Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,156 detections
Filters
Last updated
All Time
Detection languages
2,302
1,070
640
289
288
Contributors
918
814
769
696
224
Categories
20,456
11,839
5,877
5,156
4,865
Platforms
2,859
2,017
816
524
213
Products / Services
1,337
1,144
831
576
366
MITRE Techniques
1,823
1,307
787
747
577
CVEs
9
7
7
6
6
IDS Classtypes
538
151
101
57
48
IDS Protocols
375
373
132
64
42
Detects processes referencing confirmed TeamPCP C2 infrastructure or known malicious artifacts from the Trivy supply chain compromise. This includes specific C2 domains/IPs, temporary runner files, and a specific tarball name. It also looks for `entrypoint.sh` executing `grep` for environment variables or SSH-related strings, which could indicate credential access attempts.
This rule detects network connections made by a specific executable ('v20svc.exe') to domains ending with 'app-metrics-cdn.com' and containing specific URL paths ('/api/upload', '/api/upload-json', '/api/upload-complete', '/api/listener/heartbeat'). This combination of indicators is associated with the Venom Stealer malware, often delivered via fake Avast scan websites.
This rule detects activity associated with BRUSHWORM/BRUSHLOGGER malware. It looks for network connections to the domain 'dawnnewsisl.com' with a URL path containing '/updtdll'. Additionally, it checks for process execution from a specific path pattern (e.g., '\ProgramData\Photoes\Pics\*.exe') or 'rundll32.exe' executing 'C:\Users\Public\Libraries\Recorder.dll'. The combination of these indicators aims to identify high-confidence BRUSHWORM/BRUSHLOGGER activity.
Detects attempts to exploit CVE-2026-21962, a header spoofing vulnerability in Oracle WebLogic Server. The rule identifies suspicious requests where 'wl-proxy-client-ip' or 'x-forwarded-for' headers contain localhost/loopback addresses or command injection keywords, combined with URI paths related to 'weblogic' or 'proxy'.
This rule detects suspicious network connections to api.telegram.org from processes masquerading as legitimate Windows executables (MicDriver.exe, Winappx.exe, MsCache.exe, RuntimeSSH.exe, smqdservice.exe). It also identifies files with MD5 hashes matching known Indicators of Compromise (IOCs) from an external list. This combination suggests potential malware activity, possibly involving Telegram for command and control or data exfiltration, combined with process masquerading for evasion.
This rule identifies instances where users have clicked on URLs within Microsoft Teams. It specifically filters for 'UrlClickEvents' where the 'Workload' is 'Teams' and provides details such as the timestamp, user principal name, URL, URL domain, action type, and network message ID. This can be used to investigate potential phishing attempts or malicious link clicks within the Teams environment.
This rule detects network communication (DNS queries, HTTP requests, or network connections) to the command and control (C2) domain 'checkmarx.zone', which is associated with the TeamPCP threat group. This activity indicates potential compromise or communication with adversary infrastructure.
This rule detects network connections and DNS resolution requests to known typosquatted domains used by the TeamPCP threat actor for command and control (C2) and data exfiltration. These domains are associated with a compromised Trivy scanner. Detection indicates successful execution of the compromised scanner and attempted exfiltration.
This rule detects potential lateral movement attempts originating from IIS web servers (identified by 'w3wp.exe' as the initiating process) to other internal IP addresses using common lateral movement ports (SMB, RDP, WinRM, SSH). It specifically looks for successful network connections from an IIS server to a private IP address on one of the specified ports, where the remote IP is not the local IP.
This rule detects network connections to suspicious domains or IP addresses associated with potentially compromised or malicious VPN infrastructure. Specifically, it looks for connections to 'vpn-fortinet.com', 'ivanti-vpn.org', 'forticlient-vpn.de', or the IP address '194.76.226.93'. These indicators may suggest attempts to establish command and control, exfiltrate data, or engage in other malicious activities via compromised VPN services.
This Logic detects the presence of the malicious Chrome extension FreeVPN[.]One by identifying its unique extension ID across installed browsers. The logic further correlates this presence with network communications initiated by the extension to suspicious or untrusted domains. By combining extension enumeration with traffic analysis, the detection ensures high fidelity with minimal false positives. This layered approach strengthens visibility into malicious browser add-ons masquerading as VPN tools.
Detects suspicious command-line executions involving common Windows system binaries (rundll32.exe, mshta.exe, certutil.exe, wmic.exe) combined with keywords often associated with network communication or data transfer (http, https, base64, /transfer). This pattern can indicate attempts at downloading malicious payloads, exfiltrating data, or executing encoded commands.
This rule detects network connections or DNS queries to a specific Internet Computer Protocol (ICP) domain and canister ID (tdtqy-oyaaa-aaaae-af2dq-cai.raw.icp0.io or tdtqy-oyaaa-aaaae-af2dq-cai). This pattern is associated with command and control (C2) activity, where compromised systems communicate with an adversary-controlled server.
This rule detects unusual network connections from processes to legitimate service endpoints that are commonly abused for Command and Control (C2) activities (LOLC2). It specifically looks for connections to services like Telegram, Slack, Discord, GitHub, Google APIs, Pastebin, Dropbox, and others, originating from processes that are not recognized as legitimate applications for those services, and not from common system processes or standard program file paths. This helps identify potential adversary communication channels masquerading as legitimate traffic.
This rule detects unusual network connections from processes to legitimate service endpoints that are commonly abused for Command and Control (C2) activities (LOLC2). It specifically looks for connections to services like Telegram, Slack, Discord, GitHub, Google APIs, Pastebin, Dropbox, and others, originating from processes that are not recognized as legitimate applications for those services, and not from common system processes or standard program file paths. This helps identify potential adversary communication channels masquerading as legitimate traffic.
Detects ShadowSniff info-stealer based on strings, PDB path, and behavioral indicators.
This rule detects unusual network connections from processes to legitimate service endpoints that are commonly abused for Command and Control (C2) activities (LOLC2). It specifically looks for connections to services like Telegram, Slack, Discord, GitHub, Google APIs, Pastebin, Dropbox, and others, originating from processes that are not recognized as legitimate applications for those services, and not from common system processes or standard program file paths. This helps identify potential adversary communication channels masquerading as legitimate traffic.
Detects outbound network connections to the known typosquatted C2 domain (`scan.aquasecurtiy.org`) or associated IP address (`45.148.10.212`) used by the TeamPCP threat actor. This infrastructure was utilized during the Trivy supply chain attack for exfiltrating stolen SSH keys, cloud credentials, and CI/CD secrets.
This rule detects instances where a user clicks on a URL in an email, and the final redirected URL is hosted on 'workers.dev', which is often abused for phishing campaigns, particularly OAuth device code phishing. It correlates email delivery events with URL click events and analyzes the full redirect chain to identify the final destination.
This rule detects suspicious network connections or process executions initiated by processes whose command line contains specific 'ClawAgents' keywords and, in the case of process execution, also contains the keyword 'clone'. It specifically excludes known browser processes from the network connection detection to reduce false positives. The 'ClawAgents' appear to be related to a specific threat or toolset, and the 'clone' keyword suggests activities like cloning repositories or creating copies, which could be indicative of malicious operations.
Detects command line executions from non-standard applications attempting to query the local Azure Arc metadata endpoints (ports 40341/40342), which may indicate an attacker enumerating or exploiting the HIMDS token service (CVE-2026-26117).
Page 186 of 246