Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,158 detections
Filters
Last updated
All Time
Detection languages
2,304
1,070
640
289
288
Contributors
918
814
769
696
224
Categories
20,460
11,847
5,879
5,158
4,866
Platforms
2,861
2,017
816
524
213
Products / Services
1,339
1,144
831
576
366
MITRE Techniques
1,825
1,307
787
747
577
CVEs
9
7
7
6
6
IDS Classtypes
538
151
101
57
48
IDS Protocols
375
373
132
64
42
Detects HTTP GET requests for specific malicious archives (calculator.rar, EditorToolsPdf.zip) originating from suspected compromised Ukrainian domains (basecon.com.ua, online.zp.ua). This behavior is associated with the STOCKSTAY malware used by the threat actor Turla.
This rule detects potential Cobalt Strike Beacon check-in activity over HTTP. It identifies incoming GET requests where the URI is abnormally short and the HTTP Referer header is missing, which are common indicators of default Cobalt Strike malleable C2 profiles.
Detects high-volume, established TLS connections to common public DNS-over-HTTPS (DoH) providers (Google, Cloudflare, OpenDNS). Persistent high-frequency connections to these resolvers can be indicative of DNS tunneling, where an adversary encapsulates command-and-control or data exfiltration traffic within encrypted DNS queries to bypass network monitoring.
Detects DNS query traffic where the subdomain label length exceeds 50 characters and contains patterns consistent with Base64 or Hexadecimal encoding. This behavior is indicative of potential data exfiltration or command-and-control communication performed over the DNS protocol by tunneling data within query labels.
Detects high-frequency DNS query patterns characterized by long, potentially encoded, subdomain labels (exceeding 40 characters) that are indicative of DNS-based command and control (C2) beaconing activity.
Detects network traffic consistent with the Metasploit Meterpreter reverse HTTPS payload, specifically looking for the default 'CN=metasploit' certificate subject name used by the framework in SSL/TLS handshakes, or connections targeting default Meterpreter ports like 4444.
This rule detects potential command and control (C2) activity related to the Qakbot malware. It specifically monitors for established outbound TLS traffic over non-standard ports (ports other than 443) where the Server Name Indication (SNI) field contains a numeric IPv4 address instead of a domain name, which is a characteristic behavior of Qakbot C2 infrastructure.
Detects TLS/SSL traffic patterns characteristic of Metasploit Meterpreter reverse HTTPS command-and-control communication, specifically targeting the use of default, self-signed certificates with a subject line containing a bare wildcard (CN=*) in the common name field, a common artifact of unconfigured Metasploit payloads.
Detects the transmission of the 'UserInitMprLogonScript' registry value name over SMB traffic in plaintext. This registry key is commonly used by adversaries to establish persistence by executing a logon script whenever a user logs in.
Detects attempts to disable the Windows Firewall using the netsh command-line utility or PowerShell cmdlets, as well as registry modifications related to firewall profiles. Adversaries often perform this action to impair host-based security controls and facilitate unauthorized inbound or outbound network traffic.
This rule detects the use of the 'msiexec.exe' utility to fetch and potentially execute an '.msi' installer package directly from a remote source via HTTP. This behavior is a known technique for bypassing application control by abusing a signed system binary to download and install malicious packages.
Detects network communication patterns indicative of RedLine Stealer activity by looking for specific keywords in the RemoteUrl field during inbound or outbound connections.
This rule detects HTTP GET requests containing '/api/device/gate/' and the 'ngrok-skip-browser-warning' string in either the AdditionalExtensions, RequestClientApplication, csUriQuery, or csUserAgent fields. This pattern is indicative of traffic associated with ngrok, a legitimate reverse proxy tool that can be leveraged by threat actors for various malicious purposes, including C2, data exfiltration, or bypassing network restrictions. The rule consolidates logs from CommonSecurityLog, W3CIISLog, and DeviceNetworkEvents to identify such activity.
Identifies mstsc.exe initiating outbound TCP connections to external, non-private IP addresses over port 3389, indicating a potential connection to an attacker-controlled Terminal Server.
Detects the use of 'curl.exe' with command-line arguments indicating communication through a SOCKS5 proxy on localhost:9050 to a .onion address. This pattern is often associated with Tor network usage for anonymized communication, which can be leveraged by adversaries for command and control or data exfiltration.
This rule detects suspicious network connections to known infrastructure associated with the 'Borrowed Trust' gambling kit. It identifies connections to specific IP addresses, IP ranges, compromised subdomains, URLs containing affiliate referrer codes, known redirect destinations, and a unique favicon path. The rule specifically excludes connections originating from common browser processes to focus on non-browser initiated activity, which could indicate malware or other malicious software attempting to establish C2 or exfiltrate data.
Detects network communication with the Rokarolla trojan's command and control (C2) server ('beralisvc.info') and subsequent injection of base64-encoded HTML phishing overlays into legitimate banking application UIs. The rule identifies C2 contact via network events and the presence of specific HTML content indicators ('html_base64', 'PCFEt0NUWVBFIGh0bWw+', 'com.imaginbank.app') in HTTP responses, suggesting an overlay attack.
This rule detects network connections from internal hosts to identified C2 or phishing infrastructure associated with the threat actor group UNC1151 (also known as Ghostwriter). It monitors both host-based network events (via DeviceNetworkEvents) and centralized network security logs (via CommonSecurityLog) for traffic targeting a curated list of known malicious IP addresses.
Detects network communication with known malicious IP addresses or URLs associated with the 'govtop.one' infrastructure, which is commonly indicative of command and control activity or malware beaconing.
This rule detects a high volume of successful network connections to common web ports (80, 443, 8080, 8443) where the remote URL contains keywords like 'version' or 'software'. This pattern could indicate an adversary performing reconnaissance to identify installed software and their versions, potentially looking for vulnerabilities or specific applications to target. The threshold of 10 such activities within an hour for a single device is set to flag anomalous behavior.
This rule detects processes making a high number of successful network connections (10 or more within an hour) to known public container registries such as docker.io or quay.io. This activity could indicate legitimate containerization operations, but also potential malicious activity like downloading malicious container images as part of a supply chain attack, or ingress of tools.
Page 121 of 246