Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,866 detections
Filters
Last updated
All Time
Detection languages
1,757
1,593
604
243
199
Contributors
944
801
787
614
315
Categories
20,460
11,847
5,879
5,158
4,866
Platforms
3,711
737
612
405
100
Products / Services
1,458
648
498
272
235
MITRE Techniques
1,330
1,214
888
785
772
CVEs
7
5
5
5
5
IDS Classtypes
546
20
16
5
4
IDS Protocols
417
66
60
39
13
This rule detects outbound network connections that were blocked by security controls due to matching a threat signature or being categorized as malicious or command-and-control (C2) traffic.
This rule detects high-frequency security alerts from Zscaler ZIA indicating that a single source IP has encountered three or more distinct threat signatures within a 15-minute window. This behavior is indicative of a host engaging in malicious activity, such as automated scanning, malware communication attempts, or accessing infrastructure associated with multiple malicious categories.
Detects instances where Netskope security solution has identified and blocked web-based traffic classified as malware or a security threat.
This rule detects high-frequency security alerts from Zscaler ZIA indicating that a single source IP has encountered three or more distinct threat signatures within a 15-minute window. This behavior is indicative of a host engaging in malicious activity, such as automated scanning, malware communication attempts, or accessing infrastructure associated with multiple malicious categories.
Detects endpoint security scanner hits indicating the presence of msaRAT malware, specifically identifying its characteristic double-layer encryption scheme (DTLS transport paired with application-layer ChaCha-Poly1305 encryption) triggered by a 0xFE handshake frame.
Detects DNS queries for suspicious subdomains on known Mirage2FA phishing kit domains ('cheacker.store' and 'volatilesour.store'). The rule identifies queries where the subdomain is Base64-encoded and decodes into an email-like format, which is a technique used by this phishing kit to track or validate victim-specific session tokens or email addresses.
Detects instances where Zscaler web security logs identify malware, threats, or viruses, specifically flagging users and destination hosts involved in these blocked or allowed security events.
Detects BumbleBee loader binaries that utilize the GetSystemDefaultLocaleName API to perform geofencing, intentionally exiting if the system locale matches specific CIS (Commonwealth of Independent States) region strings. This behavior is used by the malware to avoid infection of systems in these regions.
Detects instances where Netskope Advanced Threat Protection (ATP) identifies a malicious file during a user-initiated upload or download operation.
Detects potential DeadLock ransomware activity by correlating a high volume of file renames (using the .dlock extension) within a short window, alongside the creation of known ransomware notes (HOW_RECOVER*.txt or RECOVERY_CHAT*.html) or the modification of the desktop wallpaper registry key to point to a file in C:\ProgramData.
Detects instances where Netskope Advanced Threat Protection (ATP) identifies a malicious file during a user-initiated upload or download operation.
This rule detects outbound network connections that were blocked by security controls due to matching a threat signature or being categorized as malicious or command-and-control (C2) traffic.
This rule detects outgoing TCP traffic to port 1082 that initiates or utilizes a SOCKS5 proxy connection, specifically identifying patterns associated with the Myxa VPN tool. The detection monitors for the specific SOCKS5 handshake byte and identifies known hardcoded IP addresses associated with this tool's proxy infrastructure.
Detects potential DeadLock ransomware activity by correlating a high volume of file renames (using the .dlock extension) within a short window, alongside the creation of known ransomware notes (HOW_RECOVER*.txt or RECOVERY_CHAT*.html) or the modification of the desktop wallpaper registry key to point to a file in C:\ProgramData.
This rule detects the execution or presence of known malicious JavaScript loader files identified as part of a banking-lure phishing campaign by matching their SHA256 file hashes.
Detects HTTP outbound traffic to domains using the .sbs TLD that follow a specific 'file' followed by dictionary words naming convention, associated with the ClickFix campaign. The rule specifically identifies staging requests matching a /curl/<hex-id> URI pattern used to deliver secondary payloads.
This rule detects macOS infostealer activity, such as AMOS, MacSync, or SHub, by identifying suspicious, correlated access to sensitive credential stores including the macOS Keychain, web browser credential databases (Chrome), SSH keys, and cryptocurrency wallet configuration files. It uses a combination of path/command-line strings and generic indicators of credential harvesting behavior.
Detects potential DeadLock ransomware activity by correlating a high volume of file renames (using the .dlock extension) within a short window, alongside the creation of known ransomware notes (HOW_RECOVER*.txt or RECOVERY_CHAT*.html) or the modification of the desktop wallpaper registry key to point to a file in C:\ProgramData.
Detects the second-stage payload of the ChainDrop/Mini Shai-Hulud npm supply chain worm, specifically targeting GitHub Actions runner environments. The rule identifies obfuscated Bun-bundled CommonJS credential-stealing scripts (math_init.js) designed to harvest secrets from the Runner.Worker process memory and communicate with C2 infrastructure via EtherHiding Ethereum contract interaction.
This rule detects activities associated with the SHub Stealer malware on macOS, specifically identifying the creation of staging directories in /tmp (named /tmp/shub_<id>/*), the presence of a 'FileGrabber' sub-directory, and unauthorized file access to common cryptocurrency wallet applications like Electrum, Exodus, Trezor Suite, Ledger Live, Sparrow, and Guarda. It filters out common administrative or installer tools to reduce noise.
This rule monitors for known file hashes and network indicators associated with Bindcloak malware. It alerts on endpoint file execution events matching specific SHA256/MD5/SHA1 hashes and network connection events to suspicious domains or a specific malicious IP address.
Page 61 of 232