Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,605 detections
Filters
Last updated
All Time
Detection languages
495
433
214
119
105
Contributors
403
350
248
92
65
Categories
20,427
11,813
5,871
5,145
4,864
1,605
Platforms
860
775
236
213
66
Products / Services
469
348
348
319
208
MITRE Techniques
726
541
453
167
163
CVEs
6
5
2
2
2
IDS Classtypes
235
83
34
19
18
IDS Protocols
283
56
51
16
12
Detects Python-based command and control activity associated with LegionLoader by monitoring for network connections, DNS queries to specific malicious domains, and file modifications involving '_socket.pyd' within the 'Traiolx Custom Utils' directory path.
Detects evidence of a malicious browser extension, identified by extension ID flkebkiofojicogddingbdmcmkpbplcd, designed to redirect search traffic through a typosquatted domain 'perplexity-ai.online'. The rule monitors for file-system creation of the malicious extension, modifications to browser preferences files, manipulation of system registry keys to enforce the search provider, and outbound network connections to the malicious domain from major web browsers.
Detects network communication associated with BeepRAT, specifically identifying direct TCP connections to a known command-and-control IP address on a non-standard port or DNS requests directed at a specific malicious domain.
Detects network and DNS indicators associated with BeepRAT, including connections to known C2 IP addresses on port 18848, resolution of known C2 domains, and suspicious DNS queries to 'doh.pub' from known loader processes (tcc.exe, HFY.exe).
This rule detects potential command-and-control (C2) activity or data exfiltration by monitoring for first-time DNS resolution of known typosquatted domains targeting 'Perplexity AI', followed by persistent outbound network connections from common web browsers to the same domain family.
Detects fast flux DNS used to rapidly change C2 IP addresses
Detects DNS calculation technique for resolving C2 server addresses
This rule detects DNS requests initiated by the Microsoft Edge browser (msedge.exe) to a specific list of domains identified as potentially malicious or associated with unauthorized activity. It monitors and aggregates these requests to provide visibility into potential command and control or unauthorized communication attempts.
This rule monitors DNS query events to detect internal systems attempting to resolve the domain 'bluegraintours.com', which is indicative of potential command and control (C2) communication or malware activity.
This rule detects suspicious activity involving interaction with the 'perplexity-ai.online' domain and the creation of specific browser extension files, which may indicate browser-based data exfiltration or credential theft. The rule correlates file creation events, DNS queries, and network connections, assigning a higher risk score when multiple indicators are present, particularly when evidence suggests exfiltration of keystroke or search data via web requests.
This rule detects installation artifacts, configuration file modifications, registry changes, and network activity associated with a specific malicious Chromium extension ('flkebkiofojicogddingbdmcmkpbplcd') that hijacks the default browser search provider via declarativeNetRequest rules and communicates with a typosquatted domain 'perplexity-ai.online'.
Detects artifacts and behaviors associated with a malicious Chromium extension identified as 'Search for perplexity ai' (extension ID: flkebkiofojicogddingbdmcmkpbplcd). The rule monitors for unauthorized extension installation, registry modifications to the browser's default search provider settings pointing to a suspicious domain (perplexity-ai.online), and outbound browser network traffic or DNS queries directed toward the same domain for potential data exfiltration.
This rule detects potential command and control (C2) activity associated with a known npm RAT, identified by network connections to specific C2 infrastructure (95.216.92.207:8080) or DNS resolution of 'nvidiadriver.net'. The rule specifically flags these events when performed by common execution tools like 'python.exe' or 'chost.exe', or when the process image is running from a temporary directory, which is a common persistence or execution indicator for malware.
Detects indicators of a specific malicious browser extension, including file-system artifacts (extension directory placement), registry-based persistence mechanisms, and network communication to associated command-and-control (C2) or onboarding domains. The rule specifically monitors for known malicious identifiers related to a typosquatted domain campaign impacting popular web browsers.
Detects DNS queries for 14-character alphanumeric .org domains characteristic of Bumblebee malware's Domain Generation Algorithm (DGA).
This rule detects anomalous DNS query activity that may indicate command and control (C2) or data exfiltration over the DNS protocol. It monitors for three specific indicators: excessive query volume to a single domain family within a short timeframe, the use of abnormally long DNS subdomain labels, and the transmission of TXT record queries from endpoints not acting as designated DNS servers.
This rule detects instances where Windows Script Host (wscript.exe or cscript.exe) initiates a DNS query to 'ip-api.com' within a 5-minute window. This behavior is often associated with reconnaissance activity, where an adversary uses scripts to determine the public IP address or geolocation of the compromised host for C2 registration or environment awareness.
This rule monitors for network connections that occur over non-standard ports (STUN, MQTT) or to specific suspicious IP addresses and domains, while excluding known legitimate user-facing applications. The detection aims to identify potentially malicious command and control (C2) communication or unauthorized network activity performed by non-standard processes.
Detects outbound network communication and DNS queries to cloud service endpoints (Google Cloud Pub/Sub, Azure MQTT, AWS IoT) originated by non-browser and non-cloud processes, which is a technique used by Grandoreiro banking trojan variants that side-load modules to tunnel command-and-control traffic.
Detects behavior patterns associated with the Grandoreiro banking trojan, specifically the use of wscript.exe or cscript.exe to execute VBScript files that perform geolocation checks against ip-api.com, followed by the dropping of an executable file in the user's AppData\Local directory.
Detects a web process modifying a .php file within WooCommerce paths, immediately followed by a DNS resolution for the 'generate.2faplugin.org' domain. This activity is indicative of the ShapedPlugin supply chain compromise where backdoored plugins are distributed, leading to file modification and subsequent communication with a malicious 2FA plugin domain.
Page 51 of 77