Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,867 detections
Filters
Last updated
All Time
Detection languages
1,758
1,593
604
243
199
Contributors
944
801
787
614
315
Categories
20,464
11,852
5,880
5,159
4,867
Platforms
3,712
737
613
406
100
Products / Services
1,458
648
498
272
235
MITRE Techniques
1,330
1,214
889
785
772
CVEs
7
5
5
5
5
IDS Classtypes
546
20
16
5
4
IDS Protocols
417
66
60
39
13
This rule monitors network traffic over the Telnet protocol (TCP port 23) for patterns indicative of Mirai botnet propagation. It identifies sequences of characters commonly used in Mirai brute-force attempts to guess default credentials (e.g., 'admin' followed by 'password'). The rule utilizes a threshold-based detection filter to trigger only when multiple such attempts are observed from a single source within a 60-second window, helping to filter out individual noise and focus on active scanning behavior.
Detects outbound HTTP POST requests characteristic of QakBot malware command and control (C2) activity. The rule identifies a specific combination of a hardcoded User-Agent string ('Trident/7.0') and a URI pattern consisting of 4 to 32 alphanumeric characters ending in .php.
Detects outbound HTTP POST requests to suspicious URIs and subsequent inbound responses containing executable binary (PE) signatures, characteristic of Emotet malware command-and-control (C2) activity.
This rule monitors for HTTP POST requests to external networks containing 'gtag=' in the URI, which is a known technique used by the TrickBot malware to exfiltrate its group identifier during C2 communication.
Detects HTTP POST requests characteristic of Emotet Epoch 4 and 5 C2 communication. The rule monitors for specific URI patterns, the presence of a 'Cookie' header, and a base64-encoded request body exceeding 80 characters, which are indicative of Emotet malware beaconing activity.
Detects multi-stage cryptojacking campaign: autorun.dll sideload, silent msiexec install, and post-exploitation .NET binary process hollowing
This rule detects network traffic indicative of the NjRAT (Bladabindi) remote access trojan, specifically identifying its pipe-delimited command-and-control protocol patterns (e.g., '|ll|' or '|kl|').
Detects a PowerShell process initiated by node.exe that attempts to reflectively load a .NET assembly from memory. The detection specifically looks for keywords related to .NET Reflection, byte array loading, and a known C2 domain (hellolargeworld.com), along with the 'Extension.SubRoutine.Run2' invocation, indicating potential backdoor activity.
Detects the execution of VBScript files containing 'ragecore' in the command line, specifically when launched via wscript.exe or cscript.exe from common staging or persistence directories such as Windows Temp, Users Public, or Startup folders.
This rule detects the execution of processes named win_guard_*.exe or those residing in directories often used for malicious staging (Users\Public, Windows\Temp, ProgramData). Additionally, it detects when these identified suspicious processes load user32.dll, a common indicator of initiating a low-level keyboard hook (WH_KEYBOARD_LL) often used by keyloggers to capture user input.
This rule detects network connections to known IP addresses associated with the FortiBleed vulnerability exploitation. These IP addresses have been categorized based on their observed roles in FortiBleed attacks, including C2, pentest lab, credential validation, and sniffer nodes. Monitoring these connections can help identify compromised systems communicating with FortiBleed infrastructure.
Detects Android applications exhibiting multiple sensitive behaviors simultaneously within a 5-minute window, such as screen recording, audio capture, GPS tracking, and unauthorized access to SMS, call logs, or contacts. This behavior is strongly indicative of malicious mobile spyware.
This rule detects network connections to known IP addresses associated with the FortiBleed vulnerability exploitation. The rule categorizes the threat based on the specific IP address, indicating potential C2, pentest lab activity, credential validation, or sniffer nodes.
This rule detects network communication to a known command and control (C2) server (23.254.164.123:443) associated with the 'protocal.cjs' backdoor, which is part of the 'easy-day-js' npm supply chain compromise. The detection specifically looks for TLS traffic with a Server Name Indication (SNI) and general IP traffic to this C2 address.
Detects file artifacts produced by the PostCSS typosquatting Windows RAT (abdrizak). Covers Chrome credential dump outputs (pwd.txt, chrome_logins_dump.txt), access to Chrome Login Data and Local State files by non-browser processes, and single-instance tracking files (.store, .host) written to the TEMP directory.
Detects modification of Windows Registry Run keys that are either explicitly associated with Remcos RAT or involve suspicious process-to-path combinations (non-standard paths being written to by command-line utilities). This rule monitors for indicators of persistent execution via common startup registry keys.
Detects the creation or writing of files within AppData directories matching specific naming patterns associated with Remcos RAT activity. Remcos typically generates files with a prefix of 'time_' or 'wnd_' followed by a timestamp string in these locations to store collected data or screenshots.
This rule detects anomalous process execution patterns associated with Remcos RAT, specifically monitoring for the spawning of 'rmclient.exe', unauthorized spawning of 'fsutil.exe', or 'svchost.exe' being launched by processes other than system-critical services. These patterns are characteristic of Remcos RAT deploying its watchdog or performing process injection.
This rule detects the execution of the Remcos Remote Access Trojan (RAT) followed by the creation of a keylogger data file by the same process, within a one-hour timeframe. This pattern indicates an active infection where the RAT is performing credential harvesting through keystroke logging.
Detects Remcos RAT watchdog activity characterized by process injection into system binaries (svchost.exe, rmclient.exe, fsutil.exe) to relaunch the main payload from non-standard directories (AppData, Temp, ProgramData), or a self-resurrection loop where the malware spawns a child process with an identical file path to maintain execution after termination.
This rule detects network connections to known IP addresses associated with FortiBleed activity, categorizing them by their suspected role (e.g., C2, pentest lab, credential validation, sniffer node). It monitors both successful connections and connection attempts.
Page 87 of 232