Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,158 detections
Filters
Last updated
All Time
Detection languages
2,304
1,070
640
289
288
Contributors
918
814
769
696
224
Categories
20,460
11,847
5,879
5,158
4,866
Platforms
2,861
2,017
816
524
213
Products / Services
1,339
1,144
831
576
366
MITRE Techniques
1,825
1,307
787
747
577
CVEs
9
7
7
6
6
IDS Classtypes
538
151
101
57
48
IDS Protocols
375
373
132
64
42
This rule detects the creation of a '.pkg_history' file, which is a known indicator of the Mastra NPM supply chain compromise, followed by a network connection to specific command and control (C2) IP addresses (23.254.164.123 or 23.254.164.92) within a 5-minute window on the same device. This correlation aims to identify successful exploitation and subsequent C2 communication by the Mastra NPM malware.
Detects network connections related to Xworm malware family indicators
Detects OAuth token theft via malicious redirect URI manipulation
Correlates browsers encountering a certificate error (invalid issuer) for a major cloud provider due to DNS redirection.
Identifies local devices sending crafted UPnP requests to the local gateway to programmatically alter DNS settings. This rule specifically looks for UDP traffic on port 1900 (UPnP) originating from processes like curl.exe or powershell.exe, which could indicate an attempt to exploit router UPnP vulnerabilities for DNS hijacking.
This rule detects anomalous network connections originating from common communication applications (Teams, Slack, Discord, Skype) to non-standard ports (not 80, 443, 8080, 8443) and to IP addresses not typically associated with Microsoft or other major cloud providers (e.g., not starting with 13. or 51.). It specifically looks for a high volume of such connections (10 or more within an hour) from a single process on a device, which could indicate protocol tunneling or the use of these applications for command and control.
Detects NTP reflection amplification DDoS attack traffic
Detects attempts by the Remcos RAT loader to perform WebRTC IP leakage by monitoring process command lines for keywords like 'webrtc', 'stun', 'turn', or 'ice' when initiated by common browsers (chrome.exe, firefox.exe, opera.exe) and having a parent process related to 'Remcos'. This indicates an attempt to gather victim IP addresses.
This rule detects network connections to remote URLs containing indicators associated with the XWorm Remote Access Trojan (RAT). It specifically looks for 'xworm', 'x-worm', 'wormx', or '/xworm' within the RemoteUrl field of DeviceNetworkEvents.
Identifies characteristics of compiled Go binaries (e.g., executing from temp with specific build path signatures in memory) taking malicious actions. This rule specifically looks for process execution of an executable, combined with network connections on port 445 (SMB), and the creation or modification of files ending with '.gentlemen'.
Detects the SSH worm component of the isp.sh dropper used in the CVE-2026-33017 Langflow cryptominer campaign. The worm enumerates local SSH private keys (id_rsa, id_ed25519, id_dsa), parses known_hosts, queries SSH_AUTH_SOCK for agent-loaded keys, and spreads via SSH and SCP with BatchMode=yes and StrictHostKeyChecking=no to avoid interactive prompts during lateral movement.
Correlates the user mounting a tax-themed ISO archive followed by the execution of a binary establishing a Remcos RAT C2 connection.
Detects ARP poisoning via gratuitous ARP responses for MITM attacks
Detects a module enumerating local processes, named pipes, loopback listeners, mutexes, or shared-memory sections to locate bot peers, indicative of Kazuar malware activity.
Detects a module changing protocol, destination class, or cloud service after repeated failed connections on its primary channel. This behavior is indicative of malware like Kazuar attempting to establish C2 communication through alternative means when its initial attempts fail.
Identifies JavaScript environments writing randomized markers to localStorage to suppress repeated execution of the malicious ClickFix payload. This rule specifically looks for browser storage modifications combined with network events indicating a CDN-hosted JavaScript file.
Detects the ClickFix technique where MSHTA is invoked to download and execute an MSIXBUNDLE that is actually a ZIP/HTA polyglot bypassing standard inspection. This rule specifically looks for mshta.exe executing with a command line that attempts to download files with extensions like .msixbundle, .zip, or .txt over HTTP/HTTPS, combined with network connection events.
Detects sudden loss of telemetry from multiple EDR agents (specifically Microsoft Defender processes like msmpeng.exe and mssense.exe) while the OS remains active, indicating potential Quality of Service (QoS) throttling or other defense evasion techniques aimed at impairing EDR functionality.
This rule monitors for suspicious activity originating from the DHCP Client service process (svchost.exe running with 'Dhcp' in the command line). It detects unauthorized child processes (such as cmd.exe or powershell.exe), unexpected child processes that deviate from established baselines, service crashes potentially indicative of exploitation, and anomalous network connections to non-standard DHCP ports or external IP addresses.
This rule detects network connections to common lateral movement ports (SMB, NetBIOS, RDP, FTP, Telnet, SSH) occurring within a 30-minute window before or a 60-minute window after the execution of known ransomware encryption binaries ('servertool.exe', 'encrypt.exe'). This correlation aims to identify post-encryption lateral movement attempts by ransomware, potentially for further compromise or data exfiltration.
This rule detects network connections to known command and control (C2) infrastructure associated with the 'Prinz Eugen' ransomware, also referred to as the ROOTBOY actor. It identifies connections to specific IP addresses and URLs that have been linked to this threat actor's operations.
Page 134 of 246