Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,158 detections
Filters
Last updated
All Time
Detection languages
2,304
1,070
640
289
288
Contributors
918
814
769
696
224
Categories
20,460
11,847
5,879
5,158
4,866
Platforms
2,861
2,017
816
524
213
Products / Services
1,339
1,144
831
576
366
MITRE Techniques
1,825
1,307
787
747
577
CVEs
9
7
7
6
6
IDS Classtypes
538
151
101
57
48
IDS Protocols
375
373
132
64
42
Detects upload of backdoored container images to internal registries
This rule detects post-VPN discovery or lateral movement activities by monitoring network connections initiated by specific command-line tools. It targets the use of utilities like PowerShell, cmd, net, nltest, adfind, ldapsearch, wmic, or winrs to interact with many internal systems, which could indicate an attacker performing reconnaissance or moving laterally within the network after gaining initial access, potentially via a compromised VPN.
Targets JSON-RPC eth_call usage by a non-browser process for dynamic command or address resolution. The UDM rule retains principal and target context for correlation.
Targets JSON-RPC eth_call usage by a non-browser process for dynamic command or address resolution. The UDM rule retains principal and target context for correlation.
Targets plain, encoded, double-encoded, and mixed-separator path traversal in a JRPC request. The UDM rule retains principal and target context for correlation.
Blockchain eth_call Command Resolution
Cortex XDR
This rule detects JSON-RPC 'eth_call' usage originating from a non-browser process, which could indicate dynamic command or address resolution related to blockchain interactions. The XQL view retains actor and causality fields to aid in investigation.
Token and tick payload URL structure
Cortex XDR
This rule detects network connections where the URL or remote IP address matches a specific pattern indicative of short-lived downloader URLs. These URLs typically contain paired tokens, numeric ticks, and a signature timestamp, often associated with malware distribution ecosystems. The rule leverages XQL to retain actor and causality fields for further investigation.
Detects the initialization of an alternative hidden shell environment via 'WindowsBackstageShell.exe' and its subsequent network connections. This activity is associated with the SilentCanvas operation.
Identifies `grep` or `findstr` utilizing decoded regex patterns searching for cloud environment variables locally, specifically looking for patterns like AKIA (AWS Access Key ID), xoxb (Slack Bot User OAuth Token), ghp_ (GitHub Personal Access Token), or npm_ (NPM Access Token). This activity is then correlated with network connections to a specific IP address (216.126.225.129), which is associated with the Megalodon CI/CD malware.
Generalized advanced detection for DLL sideloading from unprotected directories (Downloads, Temp, Public) followed by network beaconing. This rule identifies specific DLLs (autorun.dll, UnityPlayer.dll, UpdateChecker.dll, uevmonitor.dll) being loaded from these suspicious locations and then initiating network connections.
Detects PowerShell initiating web requests specifically for .jpeg files, a core component of the staging phase of the SilentCanvas operation.
Detects the Dropbox staging URL used to deliver the obfuscated Synaptics archive, specifically looking for network connections to 'dropbox.com' for 'Synaptics.rar' and correlating it with the execution of '._cache_GAME1.exe'. This indicates the download and potential execution of a malicious payload.
This rule detects a sequence of events where a network connection to a specific URL pattern ('ey.php') is followed within one hour by the execution of a process named 'Synaptics.exe'. This behavior is indicative of the Steam Wallpaper malware, where an initial C2 ping by a wrapper leads to the execution of a subsequent payload.
This rule identifies an anomalous surge in network connection attempts to a particular remote IP address. It establishes a baseline of average daily connection counts to each remote IP over the past week. It then compares the current hourly connection count to this baseline, triggering an alert if the current count is more than five times the baseline and surpasses a total of 500 connections within that hour. This could indicate various malicious activities such as data exfiltration, command and control communication, or a denial-of-service attack originating from the monitored environment.
This rule detects a high volume of HTTP POST requests to known SMS API providers (Twilio, Nexmo, Vonage) from a single source IP address within a short timeframe. This pattern is indicative of a 'pumping attack' or SMS fraud, where an attacker attempts to generate a large number of SMS messages, often to premium rate numbers, to incur charges or exploit vulnerabilities in billing systems. The threshold is set to 20 requests within 60 seconds from the same source.
Correlates mshta connecting to abimj.edu.af followed by a file write of zuidrt.hta or a .vmxx shellcode file, indicative of the Operation XENOFISCAL campaign.
Correlates the execution of a JavaScript file with a 24-hex-character name (e.g., 'a1b2c3d4e5f6a7b8c9d0e1f2.js') with an active outbound network connection to the 23.254.164.x subnet. This pattern is indicative of the Mastra NPM supply chain compromise, where malicious JavaScript is executed and attempts to communicate with a command and control server.
This rule detects the execution of 'pythonw.exe' from the AppData\Local folder, which then initiates network connections to known Vidar C2 domains (brokeapt.com, pan.ssffaa19.xyz, pan.rongtv.xyz). This behavior is indicative of the Vidar stealer malware, often distributed via social engineering campaigns leveraging AI brands as bait.
This rule detects network connections to subdomains of 'generate.2faplugin.org' using a regular expression. This infrastructure is associated with a supply chain compromise targeting ShapedPlugin, where backdoored pro plugins were distributed via official channels. The regex is designed to catch varying subdomains related to this malicious infrastructure.
Detects high-rate DNS queries used for network topology and configuration discovery
Detects SID history manipulation for domain privilege escalation
Page 144 of 246