Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,605 detections
Filters
Last updated
All Time
Detection languages
495
433
214
119
105
Contributors
403
350
248
92
65
Categories
20,427
11,813
5,871
5,145
4,864
1,605
Platforms
860
775
236
213
66
Products / Services
469
348
348
319
208
MITRE Techniques
726
541
453
167
163
CVEs
6
5
2
2
2
IDS Classtypes
235
83
34
19
18
IDS Protocols
283
56
51
16
12
Detects network connections, DNS requests, and HTTP traffic to known Tropic Trooper C2 infrastructure, indicating potential AdaptixC2 or Cobalt Strike beaconing from compromised endpoints.
This rule detects instances where a 'node.exe' process initiates an outbound network connection over HTTPS (port 443) to a domain within the '.vercel.app' top-level domain. This could indicate development activity, but also potential malicious use of Node.js applications for command and control or data exfiltration to cloud services.
Detects DNS requests to the known DinDoor and CastleLoader C2 domain serialmenot[.]com, which is a multi-tenant infrastructure used by Iranian APT actors.
This rule detects DNS queries made to a list of known malicious domains. These domains are often associated with malware command and control (C2) infrastructure or other malicious activities. Monitoring such queries can help identify compromised systems attempting to communicate with adversary-controlled resources.
Detects AdaptixC2 framework behaviors by correlating DNS over HTTPS (DoH) lookups to known providers (dns.google, dns.quad9) with subsequent Beacon Object File (BOF) activities. It specifically looks for the same process performing the DoH lookup and subsequently executing LSASS dumping commands, spawning sacrificial BOF processes, or initiating SMB/WinRM lateral movement.
Detects AdaptixC2 framework behaviors by correlating DNS over HTTPS (DoH) lookups to known providers (dns.google, dns.quad9) with subsequent Beacon Object File (BOF) activities. It specifically looks for the same process performing the DoH lookup and subsequently executing LSASS dumping commands, spawning sacrificial BOF processes, or initiating SMB/WinRM lateral movement.
This rule detects suspicious activity related to a specific IP address (142.11.206.73) in network connections, or a specific domain (sfrclak.com) in DNS requests or process command lines. This could indicate communication with known malicious infrastructure or the execution of malware.
Detects network connections to the known command and control (C2) server and port associated with the compromised axios package payload. This rule specifically looks for network connections or DNS requests to 'sfrclak.com' or connections to IP address '142.11.206.73' on port 8000.
Detects AdaptixC2 framework behaviors by correlating DNS over HTTPS (DoH) lookups to known providers (dns.google, dns.quad9) with subsequent Beacon Object File (BOF) activities. It specifically looks for the same process performing the DoH lookup and subsequently executing LSASS dumping commands, spawning sacrificial BOF processes, or initiating SMB/WinRM lateral movement.
This rule detects DNS requests to domains known to be associated with malicious browser extensions. These extensions often perform command and control (C2) or data exfiltration activities by communicating with these domains. The rule uses a regex to match both the primary domains and their subdomains, aggregating results by host and domain to identify repetitive beaconing.
Detects DNS resolution requests for known Masjesu botnet command and control (C2) domains. Masjesu relies on multiple failover domains to fetch its secondary payload and receive DDoS commands.
Detects DNS requests directed to the cloudapi[.]stream domain, which is associated with a widespread malicious Chrome extension campaign involving over 100 extensions. Monitoring for this specific domain allows defenders to identify compromised hosts regardless of the specific extension ID.
Detects DNS queries initiated by "Regsvr32.exe"
Detects when the Notepad++ updater (gup.exe) makes DNS queries to domains that are not part of the known legitimate update infrastructure.
This could indicate potential exploitation of the updater mechanism or suspicious network activity that warrants further investigation.
This could indicate potential exploitation of the updater mechanism or suspicious network activity that warrants further investigation.
This rule detects DNS requests for domain names that combine Middle Eastern-themed keywords (dubai, emirates, iran, saudi, etisalat) with suspicious or cheap Top-Level Domains (TLDs) such as .top, .cyou, .click, .life, .mom, .sbs, or .xyz. This pattern can indicate potential phishing attempts, malicious infrastructure, or C2 communication attempting to blend in with legitimate traffic by using seemingly relevant but low-cost domains.
This rule detects DNS resolution requests to specific malicious command and control (C2) domains, 'sfrclak.com' and 'callnrwise.com', which have been linked to the 'Axios attack'. Detection of these domains indicates potential compromise and active C2 communication.
Detects network connections to malicious domains, associated IPs, execution of related malicious file hashes, registry persistence, and postinstall script executions related to UNC1069 NPM/Axios supply chain attacks deploying SILKBELL and WAVESHAPER.V2. Categorized into risk-scored scenarios.
Detects indicators of the TeamPCP LiteLLM supply chain compromise. This includes the creation or modification of specific malicious files (litellm_init.pth, tpcp.tar.gz, sysmon.py, sysmon.service), execution of commands related to persistence (systemctl for sysmon.service), data archiving (tar for tpcp.tar.gz), or direct execution of the backdoor (sysmon.py). It also identifies network connections or DNS queries to known command and control (C2) domains (models.litellm.cloud, checkmarx.zone) and HTTP requests to checkmarx.zone. Furthermore, the rule detects unauthorized AWS API calls (ListSecrets, GetSecretValue, DescribeParameters) made using the 'python-urllib' user agent, which is indicative of custom scripting rather than standard boto3 usage.
Detects network connections to a known Sapphire Sleet (APT38) command and control (C2) IP address and port, or DNS resolution requests for a malicious Sapphire Sleet C2 domain. This rule identifies direct communication with infrastructure associated with the Sapphire Sleet threat actor.
Detects EtherRAT-related host and network activity using reported artefacts including a known C2 domain (aurineuroth[.]com), a CDN-like beacon URL pattern, the creation of a svchost.log debug file, and various hidden PowerShell commands for system information discovery (AV, domain, MachineGuid, GPU).
Detects DNS queries to the known command and control domain bad-example-c2.com, converted from a Suricata detection rule.
Page 59 of 77