Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,866 detections
Filters
Last updated
All Time
Detection languages
1,757
1,593
604
243
199
Contributors
944
801
787
614
315
Categories
20,462
11,849
5,879
5,158
4,866
Platforms
3,711
737
612
405
100
Products / Services
1,458
648
498
272
235
MITRE Techniques
1,330
1,214
888
785
772
CVEs
7
5
5
5
5
IDS Classtypes
546
20
16
5
4
IDS Protocols
417
66
60
39
13
This rule detects network traffic to specific JSON storage services (jsonkeeper.com, jsonsilo.com, npoint.io) that have been observed to be abused by the DPRK-linked 'Contagious Interview' threat actors for malware delivery. The detection is based on TLS Server Name Indication (SNI) patterns.
Detects execution of Node.js from unusual locations or associated with network connections to known C2 infrastructure, as seen in campaigns distributing backdoors disguised as legitimate software.
Detects attempts to load unsigned kernel extensions, which may indicate rootkit installation or malicious kernel-level access. All legitimate kernel extensions should be signed with a developer ID.
Detects potential command-and-control (C2) activity associated with Lazarus Group malware, such as Cryptoistic. This rule identifies outbound TCP connections that do not appear to be using a standard application-layer protocol like HTTP/S, which is a characteristic of some custom backdoors used by the group. The rule filters for successful outbound TCP connections with an empty RemoteUrl, excluding private IP ranges and a allowlist of common processes. It further prioritizes processes running from suspicious user-writable locations and requires more than two connection attempts to reduce noise.
This rule detects inbound HTTP requests containing the User-Agent string 'Salesforce-Multi-Org-Fetcher/1.0'. This specific User-Agent has been associated with data theft from Salesforce instances, as detailed in a Google Cloud blog post. The detection aims to identify potential malicious activity targeting web server applications, specifically Salesforce environments, where an attacker might be attempting to exfiltrate data.
Detects potential DLL sideloading activity associated with Cephalus ransomware, where a legitimate SentinelOne executable is launched from a non-standard path and loads a malicious DLL.
Detects indicators associated with a watering hole attack originating from a compromised xubuntu.org website. This includes the creation of a tampered 'tos.txt' file, the dropping and execution of a trojanized dropper ('elzvcf.exe') in AppData\Roaming, and the establishment of persistence via a registry Run key.
ET MOBILE_MALWARE Observed Klopatra Domain (guncel-tv-player-lnat .]com) in TLS SNI
ET MOBILE_MALWARE Observed Klopatra Domain (adsservice2 .org) in TLS SNI
Detects network connections to Command and Control (C2) servers associated with the LANDFALL Android spyware. LANDFALL communicates over HTTPS, often on non-standard ports.
Detects the ClickOnce service (dfsvc.exe) DLL sideloading an unsigned DLL from the ClickOnce application cache directory. This behavior is indicative of a malicious ClickOnce deployment, a technique used for initial access and code execution as seen in 'OneClik' and 'SesameOp' campaigns.
ET MOBILE_MALWARE Observed Klopatra Domain (adsservices .uk) in TLS SNI
This rule detects network traffic indicative of a Windows Shortcut Link (LNK) file containing an unusually large amount of padded whitespace in its command line arguments. This technique is often used to obfuscate malicious commands or exploit vulnerabilities like ZDI-CAN-25373, which was a zero-day exploit related to Windows shortcuts. The rule specifically looks for the LNK file header signature and then uses a PCRE to identify repeated whitespace characters (tab, newline, vertical tab, form feed, carriage return, space) within the file data, suggesting padding for obfuscation or to bypass security controls.
ET MOBILE_MALWARE Klopatra CnC Domain in DNS Lookup (adsservice2 .org)
ET MOBILE_MALWARE Android/TrickMo.Banker POST Request
ET MOBILE_MALWARE Android/TrickMo.Banker Config Response
Detects post-exploitation behavior of LANDFALL spyware on Samsung devices. After exploiting CVE-2025-21042, the spyware uses LD_PRELOAD to inject a malicious shared object (.so) from its working directory (`/data/data/com.samsung.ipservice/files/`) into the benign `/system/bin/id` process, often via a shell wrapper.
ET MALWARE LeakyStealer CnC Checkin
This rule detects TLS Server Name Indication (SNI) requests for 'store.steampowered.com'. This domain is associated with the Valve Steam Store and its presence in TLS SNI could indicate activity related to information stealers like Vidar Stealer, which has been observed targeting Steam accounts.
This rule detects HTTP requests to the '.well-known/' directory that include common webshell file extensions (php, cfm, cgi, asp, aspx, jsp, rb, sh, py, pl). This activity is suspicious as the '.well-known/' directory is typically used for standardized metadata files (e.g., for ACME challenges, security.txt) and not for executable scripts. The rule specifically excludes requests from 'Let's Encrypt validation server' to reduce false positives.
ET MALWARE TA569 Gholoader CnC Domain in DNS Lookup (secure .kasindramaharaj .com)
Page 181 of 232