Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,158 detections
Filters
Last updated
All Time
Detection languages
2,304
1,070
640
289
288
Contributors
918
814
769
696
224
Categories
20,460
11,847
5,879
5,158
4,866
Platforms
2,861
2,017
816
524
213
Products / Services
1,339
1,144
831
576
366
MITRE Techniques
1,825
1,307
787
747
577
CVEs
9
7
7
6
6
IDS Classtypes
538
151
101
57
48
IDS Protocols
375
373
132
64
42
Detects a phishing page upgrading to WebSocket or polling transport with Socket.IO event framing during authentication. This behavior is indicative of an adversary-in-the-middle (AiTM) attack, specifically associated with the 'Tycoon' threat activity.
Detects browser network events fetching secondary stage loaders via PHP handlers masking as schema descriptors.
Detects data exfiltration by identifying TCP network connections over Port 53 (DNS) originating from non-standard binaries, bypassing layer 7 firewall inspections.
Detects PowerShell establishing a reverse shell using the .NET Net.Sockets.TCPClient class and GetStream method. This is a common technique used by adversaries to create an interactive shell for remote control.
Detects the VSCode executable making direct web requests to the GitHub API. This may indicate a malicious extension exfiltrating or validating stolen OAuth tokens, as demonstrated in the 1-click GitHub Dev/VSCode webview attack.
Detects attempts to inject shell metacharacters or command substitution into VNC-related operations, specifically targeting the 'start vnc' command within network connection URLs or process command lines. This rule aims to identify potential command injection vulnerabilities being exploited.
This rule detects a sequence of events where multiple failed one-time code (MFA) attempts are followed by a successful new device registration within Dashlane. This pattern can indicate an attacker attempting to brute-force MFA codes and then registering a new device once successful, potentially leading to account compromise.
This rule detects network connections or process command lines containing a specific URL pattern often used by short-lived malware downloaders. The pattern includes paired tokens, numeric ticks, and a signature timestamp, indicating a potential malware distribution ecosystem.
Detects outbound network connections to 'stitch-design.ai' or 'stitch-google.com', which are identified as malicious domains utilized by a compromised AI agent skill. This skill attempts to bypass security vetting by dynamically fetching its instructions from these attacker-controlled external domains post-installation.
Identifies execution of the Linux/macOS bash cradle used by GLASSWORM's WASM loader. It looks for curl fetching the specific OS path structure ('/linux/i/_' or '/darwin/i/_') and piping to bash.
Detects use of Discord webhooks for covert C2 or data exfiltration
Detects reverse proxy phishing pages designed to intercept MFA OTP codes
Detects attempts to discover network shares and remote systems using 'net share', 'net view' commands, or by accessing UNC paths with extended path prefixes, which can be indicative of lateral movement or reconnaissance activities.
Correlates the Komari C2 agent writing secondary executable payloads (.exe, .dll) to disk, indicating lateral tool transfer or stage progression.
Detects the Bomgar process piping the output of a command shell directly into a network socket, establishing an interactive reverse shell. This often indicates exploitation of a Bomgar vulnerability.
Identifies the Komari agent process acting as a parent to cmd.exe or powershell.exe which then execute typical post-exploitation discovery commands. This detection correlates process creation events with network events to ensure the initiating process also has network activity, reducing false positives.
This rule detects network requests for specific URI paths and filenames ('css.js' or 'cf.js') known to be used by the ErrTraffic malware distribution framework for delivering ClickFix payloads. It identifies potential command and control (C2) infrastructure by grouping requests based on client IP, source IP, domain, destination IP, and URL.
This rule detects the download of a standalone Python build for Apple Darwin from astral-sh/python-build-standalone on GitHub using 'curl', followed by its extraction using 'tar'. This activity could indicate a developer setting up a specific Python environment or potentially a malicious actor introducing a custom Python interpreter.
Detects unauthorized or external access attempts to exposed Ollama API endpoints (port 11434) for generating or chatting, which could be indicative of LLMjacking. The rule identifies requests from known attacker IPs or any external IP, especially if the request count is high.
Detects a multi-stage attack pattern involving the creation of JavaScript or XML files in a specific public user directory, followed by their execution via wscript.exe or cscript.exe, and subsequently, the spawning of curl.exe by these script hosts to download additional content. This sequence is indicative of malware staging and execution, often used for initial access or further payload delivery.
Detects the creation of a specific scheduled task named 'WindowsSecurityUpdate' using 'schtasks.exe' in conjunction with network communication to 'azurewebsites.net'. This activity is indicative of the MiniUpdate malware, associated with the Iranian APT group 'Screening Serpens', attempting to establish persistent access.
Page 131 of 246