Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,303 detections
Filters
Last updated
All Time
Detection languages
2,251
22
21
7
2
Contributors
910
584
506
125
48
Categories
20,401
11,795
5,864
5,145
4,864
2,303
Platforms
2,190
209
168
62
61
Products / Services
2,250
2,159
163
32
31
MITRE Techniques
713
422
384
187
184
CVEs
17
12
12
12
10
IDS Classtypes
995
426
281
190
98
IDS Protocols
1,291
401
281
117
45
Detects outbound Telnet traffic initiating with a specific magic byte sequence ('|FF FB|') characteristic of the Fire Ant malware's command-and-control communication.
Detects incoming TCP and UDP traffic containing the 'sxcdewqaz!@#' magic string. This pattern is characteristic of a packet-triggered backdoor (often referred to as 'Fire Ant'), which uses custom packet payloads to activate malicious functionality on a listening host.
Detects high-frequency TCP SYN connection attempts originating from an internal device, which is indicative of a port scanning behavior typically used for network service discovery.
Detects the use of the FTP 'STOR' command to transmit a file with the '.pcap' extension to an external network. This behavior is indicative of potential data exfiltration where captured network traffic is being uploaded to an attacker-controlled server.
This rule detects unauthenticated TCP connection attempts targeting ports 43210 and 43211, which are associated with the Nexus 9000 S1HAL service. These attempts are indicative of potential exploitation activity related to CVE-2026-20212.
Detects network requests originating from the Netch gateway tool or similar environments, attempting to fetch auto-configuration profiles for Shadowsocks from the external domain 'www.sheng886.top' using the '/api/v1/internal/shadowsocks/auto-config' endpoint. The rule specifically matches the Go-http-client user agent, which is common in automated scripts and Go-based proxy tools.
Detects an HTTP POST request targeting the host 'tt.yeyoujs.com' at the URI path '/api/agent/enroll', containing a specific Python aiohttp User-Agent string. This pattern is characteristic of a C2 agent attempting to register or enroll with an external command-and-control server.
This rule detects inbound HTTP GET requests to a specific IP address (103.86.86.244) requesting a file named 'deploy.ps1'. This behavior is characteristic of adversaries using PowerShell one-liners (cradles) like 'irm' (Invoke-RestMethod) or 'iex' (Invoke-Expression) to fetch and execute malicious scripts directly from a remote C2 infrastructure.
Detects network activity related to the Toy Ghouls 'matrix-bird-agent' backdoor. The rule identifies communication with the domain 'meet.element.tw' via TLS SNI and HTTP host headers, as well as specific Matrix API event types (m.bird.status, m.bird.metrics, m.bird.cmd_response) and references to 'panel-bot' within the HTTP request body, indicating potential command-and-control behavior.
Detects periodic TLS network beacons to external destinations on port 443, characteristic of the BridgeAgent malware. The rule identifies suspicious outbound connections that exhibit consistent, repetitive behavior patterns, potentially indicating C2 communication. It is recommended to correlate this network activity with EDR alerts focusing on masquerading processes, specifically instances where binaries like gnome-shell are running as root and persisted via service mechanisms like zabbix_agent.service.
Detects network-based command signaling shared by the Fire Ant/REPTILE-derivative backdoor and its reverse-tunneling implant capability. Identifies the 'magic string' activation sequence and matching 'kill marker' termination sequence over TCP and UDP — indicative of packet-triggered backdoor activation, port-knocking style C2, or reverse-tunnel establishment via raw socket communication.
Detects network traffic within the internal network that matches the initial handshake phase of a SOCKS proxy connection. This is a common indicator of an attacker using an internal system to proxy command and control (C2) traffic or pivot within the network using tools like HTRAN, ZXProxy, or custom implementations.
Detects unauthenticated attempts to invoke Grafana API tools via the Model Context Protocol (MCP) by utilizing spoofed Mcp-Session-Id headers while bypassing bearer token authentication requirements. This primarily targets unauthorized access to API functionality on Grafana instances configured with bearer-token authentication (v1.1.0+).
Detects outbound network traffic associated with StyleSmuggler C2 infrastructure. The rule identifies established TLS connections to a known malicious IP address (99.84.67.186) and monitors for WebSocket-over-TLS traffic using the suspicious SNI 'windwsecurity.run'.
This rule detects an unauthenticated exploitation attempt against Magento GraphQL endpoints, specifically targeting the 'styles' parameter. The attack pattern involves sending a malformed request to the /graphql endpoint with an 'X-TRACE-' header, which is indicative of the StyleSmuggler vulnerability exploit.
Detects anomalous, high-frequency inbound TCP connection attempts to port 102 (S7comm), which is used by Siemens S7 PLCs. This behavior is indicative of automated network scanning or reconnaissance targeting industrial control system (ICS) infrastructure.
Detects incoming S7comm/ISO-TSAP connection attempts directed at Siemens Programmable Logic Controllers (PLCs) originating from an external network. This behavior is indicative of unauthorized access or reconnaissance attempts against Industrial Control System (ICS) assets.
This rule detects command and control (C2) communication patterns utilized by the GoCaracal malware family, specifically its fallback mechanism which leverages Ethereum blockchain RPC calls (eth_getStorageAt) to interact with known malicious smart contracts or wallet addresses.
Detects anomalous OAuth redirection chains initiated from login.microsoftonline.com or accounts.google.com that target infrastructure identified as malicious .vu domains. This pattern is indicative of a consent-phishing campaign attempting to redirect users to malicious infrastructure.
Detects periodic outbound TLS connections over port 443 exhibiting beaconing behavior (5+ established connections with a non-empty SNI from a source host within 300 seconds), consistent with BridgeAgent malware C2 heartbeat/reverse-shell maintenance. Correlate with EDR detections of a process masquerading as /usr/bin/gnome-shell running as root and persisted via a fraudulent zabbix_agent.service.
This rule monitors for HTTP traffic directed at .vu TLD domains, which contain the specific Cloudflare 'Just a moment' browser-check page. This pattern is characteristic of the NovaCookies Phishing-as-a-Service (PhaaS) platform, which uses such gates to prevent automated analysis and security scanners from accessing the final phishing page.
Page 81 of 110