Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,158 detections
Filters
Last updated
All Time
Detection languages
2,304
1,070
640
289
288
Contributors
918
814
769
696
224
Categories
20,460
11,847
5,879
5,158
4,866
Platforms
2,861
2,017
816
524
213
Products / Services
1,339
1,144
831
576
366
MITRE Techniques
1,825
1,307
787
747
577
CVEs
9
7
7
6
6
IDS Classtypes
538
151
101
57
48
IDS Protocols
375
373
132
64
42
This rule detects indicators of a multi-stage infection involving PlugX malware, often associated with the Mustang Panda threat group. It correlates process execution events where the command line contains "mustang", "panda", or "plugx" with either registry modifications containing the same keywords or network connections to a remote URL containing "/update". This correlation helps to identify more sophisticated attacks that involve multiple stages of execution, persistence, and communication.
This rule detects suspicious downloads of Python packages from pypi.org or pypi.python.org by pip or python executables. It specifically looks for a high volume (5 or more) of downloads of common package names (numpy, requests, pandas, util, common) within a one-hour window from a single device. This could indicate an attempt to compromise the software supply chain by introducing malicious versions of popular packages.
This rule detects network traffic containing the string ".bashrc" on TCP port 22 (SSH). This could indicate an attempt to modify a user's shell profile for persistence, as .bashrc is a common file used to configure the Bash shell environment and can be leveraged by attackers to execute malicious commands upon login.
This rule detects network traffic that contains specific strings indicative of a Systemd service unit being created for persistence. Specifically, it looks for the string "/etc/systemd/system" and ".service" within TCP traffic directed to the home network on port 22 (SSH). This combination suggests an attempt to establish persistence on a Linux system by creating a new Systemd service.
This rule detects remote modification attempts of the 'Run' key within the Windows Registry, which is commonly used for persistence by malware and legitimate applications to automatically start programs when a user logs in. The detection specifically looks for network traffic on port 445 (SMB) containing the string 'CurrentVersion\Run', indicating an attempt to interact with this registry path remotely.
This rule detects devices making a high volume of DNS queries (50 or more within a 5-minute window) to domains that have 4 or more subdomains and are not common legitimate services like microsoft.com, google.com, or amazon.com. This pattern can be indicative of DNS beaconing, a technique used by adversaries for command and control (C2) communication or data exfiltration.
This rule detects successful network connections to remote URLs associated with AlphV/BlackCat ransomware, including payment sites. It specifically looks for 'alphv', 'blackcat', 'noname', or 'ransom-payment' within the RemoteUrl field of DeviceNetworkEvents.
Detects network connections to URLs associated with the REvil ransomware family, including its payment and drop sites. This rule specifically looks for successful network connections.
This rule detects network connections initiated by the 'teams.exe' process to public IP addresses. It specifically looks for outbound connections from the Microsoft Teams application to external, non-private IP ranges. This could be used to monitor unusual external communication patterns from Teams, although the specific intent without further context is unclear.
This rule detects the string "systemctl enable" within TCP traffic on port 22 (SSH). This indicates an attempt to enable a systemd service on a remote Linux host via an established SSH connection. This activity could be part of legitimate system administration but also could be indicative of an attacker persisting a malicious service.
This rule detects multiple WinRM authentication attempts using basic authentication from a single source IP address to the local network. It specifically looks for the 'Authorization: Basic' header in TCP traffic destined for port 5985 (default WinRM port) and triggers an alert if five such attempts occur within 30 seconds from the same source.
This rule detects attempts to log in to a Telnet server using the default credential 'admin'. It specifically looks for the string 'admin' in TCP traffic directed to the HOME_NET on port 23 (Telnet). A threshold of 3 attempts within 30 seconds from the same source IP triggers the alert, indicating a potential brute-force or default credential attack.
This rule detects suspicious file drops over SMB (port 445) that contain both ".lnk" (likely a shortcut file) and "System32" in their content. This combination is often indicative of malware attempting to spread via removable media, using shortcut files to execute malicious payloads, potentially mimicking legitimate system directories.
Detects network connections to specific API endpoints used by the HarborWatch Agent for Command and Control (C2) communication. This rule helps identify active C2 beaconing and tasking, even if the underlying IP infrastructure changes, by monitoring for unique URI paths like '/api/agent/tasks/' and '/api/heartbeat'.
ClickFix RAT C2 Connection
Cortex XDR
Detects network traffic to the primary command and control (C2) IP address (104.207.131.216) over port 16443, which is used by the ClickFix Python Remote Access Trojan (RAT) for malicious communication.
This rule detects the use of TLS protocol on port 443 with a specific content signature, indicating potential Command and Control (C2) activity. It triggers an alert if 20 such connections are observed from the same source within 60 seconds.
This rule detects potential session hijacking or replay attacks where a stolen MFA (Multi-Factor Authentication) session cookie is replayed from a new IP address. It specifically looks for HTTP traffic containing 'auth', 'session', or 'mfa' in the cookie header. A threshold of 5 occurrences within 5 seconds, tracked by destination IP, is used to trigger the alert, indicating suspicious activity.
This rule detects HTTP traffic to JetBrains Remote IDE tunnel domains (jetbrains.space or gateway.jetbrains.com). This activity is flagged as potential Command and Control (C2) communication, specifically leveraging remote access software for malicious purposes. A threshold of 10 connections within 60 seconds from a single source IP is set to reduce alerts on legitimate, less frequent usage.
This rule detects the use of the Slack API for potential bidirectional command and control (C2) communication. Specifically, it looks for HTTP traffic to 'slack.com' that includes the '/api/chat.postMessage' URI. A threshold of 10 occurrences within 60 seconds from the same source IP is set to reduce false positives, indicating a high frequency of message posting activity which could be indicative of automated C2.
Detects high volumes of network connections directed at Domain Controller RPC and authentication ports from a single source. This may indicate reachability testing, scanning, or exploitation attempts associated with CVE-2026-41089 (Netlogon RCE).
Detects negotiation of weak cipher suites to reduce encryption strength
Page 151 of 246