Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,605 detections
Filters
Last updated
All Time
Detection languages
495
433
214
119
105
Contributors
403
350
248
92
65
Categories
20,427
11,813
5,871
5,145
4,864
1,605
Platforms
860
775
236
213
66
Products / Services
469
348
348
319
208
MITRE Techniques
726
541
453
167
163
CVEs
6
5
2
2
2
IDS Classtypes
235
83
34
19
18
IDS Protocols
283
56
51
16
12
Detects network connections to known Command and Control (C2) infrastructure associated with the compromised axios NPM package, which was found to drop a Remote Access Trojan (RAT). The rule specifically looks for connections to the IP address 142.11.206.73 or DNS queries for 'sfrclak.com'.
KQL Query
This rule detects DNS requests to the domain 'cloud.es.io'. This domain is associated with Elastic Cloud, and unusual traffic to it could indicate potential data exfiltration, command and control activity, or unauthorized access to Elastic Cloud resources. The rule specifically looks for the 'DnsRequest' event type in raw Falcon data and filters for the specified domain name, then outputs relevant host and network information.
This rule detects network connections and DNS resolution requests to known typosquatted domains used by the TeamPCP threat actor for command and control (C2) and data exfiltration. These domains are associated with a compromised Trivy scanner. Detection indicates successful execution of the compromised scanner and attempted exfiltration.
This rule detects network communication (DNS queries, HTTP requests, or network connections) to the command and control (C2) domain 'checkmarx.zone', which is associated with the TeamPCP threat group. This activity indicates potential compromise or communication with adversary infrastructure.
This rule detects network connections and DNS resolution requests to known typosquatted domains used by the TeamPCP threat actor for command and control (C2) and data exfiltration. These domains are associated with a compromised Trivy scanner. Detection indicates successful execution of the compromised scanner and attempted exfiltration.
This rule detects network connections to suspicious domains or IP addresses associated with potentially compromised or malicious VPN infrastructure. Specifically, it looks for connections to 'vpn-fortinet.com', 'ivanti-vpn.org', 'forticlient-vpn.de', or the IP address '194.76.226.93'. These indicators may suggest attempts to establish command and control, exfiltrate data, or engage in other malicious activities via compromised VPN services.
This Logic detects the presence of the malicious Chrome extension FreeVPN[.]One by identifying its unique extension ID across installed browsers. The logic further correlates this presence with network communications initiated by the extension to suspicious or untrusted domains. By combining extension enumeration with traffic analysis, the detection ensures high fidelity with minimal false positives. This layered approach strengthens visibility into malicious browser add-ons masquerading as VPN tools.
This rule detects network connections or DNS queries to a specific Internet Computer Protocol (ICP) domain and canister ID (tdtqy-oyaaa-aaaae-af2dq-cai.raw.icp0.io or tdtqy-oyaaa-aaaae-af2dq-cai). This pattern is associated with command and control (C2) activity, where compromised systems communicate with an adversary-controlled server.
This rule detects various activities associated with the Kimsuky JavaScript dropper, including DNS requests to known malicious domains, creation of specific files (Themes.js, L298306.tmp), execution of certutil.exe or script.exe for decoding/encoding, suspicious command-line arguments for system information or task listing, and persistence mechanisms via scheduled tasks or registry modifications related to 'Themes.js' or 'Windows Theme Manager'.
MicroStealer Network IOCs
Cortex XDR
Detects network communication to known MicroStealer C2 domains or Discord webhook activity with a 'MicroStealer/1.0' user agent. This rule identifies potential MicroStealer malware activity within the network.
Detects DNS queries to Solana RPC endpoints associated with GlassWorm/ForceMemo blockchain-based C2. The malware queries up to 9 Solana RPC endpoints to retrieve C2 instructions from on-chain transaction memos. A Python process resolving any of these domains is anomalous outside of cryptocurrency development environments.
This rule detects DNS queries for domains matching the pattern used by the PLASMAGRID implant's Domain Generation Algorithm (DGA). The implant, associated with the Coruna exploit kit, generates 15-character domains with a .xyz TLD as a C2 fallback mechanism.
Detects DNS resolution requests to the Operation GhostMail exfiltration subdomains (*.i.zimbrasoft.com.ua) and main domain. DNS exfiltration is the primary channel used by this APT to steal credentials and 2FA codes even when HTTPS is blocked.
Storm-2561 Network IOC Detection
Cortex XDR
Detects outbound network connections from Windows endpoints to known Storm-2561 Command and Control (C2) infrastructure, including a specific C2 IP address and various domains used for credential exfiltration and initial access via spoofed VPN services.
Detects potential DNS tunneling, a technique used by the Mori backdoor (associated with MuddyWater), by identifying an unusually high volume of long DNS queries from a single source. This could indicate C2 communication or data exfiltration.
This rule detects network connections to or from known suspicious IP addresses and requests to known suspicious domains. These indicators are often associated with command and control (C2) activity, malware distribution, or other malicious infrastructure.
This rule detects DNS queries for reverse lookups, specifically those ending with '.in-addr.arpa' or '.ip6.arpa'. While legitimate, frequent or unusual reverse DNS queries from a specific device or process could indicate reconnaissance activities or attempts to map internal network infrastructure by an attacker.
Detects DNS queries for domains associated with an active adversary-in-the-middle (AiTM) phishing campaign targeting AWS credentials.
Detects network traffic to known command and control (C2) domains used by the Iranian APT group Seedworm to distribute the Fakeset backdoor. These domains are hosted on the Backblaze cloud storage service.
Detects DNS queries for subdomains of 'trycloudflare.com' originating from suspicious processes, such as script interpreters and LOLBins.
Attackers, such as those behind the VOID#GEIST campaign, leverage Cloudflare Tunnels to host command and control (C2) infrastructure, and initiating these connections from script interpreters or LOLBins is a common TTP.
Attackers, such as those behind the VOID#GEIST campaign, leverage Cloudflare Tunnels to host command and control (C2) infrastructure, and initiating these connections from script interpreters or LOLBins is a common TTP.
Page 60 of 77