Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,866 detections
Filters
Last updated
All Time
Detection languages
1,757
1,593
604
243
199
Contributors
944
801
787
614
315
Categories
20,462
11,849
5,879
5,158
4,866
Platforms
3,711
737
612
405
100
Products / Services
1,458
648
498
272
235
MITRE Techniques
1,330
1,214
888
785
772
CVEs
7
5
5
5
5
IDS Classtypes
546
20
16
5
4
IDS Protocols
417
66
60
39
13
Detects potential unauthorized cryptocurrency mining activity by correlating process execution, network connections to known mining pools or C2 IPs, and the presence of known miner binaries in temporary directories. The rule calculates a confidence score based on the overlap of these behavioral indicators.
Detects user-initiated Terminal execution of a ClickFix bash payload copied from a fake CAPTCHA page. The command uses mktemp to create a /tmp DMG, downloads it via curl -fsSL from svs-verificationdate.beer, then silently mounts it with hdiutil attach -nobrowse to deliver the Atomic macOS Stealer (AMOS).
This rule detects the Python-based CastleLoader malware establishing persistent WebSocket (wss:// or ws://) command-and-control channels to randomized attacker endpoints. It specifically looks for network connections initiated by python.exe or pythonw.exe to URLs matching a WebSocket pattern, with at least 3 connections within a 5-minute window.
This rule detects the presence of Blackbeard malware by identifying known SHA256 hashes of its components or network connections to its known C2 infrastructure. It correlates file events with specific hashes and network events with specific remote IP addresses.
Detects known malicious invoice PDFs and email samples used in Crimson Kingsnake campaigns.
Detects the loading of 'hostfxr.dll' from suspicious user-specific AppData folders by 'CrossDeviceService.exe' or 'Teams.exe'. This behavior can indicate an attempt to load a malicious .NET runtime, potentially for DLL hijacking or code injection, often associated with persistence or execution techniques.
This rule detects the presence of known Chaos ransomware samples by matching their SHA256 hashes against process execution events and file events. If a process with a matching hash is executed or a file with a matching hash is observed, an alert will be triggered.
Detects HTTP GET requests to known malicious infrastructure used in SEO poisoning campaigns to distribute the Bumblebee malware loader. The rule monitors for specific URL paths and hostnames associated with lookalike domains delivering trojanized MSI files.
Detects execution of AryStinger or JDY malware as a secondary payload on Oracle PeopleSoft servers, likely following exploitation of CVE-2026-35273 by ShinyHunters. The rule monitors for processes matching these names or anomalous binaries spawned from within the PeopleSoft application directory that are not part of the legitimate application service suite.
Detects the execution of known adversary-in-the-middle (AiTM) phishing frameworks, such as Evilginx or Modlishka, by identifying process names, paths, or specific command-line arguments (e.g., --phishlets, --proxy, --lure) used to initiate these proxy-based phishing sessions.
This rule detects network connections to known IP addresses associated with the FortiBleed vulnerability exploitation. The rule categorizes the threat based on the specific IP address, indicating potential C2, pentest lab activity, credential validation, or sniffer nodes.
This rule detects the creation of a 'logs.dat' file, which is often associated with Remcos RAT for data exfiltration, in common user-related directories (AppData, Temp, Users, Documents) with a file size greater than or equal to 100KB. This pattern suggests an attempt to stage or exfiltrate collected data.
Detects potential Command and Control (C2) communication associated with Emotet malware by monitoring for successful network connections to suspicious remote ports frequently used by the malware. The rule flags endpoints that establish connections to at least three of these high-risk ports within a one-hour window, which is indicative of automated C2 beaconing behavior.
Detects the creation of specific scheduled tasks associated with LoaderClient or WeedHack malware. These tasks, named 'JMonitoringTask' or 'JavaSecurityUpdater', are used for persistence and recurring execution of malicious code.
Detects the creation of specific scheduled tasks associated with LoaderClient or WeedHack malware. These tasks, named 'JMonitoringTask' or 'JavaSecurityUpdater', are used for persistence and recurring execution of malicious code.
Detects PowerShell executing a reflective .NET assembly load, indicated by keywords like 'Reflection.Assembly', 'Load', and 'byte' in the command line. The detection is further refined by looking for 'Extension.SubRoutine', 'Run2', or the C2 domain 'hellolargeworld.com' in the command line, and specifically targets instances where the initiating process is 'node.exe'. This behavior is indicative of the 'protocal.cjs' backdoor.
Detects DLL side-loading behaviors associated with the Grandoreiro banking trojan. The rule identifies malicious DLLs compiled with Delphi/Embarcadero, utilizing sgcWebSockets for C2 communication via WebRTC, and including specific anti-analysis and banking-related strings, often executed via legitimate software binaries.
Detects suspicious network activity using the STUN/TURN protocol on port 3478 initiated by non-browser and non-conferencing processes. The rule specifically targets unsigned processes or those located in user-writable directories (such as Temp or AppData), which are common indicators of Grandoreiro malware sideloading and establishing C2 communication tunnels.
This rule detects activity associated with known Android Remote Access Trojans (RATs) such as BTMOB, CraxsRAT, CypherRAT, and SpySolr on SentinelOne-managed Android devices. It flags suspicious file creations (sideloaded APKs in user storage), specific malicious process names, SentinelOne threat indicators, and abuse of accessibility services for unauthorized remote control, keylogging, or screen overlay activities.
Detects outbound network connections to a known KuinaExtractor (k0to) infostealer C2 server. The rule monitors DeviceNetworkEvents for connections to the malicious IP address 103.229.53.18 on port 3000 and correlates them with process information to identify the originating application.
Detects the activation of Android Accessibility Services by non-legitimate, potentially malicious applications. This behavior is commonly associated with banking trojans like Rokarolla that abuse accessibility permissions to perform UI automation, keystroke logging, and screen scraping.
Page 79 of 232