Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,158 detections
Filters
Last updated
All Time
Detection languages
2,304
1,070
640
289
288
Contributors
918
814
769
696
224
Categories
20,460
11,847
5,879
5,158
4,866
Platforms
2,861
2,017
816
524
213
Products / Services
1,339
1,144
831
576
366
MITRE Techniques
1,825
1,307
787
747
577
CVEs
9
7
7
6
6
IDS Classtypes
538
151
101
57
48
IDS Protocols
375
373
132
64
42
Dridex C2Beacon
YARA
Banking trojan and loader using malicious Office macro delivery
Form-grabbing and credential stealing malware-as-a-service
Form-grabbing and credential stealing malware-as-a-service
AI-powered phishing-as-a-service abusing device-code authentication
Loader malware delivering follow-on ransomware payloads
Detects network activity and DNS queries associated with known TA4922 command-and-control infrastructure, including specific domains and IP addresses. It also employs behavioral analysis to identify beaconing patterns from processes that are not identified as standard web browsers or authorized system/application utilities.
Detects DNS resolution attempts or direct network connections to the domain 'vtps.us', which is associated with TA4922 command and control (C2) infrastructure.
Detects the execution of a Cloudflare tunnel (cloudflared) binary that has been renamed to evade detection (e.g., svchost.exe), commonly used to establish persistent C2 tunnels.
This rule monitors for suspicious Linux kernel operations, including the loading of BPF programs via bpftool or system calls, and attempts by debugging or tracing tools to interact with processes using forceful termination signals. It also includes an anomaly detection branch that identifies processes with active network connections that are missing from the system process list, which may indicate process ghosting or hiding techniques.
Detects Python processes binding to or establishing network connections on the local loopback interface (127.0.0.1 or ::1) on non-standard ports. This behavior may indicate a local backdoor, proxy, or C2 listener implemented in Python that is not associated with common development tools or environments.
Detects the presence and activity of Tailscale VPN, including process execution, command-line arguments, network connections to Tailscale infrastructure, and communications within the Tailscale CGNAT address range (100.64.0.0/10). This rule identifies the potential use of Tailscale for tunneling or remote access, which may be unauthorized in some environments.
Detects suspicious network connections to 'outlook-one.vercel.app' or 'api.telegram.org' when initiated by common web browsers (msedge.exe, chrome.exe, firefox.exe) or Outlook (outlook.exe). This pattern can indicate phishing attempts, credential harvesting, or data exfiltration via Telegram bots.
Detects suspicious command-line executions involving common Windows system binaries (rundll32.exe, mshta.exe, certutil.exe, wmic.exe) combined with keywords often associated with network communication or data transfer (http, https, base64, /transfer). This pattern can indicate attempts at downloading malicious payloads, exfiltrating data, or executing encoded commands.
This rule detects suspicious network connections where the initiating process command line contains keywords indicative of evasion techniques such as 'obfuscate', 'encode', or 'encrypt'. It specifically looks for these activities over common web ports (80, 443, 8080, 8443) and triggers an alert if 10 or more such attempts are observed from a device within an hour.
This rule monitors and alerts on network connections established from endpoints to a predefined list of known malicious IP addresses, which may indicate command-and-control (C2) communication or unauthorized exfiltration attempts.
This rule detects network connections where the HTTP request URL or specific HTTP cookies match patterns often associated with command and control infrastructure or specific tracking beacons. It triggers on connections to 'financemachinelearning.com/apparatus/wind/twig/statement.html' or requests containing cookies like 'zd_cs_pm' or 'euconsent-v2'.
Detects network beaconing activity associated with the SPECTRALVIPER C2 framework. This rule identifies outbound HTTP GET requests targeting known C2 infrastructure domains and IP addresses, while correlating the traffic with specific browser user agents and cookie patterns indicative of this actor.
This rule detects potential exploitation attempts against ServiceNow instances by monitoring network and DNS activity involving a known malicious IP address (51.159.98.241). It identifies high-volume connections or DNS requests related to service-now.com associated with this IP, which may indicate an attacker attempting to leverage unauthenticated Scripted REST resources.
Detects network connection events initiated by the OneDrive sync process (OneDrive.Sync.Services.exe) to known malicious domains or suspicious specific file paths, which may indicate unauthorized use of the OneDrive process for command-and-control communication or malicious file retrieval.
Detects HTTP traffic initiating a WebSocket protocol upgrade with a specific 'binary' subprotocol header, characteristic of the Brickstorm backdoor used by the UNC5221 threat actor for command and control (C2) communication.
Detects network traffic over SMB targeting the SYSVOL or NETLOGON network shares that includes the transfer or reference of common executable file extensions. This behavior is indicative of an adversary attempting to stage malicious payloads for deployment via Group Policy Objects (GPOs), a common method for lateral movement and persistence.
Page 105 of 246