Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,156 detections
Filters
Last updated
All Time
Detection languages
2,302
1,070
640
289
288
Contributors
918
814
769
696
224
Categories
20,456
11,839
5,877
5,156
4,865
Platforms
2,859
2,017
816
524
213
Products / Services
1,337
1,144
831
576
366
MITRE Techniques
1,823
1,307
787
747
577
CVEs
9
7
7
6
6
IDS Classtypes
538
151
101
57
48
IDS Protocols
375
373
132
64
42
This rule detects potential SSH brute force attacks by identifying multiple failed password attempts from a single source IP address to a specific computer within a 5-minute window. It specifically looks for 'Failed password' messages in syslog entries from the 'sshd' process.
This rule detects attempts to authenticate to SSH using GSSAPI (Generic Security Service Application Programming Interface). While GSSAPI can be used for legitimate authentication, its presence in logs might indicate an attacker attempting to use alternative authentication methods, potentially for lateral movement or privilege escalation, especially if unexpected in the environment.
Detects potential DNS tunneling, a technique used by the Mori backdoor (associated with MuddyWater), by identifying an unusually high volume of long DNS queries from a single source. This could indicate C2 communication or data exfiltration.
This rule detects suspicious command-line activity indicative of SSH tunneling, external IP checks, and reconnaissance commands. It looks for specific IP addresses associated with known C2 or SSH tunnel infrastructure, SSH command-line options like 'StrictHostKeyChecking=no' and reverse tunnel flags ('-R', '-N'), the use of 'ifconfig.me' for external IP discovery, and various 'whoami' and 'groups' commands for system reconnaissance. It also flags activity related to 'FMAPP.exe' or 'FMAPP.dll'.
This rule detects network traffic containing specific User-Agent strings used by the BurrowShell implant and the Rust-based keylogger to masquerade as legitimate Windows Update or browser traffic. These User-Agent strings are 'Windows-Update-Agent/10.0.10011.Client-Protocol/2.50' and 'Mozilla/5.0 (compatible; SecureNet/1.2)'.
Detects outbound network traffic to Icedrive domains from non-browser and non-Icedrive client processes, which could indicate C2 communication by the BeardShell implant used by Sednit (APT28).
KQL Query from file: OauthMSPhish Detection
Detects outbound network traffic to Filen domains from non-browser and non-Filen client processes, which could indicate C2 communication by Sednit's modified Covenant implant.
This rule detects network connections to or from known suspicious IP addresses and requests to known suspicious domains. These indicators are often associated with command and control (C2) activity, malware distribution, or other malicious infrastructure.
Detects network connections from a trojanized "WorkFlowy.exe" process to a known command and control (C2) server. This behavior was observed in a ClickFix campaign where a legitimate Electron application was modified to act as a C2 beacon and dropper, communicating with the C2 every two seconds.
Detects potential DLL side-loading activity associated with the MuddyWater threat actor. The rule identifies the legitimate Fortemedia application, FMAPP.exe, initiating network connections while running from a non-standard or suspicious directory, such as C:\Users\Public\Downloads\. This behavior is indicative of a malicious FMAPP.dll being loaded for command-and-control (C2) communications.
This rule set detects components of the StegaBin supply-chain attack targeting npm packages. The first rule, 'stegabin_npm_loader', identifies malicious JavaScript loaders that utilize Pastebin for steganography and Vercel API paths for command and control. It looks for specific strings indicating Pastebin usage, Vercel API endpoints, and unique markers related to the steganographic decoding or payload. The second rule, 'StegaBin_VSCode_Tasks_Persistence', focuses on persistence mechanisms within VSCode's tasks.json files. It detects configurations that automatically execute malicious code upon folder opening, specifically looking for the 'runOn': 'folderOpen' property and references to the 'ext-checkdin.vercel.app' domain and associated API paths. Together, these rules aim to identify both the initial loader and the persistence mechanism used by the StegaBin campaign.
Detects network connections to known command-and-control (C2) domains used by malicious AI browser extensions for data exfiltration.
This rule detects potential phishing attempts targeting Docusign users. It identifies emails containing URLs or network connections to specific domains (page-docusign-[a-z0-9]+\.workers\.dev) which are commonly used in phishing campaigns to mimic legitimate Docusign login pages or related services. The use of 'workers.dev' subdomains often indicates malicious infrastructure.
This rule detects multiple stages of activity associated with BaqiyatLock ransomware and Remcos RAT. It identifies the execution of known BaqiyatLock/Remcos files, attempts to bypass User Account Control (UAC) via ms-settings registry hijack, creation of files with the '.bqtlock' extension indicative of BaqiyatLock encryption, and network communication with 'icanhazip.com' for external IP discovery, which is a common reconnaissance step.
Detects HTTP POST requests to "/api/get_challenge" or "/api/get_credentials" on port 5000. This is the initial communication pattern of the TunnesshClient backdoor, a component of the BoryptGrab campaign, to retrieve SSH credentials from its C2 server before establishing a reverse SSH tunnel.
This rule detects a high volume of UDP network connections originating from a single process on a device. A count exceeding 50 UDP connections from the same process to the same remote IP address is considered anomalous and could indicate a UDP flood or other denial-of-service attempt.
Detects the beaconing activity of the HeaconLoad Golang downloader, a component of the BoryptGrab campaign. This malware sends HTTP POST requests containing system information to the "/healthcheck" endpoint on port 8088.
This rule detects network connections and user sign-ins originating from IP addresses identified as belonging to Iran. It also identifies sign-ins where the reported country is Iran, but the IP address is not found within the provided Iranian IP list, which could indicate IP geolocation discrepancies or obfuscation attempts.
This rule detects suspicious sign-in links that exhibit characteristics of OAuth redirect abuse. Specifically, it looks for URLs that contain "oauth2", "prompt=none", and "scope=invalid". This pattern suggests an attempt to use a trusted sign-in service to redirect users to a malicious page, potentially for phishing or malware delivery, by manipulating OAuth parameters.
This rule detects VNC-based lateral movement activities within an internal network (East-West traffic).
Page 188 of 246