Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,158 detections
Filters
Last updated
All Time
Detection languages
2,304
1,070
640
289
288
Contributors
918
814
769
696
224
Categories
20,460
11,847
5,879
5,158
4,866
Platforms
2,861
2,017
816
524
213
Products / Services
1,339
1,144
831
576
366
MITRE Techniques
1,825
1,307
787
747
577
CVEs
9
7
7
6
6
IDS Classtypes
538
151
101
57
48
IDS Protocols
375
373
132
64
42
This rule detects the string "mount --bind" within TCP traffic on port 22 (SSH). This string indicates an attempt to create a bind mount, which can be used by attackers to obscure the true location of malicious files or to manipulate file system access. The rule specifically looks for this activity on the home network, suggesting an internal system being targeted or used for malicious purposes.
This rule detects when a network device disables hardware crypto acceleration. It specifically looks for TCP traffic on port 22 (SSH) from any source to the home network, containing the case-insensitive string "no crypto engine". This could indicate a policy violation or an attempt to degrade cryptographic performance, potentially for evasion or to facilitate other attacks.
This rule detects the negotiation of a weak cipher, specifically 'arcfour', during an SSH session. It monitors TCP traffic flowing to the home network on port 22 (SSH) and triggers an alert if the string 'arcfour' is found in the established session, ignoring case.
This rule detects attempts to dump the LSASS process memory remotely over SMB. It specifically looks for network traffic on TCP port 445 (SMB) containing the string "lsass.dmp" in a case-insensitive manner, indicating a potential credential dumping activity.
This rule detects attempts to modify file permissions remotely via SMB by looking for the string "icacls" in TCP traffic directed to port 445 (SMB). The detection is case-insensitive and focuses on established connections flowing to the server. This activity is classified as trojan activity, suggesting an attacker might be attempting to alter file access controls on a remote system.
This rule detects network activity associated with password cracking tools like Hashcat or John the Ripper. It specifically looks for HTTP user agent strings containing "hashcat" or "john.the.ripper" in traffic flowing to a server.
This rule detects ARP cache poisoning attempts by identifying multiple ARP responses (opcode 2) for the same IP address within a short time frame (15 responses in 5 seconds from the same source). This behavior is indicative of an attacker attempting to redirect network traffic by sending forged ARP replies.
Detects network connections attempting to download the specific Bun v1.3.13 archive from the oven-sh GitHub repository, which is used by the stage 3 bootstrapper in the Miasma npm malware campaign.
Detects network connections from Bun or Node.js processes to GitHub API endpoints
used by the Miasma worm for credential exfiltration. The malware creates repos under
the liuende501 account and uploads encrypted stolen credentials.
used by the Miasma worm for credential exfiltration. The malware creates repos under
the liuende501 account and uploads encrypted stolen credentials.
Detects network traffic over TCP port 886, which is specifically used by Atlas RAT for command and control check-ins, plugin downloads, and encrypted data exfiltration in TA4922 campaigns.
Identifies active Command and Control communication from infected hosts to known Red Lamassu infrastructure by monitoring network connections to specific C2 domains.
Detects network requests associated with FallSpy, an Android spyware utilized by the Russia-nexus threat group GREYVIBE. FallSpy is deployed via fake persona lures and spoofed applications to harvest critical intelligence. While the original YARA rule targets file-based artifacts (e.g., class names like DataCollectorWork), this Sigma rule adapts the logic to focus on the highly reliable exfiltration URL parameters observable in proxy and web gateway logs.
Detects network connections originating from the Vulkan loader executable (vulkaninfo.exe) over port 1234, indicative of RomulusLoader C2 activity associated with TA4922.
Detects the execution of curl on macOS using a hardcoded Catalina user agent (Mac OS X 10_15_7) and silent/fail-fast flags (-fsSL). This pattern correlates with the macOS terminal payload delivery mechanism used in the ClearFake/ClickFix campaign.
Detects network connections to the decoy C2 domain api.anthropic.com originating from development runtimes like Node.js, Python, or Bun. The Miasma/Shai-Hulud malware actively uses this specific domain as a decoy to obscure its data exfiltration and C2 traffic.
KQL Query from file: Cloudflare Eviltokens: Gotta catch’em all
(Originally Authored by: Steven Lim (SlimKQL)
Expanded the original query to provide more context useful for investigation.
Original: https://systemtwosecurity.com/share/rule/Mn1XS6n9?utm_source=social&utm_medium=copy_link&utm_campaign=share&utm_content=detection
(Originally Authored by: Steven Lim (SlimKQL)
Expanded the original query to provide more context useful for investigation.
Original: https://systemtwosecurity.com/share/rule/Mn1XS6n9?utm_source=social&utm_medium=copy_link&utm_campaign=share&utm_content=detection
Detects network connections to typo-squatted lure domains, payload hosts, and C2 servers associated with the fake Gemini CLI and Claude Code campaign.
This rule detects potential HTTP/2 Rapid Reset or similar denial-of-service (DoS) attacks by identifying an unusually high number of streams and total requests within a single HTTP/2 network connection over a one-minute interval. Such behavior is indicative of an attacker attempting to exhaust server resources by rapidly opening and closing streams.
This rule set detects various stages of the JFMBackdoor and Showboat malware, including DLL sideloading of FLTLIB.dll by fltMC.exe from non-standard directories, network connections to known C2 and staging infrastructure (namefuture.site or 23.27.201.160), command-line activity referencing a specific Pastebin URL used by Showboat for process-hiding code, and the creation of JFMBackdoor payload artifacts (flt.bin, scr.mui).
Detects Bun or Node.js processes spawned from temporary directories making requests
to cloud instance metadata services (AWS IMDSv2, Azure IMDS). The Miasma worm
harvests cloud credentials from CI runners via these endpoints.
to cloud instance metadata services (AWS IMDSv2, Azure IMDS). The Miasma worm
harvests cloud credentials from CI runners via these endpoints.
This rule detects suspicious processes (e.g., powershell.exe, cmd.exe, mshta.exe) making outbound network connections to public IP addresses on non-standard ports. This behavior can indicate command and control (C2) communication or data exfiltration attempts, as adversaries often use non-standard ports to evade detection.
Page 175 of 246