Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,158 detections
Filters
Last updated
All Time
Detection languages
2,304
1,070
640
289
288
Contributors
918
814
769
696
224
Categories
20,460
11,847
5,879
5,158
4,866
Platforms
2,861
2,017
816
524
213
Products / Services
1,339
1,144
831
576
366
MITRE Techniques
1,825
1,307
787
747
577
CVEs
9
7
7
6
6
IDS Classtypes
538
151
101
57
48
IDS Protocols
375
373
132
64
42
Detects the unique start and end markers (VAPTb3gin, VAPTfin) used by the VAPT autonomous framework to confirm exploit success across network or host logs. This rule searches across process and network events for these confirmation markers.
Detects the Komari agent executing from anomalous staging directories (e.g., Public, ProgramData, Temp) and immediately initiating high-frequency external network connections. This rule correlates process creation events with network connection events to identify suspicious behavior indicative of Komari C2 activity.
Identifies the fake updater process making network connections to download heavily encrypted payload blobs (often .bin or .dat files) to evade perimeter AV. This rule specifically looks for `curl.exe`, `powershell.exe`, or `certutil.exe` being used to download files with `.bin`, `.dat`, or `.enc` extensions, initiated by a process with 'setup' or 'update' in its filename.
Correlates the exploited Bomgar process utilizing native network utilities (curl, wget, certutil) to download secondary malware stages from the internet.
Correlates RuntimeHost.exe spawning suspended RegAsm.exe to inject mining shellcode, followed by network activity. This behavior is indicative of cryptojacking campaigns abusing ScreenConnect and .NET utilities for process hollowing.
Identifies suspicious access to Steam configuration files (loginusers.vdf) by processes other than legitimate Steam applications, combined with network connections to known malicious URLs associated with token theft. This rule aims to detect injected or hidden wrappers attempting to steal Steam tokens.
Detects CI/CD runners utilizing inline base64 decoding to execute malware payloads, specifically looking for processes that use 'base64 -d' in their command line and also initiate network connections to a known malicious IP address (216.126.225.129) while using 'curl' or 'wget'.
This rule detects network connections to Azure infrastructure (azurewebsites.net) that utilize specific API paths associated with the MiniJunk C2 framework. The paths include '/api/app/check', '/api/app/update', and '/api/app/comment', which are indicative of command and control beaconing activity.
Identifies network traffic requesting 'te_3_la.js', a script used by UnregStealer to strip password masking from DOM elements, facilitating credential theft.
This rule detects potential ransomware lateral movement patterns by correlating specific network connection attempts (SMB/RDP/RPC) with the observed creation of files having the '.prinzeugen' extension on the same host within a 2-hour window. This behavior is indicative of a ransomware strain propagating across the network and performing encryption.
Detects network activity associated with the ROOTBOY actor, specifically identifying internal devices communicating with known malicious command and control (C2) IP addresses and subsequently attempting to access specific suspicious domains or URLs linked to the actor's infrastructure.
Detects successful network connections from hosts to specific remote IP ranges (associated with CN infrastructure) on known ports commonly used by ValleyRAT and Gh0st RAT.
Detects anomalous device network activity involving 5G-specific protocol ports (e.g., GTP-U, SIP). The rule aggregates unique port usage per device over 1-hour intervals to identify potential network reconnaissance, scanning, or unauthorized control plane communication.
Correlates pythonw.exe network connections with HTTP POST characteristics (if Deep Packet Inspection data available) for data exfil. This rule specifically looks for network connections initiated by 'pythonw.exe' to known malicious domains ('brokeapt.com', 'pan.ssffaa19.xyz').
Correlates the dropping of 'install-persistent.php' within a 'woocommerce' folder with a subsequent network connection to the C2 IP '194.76.217.28' on custom port '2871' within a one-hour window. This activity is indicative of a supply chain compromise targeting ShapedPlugin, where backdoored pro plugins are distributed via official channels.
Detects bun.exe executing scripts directly from remote URLs, a common fallback behavior for these worms.
Aggregates all traffic over the custom ShapedPlugin C2 port 2871 to identify potential lateral movement or widespread beaconing.
This rule detects potential exploitation attempts targeting REDCap, specifically looking for file events involving 'help.php' or 'Upgrade.php', or network events where the remote URL contains 'REDCAP-TOKEN'. These indicators suggest an attacker might be trying to exploit known vulnerabilities or exfiltrate data from a REDCap instance.
This rule identifies indicators and behaviors associated with KongTuke and PS1Bot campaigns. It specifically looks for network connections to known malicious IPs, domains, and URI paths, as well as the execution or presence of files with known malicious SHA256 hashes associated with these campaigns. The original description mentions 'finger.exe abuse, scheduled task and registry persistence, dynamic C# compilation for keylogging/screen capture, and suspicious PowerShell download cradles', but the current KQL rule only covers network and file/process IOCs.
Detects Python transmitting a newly created archive or JSON collection through requests, urllib, aiohttp, or a custom socket. This behavior is associated with the InvisibleFerret malware.
This rule detects successful network connections from devices to a list of known botnet command and control (C2) IP addresses. This indicates potential compromise and communication with malicious infrastructure.
Page 136 of 246