Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,158 detections
Filters
Last updated
All Time
Detection languages
2,304
1,070
640
289
288
Contributors
918
814
769
696
224
Categories
20,460
11,847
5,879
5,158
4,866
Platforms
2,861
2,017
816
524
213
Products / Services
1,339
1,144
831
576
366
MITRE Techniques
1,825
1,307
787
747
577
CVEs
9
7
7
6
6
IDS Classtypes
538
151
101
57
48
IDS Protocols
375
373
132
64
42
This rule detects post-VPN discovery or lateral movement activities by monitoring network connections initiated by specific command-line tools. It targets the use of utilities like PowerShell, cmd, net, nltest, adfind, ldapsearch, wmic, or winrs to interact with many internal systems, which could indicate an attacker performing reconnaissance or moving laterally within the network after gaining initial access, potentially via a compromised VPN.
This rule detects unauthenticated POST requests with 'Content-Encoding: deflate' in the HTTP header or command line, specifically targeting a vulnerability in SolarWinds Serv-U. The rule aims to identify exploitation attempts related to CVE-2026-28318.
This rule detects network connections or process command lines containing a specific URL pattern often used by short-lived malware downloaders. The pattern includes paired tokens, numeric ticks, and a signature timestamp, indicating a potential malware distribution ecosystem.
Targets API request content containing shell separators together with command interpreters or transfer utilities. The UDM rule retains principal and target context for correlation.
Targets plain, encoded, double-encoded, and mixed-separator path traversal in a JRPC request. The UDM rule retains principal and target context for correlation.
This rule detects PowerShell processes attempting to retrieve or execute content from a remote RTF (Rich Text Format) resource. It specifically looks for PowerShell commands like 'Invoke-WebRequest', 'iwr', 'DownloadString', 'Invoke-Expression', or 'iex' that are directed towards a URL ending with '.rtf'. This behavior is often associated with malicious activity where RTF files are used as a delivery mechanism for scripts.
Detects a non-Discord process preparing multipart attachment data from a local path for upload through a messaging API. This behavior is indicative of malware like EchoCreep exfiltrating data via messaging platforms.
NSIS InetLoad downloader user agent
Cortex XDR
This rule detects the distinctive 'NSIS_InetLoad Mozilla' user-agent string, which is commonly used by staged downloaders. It specifically targets network events where the process image name ends with '.exe' and either the event subtype or the remote IP contains the 'NSIS_InetLoad Mozilla' string. The rule aims to identify the initial stages of malware delivery and execution, providing causality fields for investigation.
This rule detects Server-Side Request Forgery (SSRF) attempts originating from Cisco WebDialer by identifying network requests targeting loopback addresses (127.0.0.1, localhost, ::1), cloud instance metadata API addresses (169.254.169.254), private IP ranges (10.0.0.0/8, 192.168.0.0/16, 172.16.0.0/12), or using 'file://' or 'gopher://' protocols. The rule specifically looks for 'webdialer' in the event_sub_type or action_remote_ip fields to narrow down the source of the request. The XQL view includes actor and causality fields for further investigation.
Detects the unique URL structures matching the Service Worker DGA targeting randomized Amazon S3 buckets, indicative of potential command and control communication.
Detects connections to temporary Cloudflare quick tunnel endpoints initiated by VBS scripts.
Detects vLLM spawning download utilities like curl or wget to pull secondary payloads post-exploitation, potentially indicating a compromise related to CVE-2026-22778.
Detects network connection attempts to the cloud Instance Metadata Service (IMDS) endpoint (169.254.169.254) initiated by processes that are not known cloud management agents or system utilities, which may indicate unauthorized credential or IAM role token theft.
Detects non-browser processes initiating HTTPS network connections to well-known public DNS over HTTPS (DoH) resolvers. This behavior is often associated with command and control (C2) communication, where malware attempts to evade network security controls by tunneling DNS queries through encrypted HTTPS traffic.
Detects the execution of 'finger.exe' or a renamed version (e.g., 'ct.exe') when its command line contains an '@' symbol and either 'http', 'https', or a '.' (dot). This pattern is indicative of the LOLBin 'finger.exe' being used to communicate with an external C2 server, as observed in CrashFix/ModeloRAT campaigns.
This rule detects PowerShell commands leveraging WMI to enumerate installed antivirus products, which is a common post-exploitation reconnaissance technique. Specifically, it looks for 'powershell.exe' executing commands containing 'Get-CimInstance' and 'root\SecurityCenter2'. The rule also includes a join with network events, suggesting an attempt to correlate this activity with network communication.
Detects CI/CD runner agents calling 'aws configure list-profiles' and connecting to a known malicious IP address (216.126.225.129), as prescribed by the Megalodon CI/CD malware.
Detects the threat actor clearing the staging archives securely via sdelete or forcefully via del /f /q immediately post-exfiltration. This rule correlates process execution of 'cmd.exe' or 'sdelete.exe' with specific command-line arguments targeting archive files (zip, rar, 7z) and a preceding network connection to a remote IP, indicating potential data exfiltration followed by anti-forensic cleanup.
This rule detects continuous C2 beaconing activity associated with Matanbuchus malware. It specifically looks for network connections originating from 'svchost.exe' or 'dllhost.exe' to common web ports (80, 443, 8080) with a high frequency (more than 10 beacons) within a 5-minute window. This behavior is indicative of a hollowed process establishing command and control communication.
End-to-end correlation: Fake AI installer executes -> Drops pythonw.exe -> Network connection to Vidar C2.
Detects the use of `wget` or `curl` to specifically target a GitHub API endpoint with a suspicious string, indicating an attempt to download initial stage malware or tools from a dead drop. This pattern is associated with supply chain attacks where GitHub is used as a temporary hosting for malicious components.
Page 133 of 246