Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,158 detections
Filters
Last updated
All Time
Detection languages
2,304
1,070
640
289
288
Contributors
918
814
769
696
224
Categories
20,460
11,847
5,879
5,158
4,866
Platforms
2,861
2,017
816
524
213
Products / Services
1,339
1,144
831
576
366
MITRE Techniques
1,825
1,307
787
747
577
CVEs
9
7
7
6
6
IDS Classtypes
538
151
101
57
48
IDS Protocols
375
373
132
64
42
Detects network connections from the 'Adblock for YouTube' browser extension to its remote API endpoint (api.adblock-for-youtube.com). These connections are associated with fetching 'scripletsRules', a post-installation mechanism used to deliver dynamic payloads and potentially bypass extension security reviews.
Detects HTTP requests initiated by common browser adblock extensions to remote API endpoints for retrieving rule configuration files. This behavior can be exploited by adversaries to perform remote scriptlet injection or change extension behavior via server-side updates, potentially enabling unauthorized JavaScript execution in the browser's context.
Detects network connections from browser processes (Chrome, Edge, Brave) to 'api.adblock-for-youtube.com'. This activity is linked to the retrieval of remote configuration scripts that can deliver malicious payloads, enabling arbitrary JavaScript execution within the context of visited web pages without requiring an official browser store update.
Detects Browser-in-the-Middle (BitM) phishing infrastructure associated with PhaaS kits (e.g., Bluekit). The detection monitors proxy access logs for patterns where page assets (images, fonts, CSS) are fetched through a proxy API endpoint on behalf of the victim, combined with WebSocket connections used for real-time relay of victim inputs to the attacker.
Detects network connections to known C2, VPS, VPN, and Starlink IP addresses and ranges used by the Handala group (Void Manticore) for their operations.
This rule monitors network device telemetry for three distinct indicators of compromise: usage of specific botnet-associated User-Agent strings, high-volume automated scanning against known IoT-vulnerable ports (80, 8080, 7547, 52869, 37215), and outbound network connections to known RondoDox command and control server infrastructure.
Detects a web browser saving an executable to disk immediately after the user conducts a search engine query for W2 tax forms, indicating SEO poisoning or malvertising.
Detects outbound network connections to remote URLs containing keywords associated with blockchain, cryptocurrency, or Web3 technologies. This behavior may indicate an adversary utilizing blockchain services or decentralised infrastructure for command and control (C2) communication, exfiltration, or proxying.
This rule detects potential lateral movement activity by identifying devices that establish connections to three or more distinct remote IP addresses via SMB/CIFS ports (445 or 139) within a one-hour window. The query excludes internal network ranges (10.x.x.x and 192.168.x.x) to focus on connections that may be traversing network boundaries or reaching out to segments that might indicate unauthorized discovery or movement.
This rule detects connection attempts to common administrative and remote access ports (RDP, SSH, SMB, RPC) from non-internal IP address ranges. Such activity may indicate an attempt to bypass Zero-Trust network policies or unauthorized remote access attempts from external or untrusted segments.
Detects network traffic associated with known Cobalt Strike Beacon request URI patterns. This rule utilizes network signature inspection to flag outbound connections containing URI fragments commonly used by Cobalt Strike default profiles.
Detects suspicious command-line executions involving common Windows system binaries (rundll32.exe, mshta.exe, certutil.exe, wmic.exe) when they contain keywords indicative of network communication or data transfer (http, https, base64, /transfer). This pattern is often observed in malware or adversary techniques to download payloads, exfiltrate data, or execute remote code.
Detects repeated HTTP PUT operations targeting the Ghost CMS admin API for post updates. This rule focuses on network connections or process command lines indicating such activity, retaining principal and target context for further correlation. This activity could be indicative of exploitation of vulnerabilities like CVE-2026-26980, leading to mass compromise and content manipulation.
Targets high-volume account failures followed by a successful tunnel or portal authentication. The UDM rule retains principal and target context for correlation.
Detects DNS tunneling used for covert C2 communications
Targets anomalous Netlogon or CLDAP traffic followed by LSASS termination or domain-controller restart indicators. The UDM rule retains principal and target context for correlation.
Targets high-volume account failures followed by a successful tunnel or portal authentication. The UDM rule retains principal and target context for correlation.
SSL VPN password spray ending in success
Cortex XDR
This rule targets high-volume account failures followed by a successful tunnel or portal authentication on SSL VPNs. It aims to detect password spraying attacks that eventually lead to a successful login, providing causality fields for investigation.
This rule detects network connections from endpoints to a list of known malicious domains. The detection is further refined by looking for specific URL paths such as '/wlc/', '/load/', or 'success/', which are commonly associated with command and control (C2) communication or data exfiltration activities by malware. This indicates potential compromise and active communication with adversary infrastructure.
Detects broad hollowing logic involving injected Microsoft utilities (InstallUtil.exe, RegAsm.exe, RegSvcs.exe, aspnet_compiler.exe, MSBuild.exe) communicating over non-standard web command and control ports (8443, 5443, 8041). This rule specifically excludes common initiating processes like cmd.exe, powershell.exe, explorer.exe, and svchost.exe to reduce noise.
Detects network events where a device communicates with the 'urlzzz.php' endpoint, specifically when this communication is correlated with file events involving 'Login Data' or 'Cookies'. This indicates potential exfiltration of browser credentials or session information by the UnregStealer malware.
Page 129 of 246