Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,158 detections
Filters
Last updated
All Time
Detection languages
2,304
1,070
640
289
288
Contributors
918
814
769
696
224
Categories
20,460
11,847
5,879
5,158
4,866
Platforms
2,861
2,017
816
524
213
Products / Services
1,339
1,144
831
576
366
MITRE Techniques
1,825
1,307
787
747
577
CVEs
9
7
7
6
6
IDS Classtypes
538
151
101
57
48
IDS Protocols
375
373
132
64
42
This rule detects processes running from suspicious temporary directories (AppData, Temp, LocalAppData, TCC) initiating frequent outbound network connections to a specific non-standard destination port (18848). This behavior is often indicative of automated Command and Control (C2) heartbeats or beacons, particularly when associated with binaries executing from untrusted or user-writeable locations.
Identifies outbound C2 connections to domains generated by MLTBackdoor DGA.
This rule monitors network traffic for suspicious patterns indicating exploitation of LocalStack environments. It detects three primary malicious activities: Velocity Template Language (VTL) injection targeting reflection methods (e.g., ProcessBuilder) for RCE; unauthorized manipulation of API Gateway resources (e.g., creating or modifying deployments) accompanied by IAM scope bypass techniques; and direct execution of RCE-style API triggers against known LocalStack port 4566.
This rule detects network connections to port 389 (LDAP) that contain specific keywords related to Active Directory trust relationships. This could indicate an adversary attempting to discover trust details within an Active Directory environment.
Detects anomalous activity associated with the 'SmartWindow' browser exploitation technique, specifically: Firefox communicating with the local SmartWindow PoC C2 API on port 8765, Firefox spawning unexpected child processes, or unauthorized processes accessing Firefox's 'places.sqlite' database to harvest browsing history or private session data.
Detects specific suspicious processes (MediumInstStart.exe or pcl2bmp.exe) initiating network connections or DNS requests to identified malicious IP addresses (188.208.141.177) or domains (couldinstallup.com, workdrive.zoho.com, zohoapis.com) within a one-hour window. These processes are indicative of potential malware or unauthorized C2 activity.
Detects potential abuse of Active Directory Web Services (ADWS) by identifying the execution of known tools like SharpADWS or suspicious network connections to ADWS port 9389 by non-standard processes. The rule monitors Sysmon process creation and network connection events for keywords related to Active Directory web enumeration.
Detects phishing lures delivered through social media messaging services
Detects firmware updates pushed from unverified or IP-only sources
Detects SNMP bulk walk used to collect network device configurations
Detects SMS pumping attacks via bulk SMS API requests
Detects creation of new Azure AD accounts which may be used for persistence
Detects Node.js process querying Ethereum blockchain for C2 address.
Detects port knocking sequences used to activate hidden backdoors
Detects Log4Shell JNDI injection attempts
Detects access to code signing certificate vendors for capability development
Detects modification of domain trust relationships via LDAP for privilege escalation
Detects simultaneous RDP connections to multiple internal hosts originating from a single compromised RedVDS gateway, indicating rapid lateral movement.
Detects brute-force tools (Hydra, NLBrute) originating from known RedVDS infrastructure IP ranges/ASNs, indicating cybercriminal VDI abuse.
Detects exploit kit landing pages serving browser exploits
Detects users clicking links from emails containing Canadian payroll lures leading to fake Workday/ADP domains. The rule specifically looks for navigation to URLs matching a regex pattern for Workday, ADP, or payroll-related terms combined with login/auth/secure keywords, and correlates this with browser process events (Chrome or Edge).
Page 109 of 246