Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,158 detections
Filters
Last updated
All Time
Detection languages
2,304
1,070
640
289
288
Contributors
918
814
769
696
224
Categories
20,460
11,847
5,879
5,158
4,866
Platforms
2,861
2,017
816
524
213
Products / Services
1,339
1,144
831
576
366
MITRE Techniques
1,825
1,307
787
747
577
CVEs
9
7
7
6
6
IDS Classtypes
538
151
101
57
48
IDS Protocols
375
373
132
64
42
This rule detects automated script interaction with HR portals by correlating headless browsers or rapid HTTP POST requests sequentially navigating payroll endpoints. Specifically, it looks for network connections to URLs containing 'workday' or 'adp' initiated by 'python.exe' or 'curl.exe'.
Detects network connections initiated by the Squid proxy server (squid.exe) on port 21, which is typically used for FTP. This could indicate unusual or potentially malicious use of the proxy, as FTP traffic through a proxy on this port might be unexpected.
Detects network events where a remote URL contains repeated null bytes (\0 or \x00) on port 21, which could indicate an attempt to exploit the Squidbleed vulnerability or similar memory dump patterns.
Hunts for curl or wget pulling secondary stage obfuscated payloads from Pastebin or GitHub Gists initiated by developer tools.
This rule detects network events originating from 'squid.exe' that involve DNS query responses or network signature inspections, specifically looking for reverse DNS lookups to an IPv4 address. This could indicate attempts to resolve IP addresses back to hostnames, potentially for reconnaissance or C2 communication.
Identifies the execution of portable network scanning utilities (netscan.exe, advanced_ip_scanner.exe) that also initiate network connections to common administrative ports (135, 445, 3389). This activity is often observed post-breach to map the internal network.
This rule detects the use of JSON-RPC 'eth_call' by a non-browser process during network connection events. It specifically looks for network activity where the process is not a known web browser (Chrome, Edge, Firefox) and the network traffic or command line contains the string '"method":"eth_call"'. This behavior is indicative of malware or other malicious software attempting to interact with blockchain services, potentially for dynamic command and control or address resolution, as described in the referenced Check Point research.
Detects the HTTPS POST exfiltration enforcing the server-side gate using the actor's custom X-Rise-To-The-Trinny: agree header or X-QT-SR: 14 header, associated with TeamPCP supply chain attacks.
Detects the execution of the Squid proxy application with command line arguments that may indicate its use for malicious proxying or tunneling activities. This includes arguments related to safe ports, connection types (CONNECT, PORT, PASV), specific port numbers (21), and outgoing address configurations.
Detects network communication to known Command and Control (C2) IP addresses used by the Medusa ransomware group.
This detection monitors for web requests to the specific URI path "/mifs/403.jsp". This path is known to be used by attackers to deploy a dormant Java-based webshell ("sleeper shell") on vulnerable Ivanti Endpoint Manager Mobile (EPMM) instances as part of an initial access campaign.
This rule detects successful OAuth logins originating from IP addresses identified as residential proxies. This behavior can indicate an adversary attempting to bypass geo-blocking or other IP-based restrictions, potentially using stolen credentials (Valid Accounts) or after a successful phishing campaign (Spearphishing Link) to gain initial access or maintain persistence.
This rule detects the use of JSON-RPC 'eth_call' by a non-browser process during network connection events. It specifically looks for network activity where the process is not a known web browser (Chrome, Edge, Firefox) and the network traffic or command line contains the string '"method":"eth_call"'. This behavior is indicative of malware or other malicious software attempting to interact with blockchain services, potentially for dynamic command and control or address resolution, as described in the Check Point research.
This rule detects web browser processes (Chrome, Edge, Brave, Chromium) or potential browser extension files interacting with the 'perplexity-ai.online' domain. This is often associated with malicious browser extensions or phishing campaigns attempting to lure users to fraudulent sites.
Detects network and DNS indicators associated with BeepRAT, including connections to known C2 IP addresses on port 18848, resolution of known C2 domains, and suspicious DNS queries to 'doh.pub' from known loader processes (tcc.exe, HFY.exe).
Detects BeepRAT malware activity, including network communication to its command-and-control (C2) server on port 18848 and the creation of screenshot or video artifacts by known loader processes (HFY.exe, LuaJit.exe, tcc.exe). It also monitors for unauthorized network connections to the known BeepRAT C2 IP address.
Detects the execution of ssh.exe with the '-R' flag, indicating the creation of a reverse SSH tunnel (remote port forwarding). This technique is used to bypass inbound firewall rules and maintain encrypted access to internal endpoints, bypassing traditional C2.
This rule detects network connections initiated by VBScript (wscript.exe or cscript.exe) to external IP addresses. This behavior can be indicative of malicious VBScript execution attempting to communicate with command and control servers or exfiltrate data, often associated with phishing attacks.
Detects instances where 'Cursor.exe' initiates a process that attempts to download content from the internet. This behavior can be indicative of malicious activity, as 'Cursor.exe' is not typically associated with network communication or file downloads.
This rule detects potential leakage of HTTP Authorization headers (including 'Authorization', 'Basic', 'Bearer', 'Digest', and 'X-API-Key') over FTP (port 21) within network traffic. This could indicate a misconfiguration or an attempt to exfiltrate credentials or sensitive API keys in an unencrypted manner.
Detects high-volume SSH or network logon failures from a single source IP address within a short time window, indicative of a brute force attack. The rule specifically mentions consistency with 'mpbrute2.bin' tooling used in the 'FortiBleed' campaign.
Page 123 of 246