Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,156 detections
Filters
Last updated
All Time
Detection languages
2,302
1,070
640
289
288
Contributors
918
814
769
696
224
Categories
20,456
11,839
5,877
5,156
4,865
Platforms
2,859
2,017
816
524
213
Products / Services
1,337
1,144
831
576
366
MITRE Techniques
1,823
1,307
787
747
577
CVEs
9
7
7
6
6
IDS Classtypes
538
151
101
57
48
IDS Protocols
375
373
132
64
42
This rule detects various stages of the VOID#GEIST multi-stage Python loader as described in the Securonix blog. It identifies initial batch file execution, Chrome decoy PDF lures, hidden PowerShell relaunching of the batch file, persistence via the Startup folder, curl commands downloading zip payloads, Python embedded runtime downloads, and final Python payload execution. The rule is designed to catch the distinct command-line patterns associated with each stage of this specific malware.
This query provides a 360-degree view of a phishing campaign's impact. Starting from a reported email's indicators (sender, subject), it finds all similar emails and correlates them with user actions like URL clicks, attachment interactions on endpoints, replies, and if the emails were zapped by Microsoft. This allows an analyst to quickly scope an incident and determine the extent of compromise.
Linux VNC Install
Sigma
Detects VNC-based lateral movement activities. Looking for the initial install
The rule detects VNC (Virtual Network Computing) application usage on Windows systems, looking for specific indicators in conjunction.
This combination suggests active VNC communication, potentially indicating lateral movement or unauthorized remote access, particularly in environments where VNC is not standard for enterprise use.
This combination suggests active VNC communication, potentially indicating lateral movement or unauthorized remote access, particularly in environments where VNC is not standard for enterprise use.
Detects CL-UNK-1068's custom-compiled Fast Reverse Proxy (FRP) variant based on unique command-line artifacts.
Detects malicious Message of the Day scripts being used for persistence, since these messages are ran at start time and will display to all users
Detects URL click events or browser launches where the URL targets Microsoft or Google OAuth endpoints and contains the combination of 'prompt=none' and 'scope=invalid'. This specific combination is used by attackers to force a silent error redirect to a malicious URI.
Detects network traffic to known command and control (C2) domains used by the Iranian APT group Seedworm to distribute the Fakeset backdoor. These domains are hosted on the Backblaze cloud storage service.
Detects VNC-based lateral movement activities. East to West traffic
Detects a high volume of network connections from a browser process to a high port on the local host (127.0.0.1 or ::1). This pattern can indicate a malicious website attempting to brute-force credentials for a local service, such as the OpenClaw AI agent, by abusing the browser's permission to establish WebSocket connections to localhost. The vulnerable service may not rate-limit these local connections, allowing for rapid password guessing.
Detects command-line activity indicative of mounting a remote WebDAV share, a technique used to bypass browser security controls and deliver malware. This rule looks for specific keywords used to force a connection to a remote WebDAV server.
Detects the JavaScript XOR-based string reconstruction pattern used by the Coruna iOS exploit kit. This pattern maps an array of integers through String.fromCharCode with XOR to reconstruct code at runtime. Coruna contained 23 iOS exploits targeting iOS 13.0 through 17.2.1 and was used by UNC6353 (Russian espionage) and UNC6691 (Chinese financially motivated).
Detects VNC-based activities. Looking for specific VNC processes
Detects the complete CVE-2026-21902 exploitation chain against Juniper Junos OS Evolved On-Box Anomaly Detection Framework. Requires all four steps: command creation, DAG creation, DAG instance scheduling, and commit.
Detects network traffic matching patterns used by the Chrysalis backdoor for C2 communications. The malware was observed using the domain 'api.skycloudcenter.com' and mimicking DeepSeek AI API URL paths to evade detection.
was reading this article today on cybersecuritynews (🔗 ⬇️ ) about attackers abusing Windows File Explorer + WebDAV to deliver malware, and it made me think about how to monitor this threat.
The attack makes File Explorer connect to an external location that looks like a normal folder. From the user side nothing feels strange… but in reality explorer.exe is establishing an internet connection to attacker infrastructure.
As I usually say, it’s often better to focus on IOAs (how the activity happens) rather than only URLs or domains, because those are trivial for attackers to change. The behaviour is what tends to stay consistent.
The following KQL Query filter identify external connections initiated by Explorer + option to exclude False Positives based on URLs + option to specify connections to specific countries
The attack makes File Explorer connect to an external location that looks like a normal folder. From the user side nothing feels strange… but in reality explorer.exe is establishing an internet connection to attacker infrastructure.
As I usually say, it’s often better to focus on IOAs (how the activity happens) rather than only URLs or domains, because those are trivial for attackers to change. The behaviour is what tends to stay consistent.
The following KQL Query filter identify external connections initiated by Explorer + option to exclude False Positives based on URLs + option to specify connections to specific countries
Detects network connections to known command-and-control (C2) and distribution domains associated with the Coruna exploit kit campaigns. This includes the domain used in the Ukrainian campaign by UNC6353 and the larger set from the financially motivated UNC6691 group.
Detects an npm installation process (node.exe) spawning a shell or network utility to download a secondary payload from a Vercel-hosted domain. This TTP was observed in the StegaBin campaign where malicious packages used install scripts to fetch next-stage malware.
Detect .NET hollowing technique
Suricata
.NET hollowing technique - external fetch of InstallUtil.exe (rare)
This rule detects potential indicators of compromise related to CVE-2026-20127 in Cisco Catalyst SD-WAN systems. It focuses on two main areas: 1) suspicious successful SSH authentications for the 'vmanage-admin' account, and 2) SD-WAN control plane connection events indicating a new 'up' state. The first part looks for specific log entries related to publickey authentication for 'vmanage-admin' from any source IP. The second part identifies control connection state changes to 'up' and extracts peer type, peer system IP, and public IP from the raw logs. The rule aims to surface events that require human confirmation by comparing them against known network designs and change records, as these events can indicate unexpected relationships between devices or unauthorized privileged access.
This rule detects network connections to domains that appear to be dynamically generated IPv6 reverse DNS entries. These types of domains (e.g., 'xxxxxxxxxx.ip6.arpa') are often used in command and control (C2) communications or for exfiltration by malware to evade traditional domain-based detection. The regex specifically looks for a 10-character alphanumeric string followed by '.ip6.arpa'.
Page 189 of 246