Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,155 detections
Filters
Last updated
All Time
Detection languages
2,301
1,070
640
289
288
Contributors
918
814
769
696
224
Categories
20,456
11,839
5,876
5,155
4,865
Platforms
2,858
2,017
816
524
213
Products / Services
1,336
1,144
831
576
366
MITRE Techniques
1,822
1,307
787
747
577
CVEs
9
7
7
6
6
IDS Classtypes
538
151
101
57
48
IDS Protocols
375
373
132
64
42
This rule detects DNS queries for 'pastebin.com'. This activity is often associated with Command and Control (C2) communication, where attackers use services like Pastebin to host malicious code, configuration data, or receive commands. The rule triggers if 10 such queries are observed from the same source IP within a 300-second (5-minute) window, indicating potential C2 activity or data exfiltration attempts.
This rule detects TCP connections to port 8888, which is commonly used by Remote Access Trojans (RATs) for Command and Control (C2) communications. The rule specifically looks for the SYN flag in the TCP handshake, indicating the initiation of a new connection from the internal network ($HOME_NET) to any external destination.
This rule detects network connections to TCP port 4444, which is a commonly used default handler port for Metasploit, a popular penetration testing framework. The rule specifically looks for the initial SYN packet (flags:S) of a TCP connection from any source to any destination on port 4444 within the home network. This activity is often associated with command and control (C2) communication or reverse shells established by attackers using Metasploit.
This rule detects a high rate of DNS queries originating from a single source IP address within a specified time frame, which can be indicative of DNS Command and Control (C2) beaconing activity. Specifically, it triggers an alert if a source IP makes 50 or more DNS queries within a 60-second window. This behavior is often associated with malware attempting to communicate with a C2 server by encoding data within DNS requests or using DNS as a covert communication channel.
This rule detects potential audio stream exfiltration using the Real-time Transport Protocol (RTP). It specifically looks for UDP traffic with a packet size between 160 and 200 bytes, which is characteristic of some RTP audio streams. A threshold of 100 such packets from the same source within 10 seconds triggers the alert, indicating a sustained audio stream.
This rule detects a UDP flood Denial of Service (DoS) attack targeting the home network. It triggers an alert if more than 1000 UDP packets are observed from any source to any destination within the home network within a 5-second interval, tracked per destination.
This rule detects a TCP SYN Flood Denial of Service (DoS) attack. It triggers when a high volume of TCP SYN packets (1000 packets within 5 seconds) are observed targeting a single destination IP address within the HOME_NET, indicating an attempt to overwhelm the target's network resources.
Detects network connections to known Command and Control (C2) servers associated with the ValleyRAT backdoor, used by the Silver Fox APT group.
This rule detects a high volume of successful network connections to common web ports (80, 443, 8080, 8443) where the remote URL contains keywords like 'version' or 'software'. This pattern could indicate an adversary performing reconnaissance to identify installed software and their versions, potentially looking for vulnerabilities or specific applications to target. The threshold of 10 such activities within an hour for a single device is set to flag anomalous behavior.
Correlates phishing email delivery with subsequent communication to attacker-controlled domains.
Detects when a browser navigates to or launches with a 'blob:https://' URL. This can indicate unusual browser activity, potentially related to data exfiltration, web-based attacks, or specific application behaviors that might warrant investigation.
This rule detects potential HTTP/2 Rapid Reset or similar denial-of-service (DoS) attacks by identifying an unusually high number of streams and total requests within a single HTTP/2 network connection over a one-minute interval. Such behavior is indicative of an attacker attempting to exhaust server resources by rapidly opening and closing streams.
Monitors for systems communicating with trycloudflare.com infrastructure, which may indicate creation or use of temporary Cloudflare tunnels capable of bypassing traditional remote access controls.
Identifies mshta.exe accessing externally hosted HTA content from a user-initiated Explorer session, potentially indicating malicious remote code execution.
Detects mshta.exe launched from Windows Explorer to retrieve remote HTA content over HTTP, a technique frequently observed in phishing campaigns and initial access attacks.
This rule detects a high volume of network share connections (SMB/CIFS) from a single device to multiple remote IPs within a short timeframe. This behavior can be indicative of ransomware attempting to encrypt files across network shares, or other forms of rapid lateral movement and data access. The rule specifically looks for connections on ports 445 or 139 initiated by common user or system processes like explorer.exe, cmd.exe, or powershell.exe.
This rule detects network connections where the User-Agent or RequestClientApplication header contains "NSIS_InetLoad". This string is often associated with Nullsoft Scriptable Install System (NSIS) installers, which can be used by legitimate software but also by malware to download additional components or communicate with command and control servers. The rule specifically looks for at least 3 such connections from the same source to the same destination within the aggregated timeframe, while excluding connections to Microsoft domains to reduce false positives.
This rule detects indicators of a multi-stage infection involving PlugX malware, often associated with the Mustang Panda threat group. It correlates process execution events where the command line contains "mustang", "panda", or "plugx" with either registry modifications containing the same keywords or network connections to a remote URL containing "/update". This correlation helps to identify more sophisticated attacks that involve multiple stages of execution, persistence, and communication.
This rule detects a high number of distinct URLs and total network connections originating from a single remote IP address within a one-minute time window. This behavior can be indicative of various malicious activities such as data exfiltration, command and control (C2) communication, or network scanning. The threshold for distinct URLs is set to greater than 100 and total connections greater than 500.
This rule detects instances where a single remote IP address exhibits a high number of idle network events (more than 200 idle events) and a high total number of network events (more than 500 total events) within a one-minute interval. This pattern can be indicative of Command and Control (C2) communication, where an adversary establishes a connection and then waits for commands, or data exfiltration, where data is sent in bursts with idle periods in between. It highlights unusual network communication patterns that might suggest malicious activity.
Detects DNS queries to domains associated with tunneling tools (Ngrok, Tailscale) and Remote Monitoring and Management (RMM) tools (FleetDeck, TacticalRMM, Level.io, Pulseway, ScreenConnect, Splashtop, RustDesk, Atera, Remcos) known to be used by threat actors like Scattered Spider/Muddled Libra for covert persistent connectivity, remote access, and lateral movement.
Page 178 of 246