detects network activity associated with a known malicious domain 'facture-in.pages.dev' or suspicious HTTP response patterns often observed in phishing kits or web-based redirection, such as 'BOT BLOCKED', 'no_mouse', 'wrong_timezone', or specific language-localized error messages.
This rule detects potential command and control (C2) activity associated with the BTMOB Remote Access Trojan (RAT). It monitors for suspicious network behavior by correlating DNS requests to ip-api.com (a common geolocation service used by malware to identify the victim's location/public IP) with subsequent C2 communication to cloud services (Google Pub/Sub, Azure MQTT) or non-standard network traffic on port 3478 (often used for STUN/NAT traversal, but excluded for known browsers and communication tools) within a 30-minute window.
This rule monitors DNS traffic for queries to the domain 'chongdaotang.net', which is associated with a phishing campaign leveraging legal threat lures to harvest credentials. Detecting these queries indicates that a host in the network is attempting to resolve a domain used in a known credential harvesting attack.
Detects DNS TXT queries for the domain '_axiom-config.m100.cloud', which is associated with fileless payload retrieval techniques.
This rule detects potential Command and Control (C2) communication activity by identifying instances of Domain Generation Algorithms (DGA). It monitors DNS query responses for patterns consisting of 8 to 16 lowercase alphabetic characters followed by common TLDs (com, net, org, ru, cc, su). An alert is triggered if 5 or more unique suspicious domains are queried by the same device within a one-hour window.
This rule detects activity associated with a known malicious campaign involving 'Photo ZIP' themed lures. It identifies DNS queries to actor-controlled domains, the spawning of PowerShell by Explorer.exe with command lines referencing photo-related filenames or external file-sharing services, and the subsequent downloading of the node.exe runtime to user-accessible directories (consistent with TonRAT delivery).
Page 47 of 77