Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,156 detections
Filters
Last updated
All Time
Detection languages
2,302
1,070
640
289
288
Contributors
918
814
769
696
224
Categories
20,456
11,839
5,877
5,156
4,865
Platforms
2,859
2,017
816
524
213
Products / Services
1,337
1,144
831
576
366
MITRE Techniques
1,823
1,307
787
747
577
CVEs
9
7
7
6
6
IDS Classtypes
538
151
101
57
48
IDS Protocols
375
373
132
64
42
This rule detects network connections to the Telegram API (api.telegram.org) originating from processes that are not recognized as legitimate Telegram applications (e.g., chrome.exe, Telegram.exe). This behavior can indicate the presence of malware or other unauthorized applications attempting to exfiltrate data or establish command and control via the Telegram messaging platform.
This rule detects DNS requests to hyphen mirrored domains. This tactic has been seen from Silver Fox to deliver the Atlas RAT via Weaponized VPN Installers. Known bad according to the Hexastrike article
trezor-trezor[.]com
signal-signal[.]com
quickq-quickq[.]com
eyy-eyy[.]com
trezor-trezor[.]com
signal-signal[.]com
quickq-quickq[.]com
eyy-eyy[.]com
Detects when a browser navigates to or launches with a 'blob:https://' URL. This can indicate unusual browser activity, potentially related to data exfiltration, web-based attacks, or specific application behaviors that might warrant investigation.
Detects process executions containing SSH tunneling or port forwarding parameters correlated with outbound network connections to external public IPs. This may indicate protocol tunneling for evasion or data exfiltration.
Detects the creation of AF_ALG (kernel crypto API) sockets from Python processes or processes explicitly referencing the 'authencesn' cryptographic template. This behavior is heavily associated with the "Copy Fail" (CVE-2026-31431) local privilege escalation exploit, which uses a Python script to chain AF_ALG and splice() to overwrite page cache pages.
https://thehackernews.com/2026/04/microsoft-confirms-active-exploitation.html
This rule detects outbound network connections from endpoints to specific, potentially suspicious, IPv4 address ranges (162.220.234.0/24 and 162.220.232.0/24). Such connections could indicate command and control (C2) activity, data exfiltration, or communication with malicious infrastructure.
For network requests to the GitHub API containing specific staging and fallback markers (LongLiveTheResistanceAgainstMachines or beautifulcastle) used by TeamPCP in the Bitwarden CLI campaign to retrieve C2 instructions.
Detects regsvr32.exe executing with command-line arguments that indicate an attempt to download and execute a scriptlet from a remote HTTP/HTTPS source. This technique, often referred to as 'Squiblydoo', is used to bypass application control and execute malicious code.
This rule detects successful sign-ins to specific Microsoft 365 applications (identified by ApplicationId '08ad6f98-a4f8-4635-bb8d-f1a3044760f0' or '07c030f6-5743-41b7-ba00-0a6e85f37c17') from devices that have previously established a network connection with a process named 'cowork-svc'. The rule correlates network connection events with Azure AD sign-in events over a 30-day lookback period to identify potentially legitimate or suspicious activity related to 'cowork-svc' application usage.
Detects DNS requests to file.io originating from non-browser processes, indicative of data exfiltration, potentially by tools like CompactGopher. The rule identifies DNS requests for file.io or its subdomains, joins them with process information, and then filters out common web browsers to highlight suspicious activity.
Detects a specific combination of HTTP GET, POST, and PUT requests to the GitHub API (api.github.com) within a short timeframe. This sequence matches the behavior of the AdaptixC2 custom listener used by Tropic Trooper, which uses GitHub issues for beaconing/task polling and the contents API for data exfiltration. The detection has been refined to look for specific AdaptixC2 operational keywords ('beat', 'upload', 'download') to reduce noise.
This rule detects suspicious activity where a user clicks on a URL from an email and subsequently accesses a '.workers.dev' domain that contains keywords commonly associated with credential harvesting or malicious activity (e.g., 'docusign', 'onedrive', 'password_reset'). This pattern often indicates a phishing attempt where an attacker uses a Cloudflare Workers domain to host a malicious landing page.
Identifies when the ScreenMeet.Support.exe RMM tool is downloaded on a host or initiates network connections. This rule detects file creation events for 'ScreenMeet.Support.exe' and network connections made by processes with 'ScreenMeet.Support.exe' as the initiating process filename.
Detects instances where 'explorer.exe' initiates network connections to domains associated with Cloudflare Tunnel (trycloudflare.com). This behavior can indicate the use of tunneling software, potentially for malicious purposes such as command and control, data exfiltration, or bypassing network restrictions. While Cloudflare Tunnel has legitimate uses, its connection by 'explorer.exe' is unusual and warrants investigation.
Detects network connections, DNS requests, and HTTP traffic to known Tropic Trooper C2 infrastructure, indicating potential AdaptixC2 or Cobalt Strike beaconing from compromised endpoints.
This rule detects network connections (both inbound and outbound) on TCP/UDP port 18789, excluding connections initiated by processes from well-known publishers like Microsoft, Apple, and Google. This port is not commonly used by legitimate applications and could indicate the presence of custom malware, command and control (C2) communication, or other unauthorized network activity.
Detects DNS requests to the known DinDoor and CastleLoader C2 domain serialmenot[.]com, which is a multi-tenant infrastructure used by Iranian APT actors.
Detects network connections to known malicious infrastructure domains and IP addresses associated with the Checkmarx supply chain compromise. The compromised KICS images and mcpAddon.js payload use these hardcoded endpoints to exfiltrate stolen credentials and tokens.
This rule detects multiple TTPs (Tactics, Techniques, and Procedures) associated with advanced adversaries, including QEMU virtualization abuse for defense evasion, creation of malicious scheduled tasks (specifically 'TPMProfiler'), rogue account or service creation (e.g., 'CtxAppVCOMService' or 'AppMgmt' service via 'sc.exe'), port forwarding/tunneling commands (using 'ssh' or 'portproxy' with specific ports), credential access attempts via 'vssuirun.exe' or printing 'NTDS.dit', and potential DLL sideloading involving 'ADNotificationManager.exe' and 'vcruntime140_1.dll'. It also includes IOCs for specific IPs, domains, and file hashes.
Detects a Python process initiating outbound network connections to common administrative and remote access ports (135, 445, 3389). This activity is indicative of the internal port scanning phase used by UNC6692 prior to lateral movement in their SNOW ecosystem deployment.
Page 181 of 246