Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,158 detections
Filters
Last updated
All Time
Detection languages
2,304
1,070
640
289
288
Contributors
918
814
769
696
224
Categories
20,460
11,847
5,879
5,158
4,866
Platforms
2,861
2,017
816
524
213
Products / Services
1,339
1,144
831
576
366
MITRE Techniques
1,825
1,307
787
747
577
CVEs
9
7
7
6
6
IDS Classtypes
538
151
101
57
48
IDS Protocols
375
373
132
64
42
Detects potential Windows executable or DLL file downloads originating from or directed to a specific suspicious external IP address (154.49.70.216) over HTTP port 80, based on signature-based alerts from network security tools.
Detects network connections from a host to the api.adblock-for-youtube.com domain at the /api/v2/rules endpoint. This behavior is associated with the 'Adblock for YouTube' browser extension (cmedhionkhpnakcndndgjdbohmhepckk) as it retrieves remote JavaScript scriplets for rule updates, which can be a vector for unauthorized code execution if the domain is compromised or used maliciously.
Detects unauthorized access attempts to sensitive SD-WAN control plane endpoints via REST API or the presence of suspicious 'evil_tenant.csv' artifacts, which may indicate reconnaissance or staging activities.
This rule detects potential Bluekit malware activity by identifying specific CSS filter function combinations (saturate, hue-rotate, brightness, and contrast) within HTTP header data. These functions are used by Bluekit to generate unique pixel hashes for page loads, intended to bypass screenshot-based detection. The rule also flags instances where these headers co-occur with content-length and javascript identifiers.
Detects SSH network connections initiated by common administrative service accounts 'vmanage-admin' or 'troot' using the ssh or sshd process. This pattern may indicate unauthorized use of these service accounts or anomalous remote access behavior.
This rule detects network connections or DNS queries originating from an endpoint towards domains or IP addresses associated with BlueKit command-and-control (C2) infrastructure, including TLDs (pk, ws, cc, su) and onion-based addresses. This activity is indicative of potential malware communication or C2 beacons.
This rule monitors DNS query logs for attempts to resolve domains associated with 'rrweb' or 'rrweb-snapshot'. These libraries are legitimate tools for session recording and DOM snapshotting but have been increasingly observed in malicious activity, specifically in web-based credential theft, automated session hijacking, or exfiltration of sensitive user activity via session recording.
Detects network activity associated with Bluekit phishing infrastructure, which utilizes WebSocket connections for real-time browser session exfiltration. The rule monitors for characteristic HTTP upgrade requests to WebSockets containing 'rrweb' or 'session' query parameters, or connections to known Bluekit phishing domains, which allow attackers to stream DOM, keystrokes, and mouse movements from a victim's browser to an attacker-controlled dashboard.
Detects potential fast-flux DNS behavior indicative of Bluekit PhaaS P2P infrastructure. The rule monitors for browser processes resolving a single domain to 5 or more distinct external IP addresses within a one-hour window, excluding known CDNs and cloud infrastructure.
This rule detects attempts to dump LSASS process memory using common tools like procdump, rundll32 with comsvcs.dll, or mimikatz (sekurlsa module), followed by DCOM lateral movement (network connection on port 135) on the same device within a 30-minute window. This sequence of events is indicative of an adversary attempting to steal credentials and then use them for lateral movement within the network.
This rule correlates three distinct events to detect a potential credential theft and lateral movement chain: an LSASS credential dump, followed by an NTLM network logon, and then a DCOM activation of mmc.exe with the '-Embedding' flag on the target system. This sequence of events is indicative of an attacker compromising credentials, using them to move laterally, and then potentially executing further commands or tools via DCOM.
Detects PowerShell execution with a highly suspicious command line containing common obfuscation techniques, the 'DownloadString' method, and a hardcoded IP address. This pattern is frequently observed in malware and adversary tooling to download and execute malicious payloads from a remote server.
Detects high-volume SQL UPDATE operations indicating data manipulation attack
Detects bulk access to Crunchbase or ZoomInfo for corporate intelligence
Detects queries to passive DNS databases for historical DNS resolution data
Detects SMTP being used as a covert C2 communication channel
Detects SSL/TLS handshake flood for service exhaustion attacks
Detects use of Wayback Machine to access archived web content for reconnaissance
This rule detects network connection events where the AutoGen Studio application (identified by its image filename) initiates connections to localhost (127.0.0.1 or ::1) on ports 8080 or 8081. This is typical behavior for the AutoGen Studio web interface or API server running locally.
Detects SEO poisoning pages with hidden keywords to manipulate search rankings
Detects enumeration of hardware asset inventories via web or network
Page 115 of 246