Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,158 detections
Filters
Last updated
All Time
Detection languages
2,304
1,070
640
289
288
Contributors
918
814
769
696
224
Categories
20,460
11,847
5,879
5,158
4,866
Platforms
2,861
2,017
816
524
213
Products / Services
1,339
1,144
831
576
366
MITRE Techniques
1,825
1,307
787
747
577
CVEs
9
7
7
6
6
IDS Classtypes
538
151
101
57
48
IDS Protocols
375
373
132
64
42
This rule detects network connections to common lateral movement ports (SMB, NetBIOS, RDP, FTP, Telnet, SSH) occurring within a 30-minute window before or a 60-minute window after the execution of known ransomware encryption binaries ('servertool.exe', 'encrypt.exe'). This correlation aims to identify post-encryption lateral movement attempts by ransomware, potentially for further compromise or data exfiltration.
This rule detects network connections to known command and control (C2) infrastructure associated with the 'Prinz Eugen' ransomware, also referred to as the ROOTBOY actor. It identifies connections to specific IP addresses and URLs that have been linked to this threat actor's operations.
This rule detects a pattern of network shared folder access followed by the execution of known ransomware executables ('servertool.exe', 'encrypt.exe') within a 45-minute window. This behavior is indicative of ransomware preparing to encrypt data on network shares.
Detects Bun beaconing to the checkmarx or kosche C2s, followed immediately by dropping a new .js or .mjs file. This behavior is indicative of a supply chain attack where a compromised Bun package might be attempting to establish C2 communication and then deploy malicious JavaScript files.
Detects fake AI installers (e.g., deepseek, ProFluxeFlowAi) making network connections before deploying a Python loader. This activity is indicative of social engineering campaigns leveraging popular AI brands to distribute malware.
Detects node.exe spawning curl or wget pointing directly to the hardcoded C2 IPs (94.154.172.43, 91.195.240.123) indicating stage 2 download.
This rule detects suspicious DNS queries originating from VBScript (wscript.exe or cscript.exe) processes. It specifically filters out common legitimate domains like Microsoft, Windows, and Google to reduce noise, aiming to identify potential phishing or malware activity leveraging VBScript for network communication.
EchoCreep Sends an Up Success Check-In
Cortex XDR
Detects a Go backdoor or renamed service process emitting the distinctive 'Up Success' runtime message used during Discord channel check-in. This rule specifically looks for network events where the process name matches common system processes (searchapp, service, update) and the command line contains 'Up Success'.
Identifies browsers executing highly obfuscated Tycoon2FA JavaScript payloads utilizing eval or specific array mapping functions to hide the phishing kit logic, specifically when interacting with authentication or login pages.
Identifies emails where SenderFromDomain matches an internal legitimate domain, but the SenderIPv4 originates from an unassociated external network exploiting permissive SPF records or dangling DNS. This rule specifically looks for emails with a sender domain matching 'yourcompany.com' (which should be replaced with the actual tenant domain), where the sender's IPv4 address is not from internal networks (excluding 10.0.0.0/8 and 192.168.0.0/16), and the SPF authentication passed. It further ensures that the originating IP address is not known to internal devices via network connection events, helping to filter out legitimate internal mail relays or services.
Detects browser network events accessing Cloudflare Turnstile endpoints followed immediately by a connection to an anomalous, newly registered AiTM subdomain. This sequence of events is indicative of a CAPTCHA bypass technique used by the Tycoon2FA phishing kit.
This rule detects a scenario where a user downloads a fake installer (e.g., setup, install, vpn executable) from a browser, and shortly after, the downloaded executable initiates a PowerShell process. This PowerShell process then attempts to fetch secondary payloads from known malicious hosting services like Discord or Pastebin using `Invoke-WebRequest` or `IEX`.
Detects network activity initiated by the 'PerfWatson2.exe' process, which is associated with the TinyRCT .NET backdoor, communicating with a known malicious C2 IP address (45.32.113.172). The rule monitors for network connections from this specific binary to the identified infrastructure, indicative of beaconing or command and control activity.
This rule detects a behavioral transition where an active browser session (Chrome or Edge) navigates to a URL containing deceptive captcha/verify/human keywords, immediately followed by the invocation of PowerShell within a 3-minute window, initiated by explorer.exe. This pattern is indicative of the ClickFix attack, where a user is tricked into interacting with a malicious website that then triggers a PowerShell execution.
Identifies users accessing Cloudflare Turnstile or reCAPTCHA gateways immediately preceding the AiTM proxy domain resolution. This behavior is indicative of an adversary-in-the-middle (AiTM) phishing attack attempting to bypass CAPTCHA challenges.
Detects known malicious file hashes associated with Miasma/Mini Shai-Hulud malware, as well as suspicious npm-lifecycle behaviors including binding.gyp shell execution, runtime staging of the Bun engine, and suspicious Bun-related downloads from GitHub.
Detects the execution of the legitimate AutoIt3.exe interpreter launching a script (either .au3 or .a3x) that also initiates network connections to non-localhost IP addresses. This behavior is indicative of malicious activity, such as that observed with the Vidar stealer.
This rule detects network connections to known malicious IP addresses or attempts to resolve specific domains associated with malicious activity. It monitors for outbound network traffic patterns identified as potential indicators of compromise (IOCs) linked to command and control (C2) servers.
This rule detects network activity involving connections to known malicious IP addresses or DNS domains ('govtop.one') and subsequent attempts to download specific suspicious file payloads, such as archives or image files often associated with malicious activity. This activity is indicative of potential command and control communication or initial malware ingress.
Identifies network connections made by Python immediately after loading safetensors or pickle files, indicating a potential supply chain payload phoning home. The rule joins file events where specific model file types (.safetensors, .pkl, .pth) are loaded with network connection events from the same initiating process within one minute of the file load. It specifically excludes local loopback connections.
Detects curl POST requests sending JSON telemetry to attacker endpoints post-infection, specifically looking for patterns associated with the ClickFix campaign.
Page 130 of 246