Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,158 detections
Filters
Last updated
All Time
Detection languages
2,304
1,070
640
289
288
Contributors
918
814
769
696
224
Categories
20,460
11,847
5,879
5,158
4,866
Platforms
2,861
2,017
816
524
213
Products / Services
1,339
1,144
831
576
366
MITRE Techniques
1,825
1,307
787
747
577
CVEs
9
7
7
6
6
IDS Classtypes
538
151
101
57
48
IDS Protocols
375
373
132
64
42
macOS malware used by JINX-0164 against cryptocurrency developers
Open-source derived remote access trojan with plugin architecture
Commodity .NET keylogger and remote access trojan
Clipboard hijacking malware for cryptocurrency address substitution
Commodity .NET keylogger and remote access trojan
Detects administrative commands (e.g., showing running configuration, copying startup configuration, or accessing enable secret) executed via SSH or Telnet on network devices from non-baseline management IP addresses.
This rule detects potential DNS hijacking or redirection by comparing the returned IP address from a DNS query against a known list of authoritative IP addresses for specific domains. If an internal DNS resolver returns an IP address that does not match the authoritative record, it flags the event as a potential DNS response mismatch. It includes risk scoring based on the number of distinct affected hosts.
This rule monitors for indicators of unauthorized Tor usage or anonymization activity, including non-standard Tor executable paths, suspicious library loads, the creation of Tor configuration files (torrc), non-browser processes communicating over known Tor ports, and DNS queries for .onion domains. It also specifically monitors for potential data exfiltration via the temp.sh file-sharing service from non-browser applications. The rule aggregates these suspicious signals over a 24-hour period to calculate a risk severity score based on the frequency and variety of indicators detected.
Detects anomalous activity consistent with the IronWorm threat actor using compromised CI credentials to perform npm package publishing. The rule identifies a sequence of two events from the same source IP within a 10-minute window: first, an OIDC identity token exchange request at the npm registry, followed by a package publish operation (PUT request). This behavior is characteristic of malicious actors hijacking CI/CD pipelines to inject malicious code into trusted npm packages.
This rule detects command and control (C2) communication associated with the 'easy-day-js' backdoor, which is part of the Mastra npm supply chain attack. It specifically looks for HTTP POST requests to the IP address 23.254.164.123 with a spoofed Internet Explorer 8 User-Agent string.
This rule detects attempts to authenticate to SSH using GSSAPI (Generic Security Service Application Programming Interface). While GSSAPI can be used for legitimate authentication, its presence in logs might indicate an attacker attempting to use alternative authentication methods, potentially for lateral movement or privilege escalation, especially if unexpected in the environment.
Detects network connections to a specific suspicious IP address (94.156.181.89) or to domains associated with Cloudflare Tunnel (.trycloudflare.com). This could indicate command and control activity, data exfiltration, or other malicious network communication.
This rule detects the presence of Blackbeard malware by identifying known SHA256 hashes of its components or network connections to its known C2 infrastructure. It correlates file events with specific hashes and network events with specific remote IP addresses.
Identifies mshta.exe accessing externally hosted HTA content from a user-initiated Explorer session, potentially indicating malicious remote code execution.
Detects mshta.exe launched from Windows Explorer to retrieve remote HTA content over HTTP, a technique frequently observed in phishing campaigns and initial access attacks.
This rule detects suspicious network connections where the initiating process command line contains keywords indicative of evasion techniques such as 'obfuscate', 'encode', or 'encrypt'. It specifically looks for these activities over common web ports (80, 443, 8080, 8443) and triggers an alert if 10 or more such attempts are observed from a device within an hour.
Detects a specific network handshake pattern (05 01 00) associated with the SystemBC malware acting as a SOCKS5 proxy. This pattern is characteristic of the initial communication phase used by SystemBC to establish C2 connectivity, often utilized by ransomware affiliates.
Detects the SPECTRALVIPER downloader component characteristic of OceanLotus activity. The rule monitors for a specific HTTP POST request to a check-in URL, followed by the execution of IntelAudioService.exe with command-line arguments indicating a side-loading attack chain from the appmodel StateRepository.
Detects outbound network connections initiated by ConfigurationRemotingServer.exe on port 443, which may indicate a reverse shell connection established via DSC (Desired State Configuration) resources.
Detects processes that execute and remain dormant for more than 120 seconds before performing a high volume of file operations (greater than 50) or initiating a high volume of network connections (greater than 20). This pattern is consistent with malware or beaconing implants attempting to evade detection during automated sandbox analysis.
This rule detects the execution of 'gs-netcat' or 'gsocket' utilities, as well as specific configurations of 'smbd' that suggest potential use of network tools for remote command and control or unauthorized access. GSocket allows for the creation of secure reverse shells and peer-to-peer communication channels, which are often used by adversaries to bypass firewall restrictions.
Page 119 of 246