Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,158 detections
Filters
Last updated
All Time
Detection languages
2,304
1,070
640
289
288
Contributors
918
814
769
696
224
Categories
20,460
11,847
5,879
5,158
4,866
Platforms
2,861
2,017
816
524
213
Products / Services
1,339
1,144
831
576
366
MITRE Techniques
1,825
1,307
787
747
577
CVEs
9
7
7
6
6
IDS Classtypes
538
151
101
57
48
IDS Protocols
375
373
132
64
42
This rule detects suspicious activity involving interaction with the 'perplexity-ai.online' domain and the creation of specific browser extension files, which may indicate browser-based data exfiltration or credential theft. The rule correlates file creation events, DNS queries, and network connections, assigning a higher risk score when multiple indicators are present, particularly when evidence suggests exfiltration of keystroke or search data via web requests.
Detects potential unauthorized or rogue peer connections within a Cisco SD-WAN infrastructure. The rule monitors certificate-based authentication events for indicators of rogue peers (e.g., certificate mismatches, invalid common names) or connections originating from known malicious IP addresses associated with rogue SD-WAN activity.
Detects a module changing protocol, destination class, or cloud service after repeated failed connections on its primary channel. This behavior is indicative of malware like Kazuar attempting to establish C2 communication through alternative means when its initial attempts fail.
Detects fake security alert pages used for social engineering attacks
Detects evil twin access point credential capture portal
Detects anomalous SSH lateral movement originating from the Cisco SD-WAN Manager (vManage) to other control plane components (vSmart/vBond). This rule correlates network connections on port 22 with successful SSH logins using privileged or service-related accounts, which is indicative of potential post-exploitation activity or pivoting within an SD-WAN control plane environment.
This rule detects multiple stages of activity associated with BaqiyatLock ransomware and Remcos RAT. It identifies the execution of known BaqiyatLock/Remcos files, attempts to bypass User Account Control (UAC) via ms-settings registry hijack, creation of files with the '.bqtlock' extension indicative of BaqiyatLock encryption, and network communication with 'icanhazip.com' for external IP discovery, which is a common reconnaissance step.
This rule detects network connections or URL click events to a list of domains known to be associated with phishing or malware distribution. The rule specifically looks for connections to these domains that also contain certain path segments like '/wlc/', '/load/', or '/success/', which are often indicative of malicious activity or payload delivery. It also broadly checks for any URL click events containing these suspicious domains.
Detects Jellyfin's automated ffprobe media scan pipeline spawning suspicious network-related shell commands. This indicates active exploitation of the PixelSmash vulnerability (CVE-2026-8461) via zero-click library scans.
Correlates RuntimeHost.exe spawning suspended MSBuild.exe to inject mining shellcode, followed by network activity. This behavior is indicative of cryptojacking campaigns abusing ScreenConnect and .NET utilities.
Detects network traffic over port 6757, which is indicative of PureHVNC command and control (C2) communication.
This rule detects the sideloading of 'UnityPlayer.dll' by 'BrowserViewUtility.exe' in conjunction with network communication to a 'windows.net' domain. This activity is indicative of the 'Dragon Weave' campaign, specifically the 'RustCloak' malware, which uses DLL sideloading for execution and Azure cloud for C2.
Detects network traffic associated with known Cobalt Strike Beacon request URI patterns. This rule utilizes network signature inspection to flag outbound connections containing URI fragments commonly used by Cobalt Strike default profiles.
Correlates the successful DNS resolution of a legit domain to a malicious IP, followed by an HTTP POST submitting stolen credentials. Specifically looks for POST requests to 'login.microsoftonline.com' where the remote IP address is not a known Microsoft IP range (13.x.x.x or 20.x.x.x).
This rule detects network connections from internal hosts to identified C2 or phishing infrastructure associated with the threat actor group UNC1151 (also known as Ghostwriter). It monitors both host-based network events (via DeviceNetworkEvents) and centralized network security logs (via CommonSecurityLog) for traffic targeting a curated list of known malicious IP addresses.
This rule detects network connections from internal hosts to identified C2 or phishing infrastructure associated with the threat actor group UNC1151 (also known as Ghostwriter). It monitors both host-based network events (via DeviceNetworkEvents) and centralized network security logs (via CommonSecurityLog) for traffic targeting a curated list of known malicious IP addresses.
Detects when RegAsm.exe initiates outbound HTTPS connections to domains associated with Telegram or Cloudflare. This behavior is indicative of malware like Vidar using RegAsm.exe for network communication, potentially for command and control or data exfiltration, leveraging legitimate services as proxies.
Identifies post-exploitation reverse shells resulting from the LiteLLM RCE vulnerabilities. This rule specifically looks for process creation events where the parent process is associated with LiteLLM (either the 'litellm' executable or a Python process running 'litellm') and the spawned child process command line contains common reverse shell patterns such as 'bash -i', '/dev/tcp/', 'nc -e', or 'sh -i'.
Detects non-browser processes initiating HTTPS network connections to well-known public DNS over HTTPS (DoH) resolvers. This behavior is often associated with command and control (C2) communication, where malware attempts to evade network security controls by tunneling DNS queries through encrypted HTTPS traffic.
Detects outbound network connections to common Azure-related domains originating from suspicious file paths such as Temp, Downloads, or AppData subdirectories. This behavior is indicative of potential malware or unauthorized scripts executing from temporary user locations to reach out to cloud infrastructure.
Detects instances where the Outlook process (OUTLOOK.EXE) initiates a network connection over SMB (port 445) to an external, non-private IP address. This behavior is highly suspicious as Microsoft Outlook should typically not be performing direct SMB connections to external systems, and this is often indicative of an adversary attempting to leverage malicious documents or templates to perform credential harvesting via NTLM relay or SMB authentication captures.
Page 125 of 246