Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,156 detections
Filters
Last updated
All Time
Detection languages
2,302
1,070
640
289
288
Contributors
918
814
769
696
224
Categories
20,456
11,839
5,877
5,156
4,865
Platforms
2,859
2,017
816
524
213
Products / Services
1,337
1,144
831
576
366
MITRE Techniques
1,823
1,307
787
747
577
CVEs
9
7
7
6
6
IDS Classtypes
538
151
101
57
48
IDS Protocols
375
373
132
64
42
Detects a PowerShell process initiating a network connection to download an image or text file from domains associated with a Remcos RAT campaign. In this campaign, PowerShell is used to download a steganographic image containing the next stage payload.
This rule detects network connections from common web browsers to known command and control (C2) domains associated with the ChatGPT Stealer campaign. These domains are used to exfiltrate stolen AI session tokens and conversation data.
Detects execution of curl.exe uploading data to temp.sh using custom user-agent parameters, consistent with publicly reported malicious Notepad++ updater activity.
This rule detects the presence of a fake Windows 11 malvertising installer, specifically 'ms-update32.exe', which is known to be distributed via malicious advertisements. It correlates network connections to suspicious domains (including lookalike domains and GitHub hosting) with process execution from user-writeable paths or the presence of 'LunarApplication' artifacts, and registry modifications to the 'TIP\AggregateResults' key, indicating persistence. The rule requires at least two independent signals (registry write plus one or more supporting signals) within a 30-minute pivot window to reduce false positives.
Detects XWorm LATAM campaign artifacts via published SHA256 and unique network/mutex markers from ANY.RUN analysis.
This rule detects network connections to malicious infrastructure associated with a supply chain attack targeting dYdX npm and PyPI packages. The infrastructure is used for credential exfiltration and as a C2 for a RAT.
This rule detects the execution of `nslookup` and `findstr` together in a command line, specifically looking for non-private IP addresses. This combination can indicate an adversary attempting to discover remote systems or exfiltrate data by encoding it within DNS queries, often seen in DNS tunneling or data staging activities.
This rule identifies network connections to known command and control (C2) infrastructure and typosquatted domains associated with the ValleyRAT malware, specifically those used in the Huorong impersonation campaign. It looks for connections to a hardcoded malicious IP address or a list of malicious domains.
This rule detects outbound network connections from devices to a known Moonrise C2 IP address (193.23.199.88). It specifically looks for successful connections, inbound connections accepted, or connection attempts to this malicious IP.
Detects network traffic to local proxy on port 7152 associated with malicious NuGet package C2 behavior.
This rule set detects various stages of the OysterLoader malware activity, including its registration and login attempts to a command and control (C2) server, specific C2 communication patterns via HTTP URIs, and connections to known OysterLoader C2 domains and IP addresses. The rules look for specific HTTP URI paths like "/reg" and "/login" combined with distinct User-Agent strings ("WordPressAgent" and "FingerPrint"), as well as specific API paths under "/api/" and hardcoded C2 domains and IP addresses.
Detects network connections to phishing domains mimicking Windows 11 download pages used to distribute infostealer malware.
Detects network traffic to a local proxy on port 7152, a behavior associated with a malicious NuGet package campaign involving NCryptYo, DOMOAuth2_, IRAOAuth2.0, and SimpleWriter_. This traffic is characterized by communication to a loopback address (127.0.0.1 or ::1) or 'localhost' on the suspicious port, specifically targeting '/api/auth/' endpoints.
This is a broad hunting query to find Indicators of Compromise (IOCs) associated with the Notepad++ supply-chain attack attributed to the Lotus Blossom actor and the Chrysalis backdoor. It searches for known file hashes, file paths, network indicators (IPs, domains, URLs), and user-agents across multiple event types.
Hunts for unusual external SSH access patterns indicating Technique T1133
Identifies network connections or DNS queries to known phishing domains mimicking Windows 11 update sites, which are used to distribute infostealer malware. These domains are highly specific to this campaign.
Hunts for unusual external SSH access patterns indicating Technique T1133
This rule detects Windows Admin Center (WAC) creating a listening connection on its default port (6516) on internet-facing devices, specifically when the WAC version is not '2.6.4'. This could indicate an unpatched or vulnerable version of WAC exposed to the internet, potentially making it susceptible to exploitation.
This rule detects various activities associated with the FoxKitsune malware, including network staging, suspicious file drops in SysWOW64, unusual svchost execution, service persistence, and attempts to tamper with Windows Defender. It correlates these events to identify potential FoxKitsune infections.
This rule detects attempts to use outdated or weak cryptographic algorithms and protocols by monitoring command-line arguments of common network and cryptographic utilities. Specifically, it looks for the use of RC4, DES, 3DES, RSA1024, MD5 ciphers, or TLS 1.0, TLS 1.1, and SSL 3.0 protocols, as well as the '--insecure' flag, when executed by applications like openssl, gpg, ssh, or curl. This could indicate an adversary attempting to downgrade cryptographic protections to facilitate eavesdropping or other attacks.
Detects outbound network connections to known Command and Control (C2) domains and IPs associated with the TrustConnect and DocConnect malware infrastructure.
Page 192 of 246