Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,158 detections
Filters
Last updated
All Time
Detection languages
2,304
1,070
640
289
288
Contributors
918
814
769
696
224
Categories
20,460
11,847
5,879
5,158
4,866
Platforms
2,861
2,017
816
524
213
Products / Services
1,339
1,144
831
576
366
MITRE Techniques
1,825
1,307
787
747
577
CVEs
9
7
7
6
6
IDS Classtypes
538
151
101
57
48
IDS Protocols
375
373
132
64
42
This rule detects network connections or URL click events to a list of domains known to be associated with phishing or malware distribution. The rule specifically looks for connections to these domains that also contain certain path segments like '/wlc/', '/load/', or '/success/', which are often indicative of malicious activity or payload delivery. It also broadly checks for any URL click events containing these suspicious domains.
Detects suspicious command-line executions involving common Windows system binaries (rundll32.exe, mshta.exe, certutil.exe, wmic.exe) combined with keywords often associated with network communication or data transfer (http, https, base64, /transfer). This pattern can indicate attempts at downloading malicious payloads, exfiltrating data, or executing encoded commands.
This rule detects network connections to suspicious domains or IP addresses associated with potentially compromised or malicious VPN infrastructure. Specifically, it looks for connections to 'vpn-fortinet.com', 'ivanti-vpn.org', 'forticlient-vpn.de', or the IP address '194.76.226.93'. These indicators may suggest attempts to establish command and control, exfiltrate data, or engage in other malicious activities via compromised VPN services.
Detects instances where rundll32.exe is launched by explorer.exe and includes command-line parameters indicative of network communication (http, https) or WebDAV activity (davclnt.dll, WebDAV, \\). This behavior can be associated with forced authentication attempts or execution of remote code.
Detects suspicious execution of rundll32.exe initiated by explorer.exe that includes network-related command-line arguments (http, https, .dll, entrypoint). This pattern can indicate malicious DLL loading or execution attempting to establish network communication, potentially for command and control or data exfiltration. The rule filters out common system accounts and focuses on infrequent occurrences.
This rule detects a high volume of network connection retries (more than 500 within a one-minute window) to a distinct remote IP address. This behavior can be indicative of a network denial-of-service (DoS) attack, where an attacker attempts to overwhelm a target by repeatedly trying to establish connections.
This rule detects a high volume of network share connections (SMB/CIFS) from a single device to multiple remote IPs within a short timeframe. This behavior can be indicative of ransomware attempting to encrypt files across network shares, or other forms of rapid lateral movement and data access. The rule specifically looks for connections on ports 445 or 139 initiated by common user or system processes like explorer.exe, cmd.exe, or powershell.exe.
This rule detects suspicious access patterns to Windows administrative shares (C$, D$, E$, IPC$, ADMIN$). It specifically looks for multiple access attempts (10 or more within an hour) involving read or write operations (AccessMask contains '0x0001' or '0x0002') from a single source IP address and account. This behavior can indicate lateral movement, data exfiltration, or other malicious activity.
This rule detects potential command and control (C2) beaconing activity by monitoring network events for specific URL patterns and user agent strings associated with known C2 frameworks like AzureVeil and Adaptix. It identifies beaconing if multiple devices communicate with the same remote IP address using these indicators within a 15-minute window, with more than 5 beacon counts and more than 1 distinct device.
This rule detects suspicious network connections where the initiating process command line contains keywords indicative of evasion techniques such as 'obfuscate', 'encode', or 'encrypt'. It specifically looks for these activities over common web ports (80, 443, 8080, 8443) and triggers an alert if 10 or more such attempts are observed from a device within an hour.
Detects indicators associated with the MiniUpdate RAT deployed by the threat group Screening Serpens. This rule identifies network connections to known C2 domains, the creation of a persistence scheduled task named 'WindowsSecurityUpdate', and the dropping of specific RAT module DLLs ('UpdateChecker.dll', 'InitInstall.dll', 'Updater.dll') in common user-writable directories. The file event detection is tuned to require multiple generic DLLs or the presence of 'InitInstall.dll' to reduce false positives.
Detects DNS resolutions for domains associated with the Kali365 affiliate panel, which is heavily abused in device code phishing campaigns. This rule specifically identifies DNS queries to known malicious domains used by this PhaaS (Phishing-as-a-Service) infrastructure.
This rule detects Fast Flux DNS activity, characterized by rapid changes in IP addresses associated with the same domain within a short period. Specifically, it triggers an alert if 30 or more distinct IP addresses are observed for a single domain within a 10-second window, based on DNS queries. This behavior is often indicative of malware using fast flux techniques to evade detection and make takedowns more difficult.
This rule detects potential use of a compromised Virtual Private Server (VPS) as a proxy relay. It specifically looks for HTTP CONNECT requests, which are commonly used for tunneling traffic through a proxy. A threshold of 10 CONNECT requests within 60 seconds from a single source IP is set to identify suspicious activity, indicating a high volume of proxy usage.
This rule detects a potential account takeover attempt via a credential stuffing attack. It specifically looks for HTTP POST requests to a URI containing 'login' (case-insensitive) from a single destination IP address, with a high frequency (50 requests within 60 seconds). This pattern suggests an automated attempt to try multiple credentials against a login endpoint.
This rule detects a brute-force attack against an IMAP email account. It triggers when a source IP attempts to connect to the IMAP port (993) on the home network 20 or more times within a 30-second window. This behavior is indicative of an attacker repeatedly trying different credentials to gain unauthorized access to an email account.
This rule detects a brute force attempt against a cloud management console. It triggers when a source IP address makes 10 or more HTTP POST requests to a URI containing 'signin' within a 30-second window. This pattern is indicative of an automated attempt to guess credentials for a login page.
This rule detects the use of a code signing certificate that is suspected to be stolen. It specifically looks for HTTP traffic where the TLS certificate subject contains an organization name matching a common corporate naming convention (e.g., 'O=Company Inc', 'O=Company LLC', 'O=Company Ltd', 'O=Company Corp') and the issuer is 'DigiCert'. This combination suggests a potentially legitimate certificate being used in an unauthorized context, possibly for signing malicious software.
This rule detects network traffic to known initial access broker (IAB) market domains. It specifically looks for HTTP requests where the host matches 'exploit.in', 'xss.is', 'raidforums', or 'breachforums' and the URI contains the word 'access'. This indicates potential activity related to purchasing or selling initial access to compromised systems.
This rule detects suspicious access to domain registration services by monitoring HTTP traffic for requests to known domain registrars (namecheap.com, godaddy.com, porkbun.com) with a URI containing 'register'. A threshold of 5 such requests within 60 seconds from the same source IP triggers an alert, indicating potential resource development activity such as bulk domain registration.
This rule detects potential TLS client configuration fingerprinting activity. It triggers an alert when a client sends 20 or more TLS Server Name Indication (SNI) requests to a server within a 30-second window. This behavior can be indicative of reconnaissance activities where an attacker is attempting to identify services or configurations on a target network by observing TLS handshakes.
Page 172 of 246