Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,155 detections
Filters
Last updated
All Time
Detection languages
2,301
1,070
640
289
288
Contributors
918
814
769
696
224
Categories
20,456
11,839
5,876
5,155
4,865
Platforms
2,858
2,017
816
524
213
Products / Services
1,336
1,144
831
576
366
MITRE Techniques
1,822
1,307
787
747
577
CVEs
9
7
7
6
6
IDS Classtypes
538
151
101
57
48
IDS Protocols
375
373
132
64
42
Detects DKnife attempting to discover network information by sending a POST request with a specific password hash to a router management interface. This activity is associated with the DKnife framework, a China-nexus gateway-monitoring tool.
In this attack, malware is delivered through links or cloud storage. The attacker uses specific websites and services to host the fake documents. When a user clicks a link in a phishing email, they may be taken to one of these sites. The sites can look legitimate because they use well-known web infrastructure. But they are known to host the fake documents used in this campaign. Security teams should monitor for connections to these domains and URLs. Blocking or alerting on them can stop the attack before the user downloads the malicious file. This rule helps identify when a device is connecting to these known bad locations. Early detection allows teams to warn users or block the connection.
This rule detects activity associated with the Chrysalis backdoor used by the Lotus Blossom threat group. It correlates multiple high-confidence indicators to identify potential compromise.
The detection focuses on three key behaviours:
Known malicious artifacts
File and process activity where the SHA256 hash matches confirmed Chrysalis malware samples.
Malicious network communications
Outbound connections to known Chrysalis command-and-control IP addresses or domains.
Suspicious svchost execution
Execution of svchost.exe from non-standard Windows directories, combined with unusual command-line arguments such as -nostdlib and -run, strongly suggests masquerading or malicious payload execution.
The detection focuses on three key behaviours:
Known malicious artifacts
File and process activity where the SHA256 hash matches confirmed Chrysalis malware samples.
Malicious network communications
Outbound connections to known Chrysalis command-and-control IP addresses or domains.
Suspicious svchost execution
Execution of svchost.exe from non-standard Windows directories, combined with unusual command-line arguments such as -nostdlib and -run, strongly suggests masquerading or malicious payload execution.
Detects WinGUp (gup.exe) making network connections to domains other than the legitimate Notepad++ update infrastructure. Per Kevin Beaumont, gup.exe should only connect to notepad-plus-plus.org, github.com, and release-assets.githubusercontent.com.
ClawdBot C2 Network Communication
Cortex XDR
Detects network connections to known malicious ClawdBot command and control (C2) infrastructure based on specific IP addresses and hostnames.
This query detects network traffic patterns associated with the DKnife Adversary-in-the-Middle (AitM) framework. Specifically, it looks for triggers used by the DarkNimbus backdoor to request C2 information from a compromised gateway. This includes HTTP requests to a specific Baidu URL used by the Android variant and UDP traffic to port 8005 used by the Windows variant.
Detects network connections or DNS queries to known malicious domains identified as being used for Cobalt Strike C2, data exfiltration, and secondary payload delivery during the Notepad++ supply chain attack. This rule specifically targets the domains 'cdncheck.it.com', 'safe-dns.it.com', 'self-dns.it.com', 'api.wiresguard.com', 'api.skycloudcenter.com', and 'temp.sh'.
Detects a high frequency of ICMP Echo Request (Type 8) packets, which could indicate a Denial of Service (DoS) attack.
This rule detects activity associated with the 'ClawdBot' campaign, which involves dropping the ScreenConnect Remote Access Trojan (RAT) via a fake VS Code extension. It identifies suspicious network connections to known malicious domains or Dropbox (when initiated by Code.exe), known malicious file hashes, outbound connections to ScreenConnect C2 ports, creation or start of ScreenConnect services, file drops in temporary directories related to ScreenConnect or Lightshot, and execution of Code.exe or ScreenConnect binaries from temporary folders. It also looks for initial payload downloads from attacker command and control infrastructure.
This rule detects chat or call activity by external users in Microsoft Teams whose source tenant is not present in a pre-defined whitelist. This could indicate unauthorized external communication or potential data exfiltration attempts.
This rule detects network connections to cloud storage services Koofr, IceDrive, and Filen (koofr.net, icedrive.net, filen.io, filen.net, filen-1.net, filen-2.net) from non-browser processes. This activity is indicative of potential command and control (C2) communication, as APT28 has been observed using these services for C2, with tools like Covenant Grunt and BeardShell communicating via their APIs. The rule specifically filters out connections originating from common web browsers (msedge.exe, chrome.exe, firefox.exe) to reduce false positives.
Detects Windows VBScript (wscript.exe or cscript.exe) processes establishing network connections to AI/LLM API endpoints. This behavior is highly anomalous as VBScript is typically used for local automation and rarely makes HTTPS API calls to external services. This pattern is consistent with PROMPTFLUX malware and jailbroken LLM variants like WormGPT. PROMPTFLUX uses Gemini's API to dynamically rewrite and obfuscate its own VBScript code at runtime. WormGPT variants use jailbroken Grok (xAI) or Mixtral (Mistral AI) APIs with manipulated system prompts to bypass guardrails. The malware queries AI models to generate new obfuscated versions of itself, creating a "just-in-time" metamorphic capability that constantly evolves to bypass static signature-based detection. Sysmon Event ID 3 is the best way to detect this behavior on endpoints.
This rule correlates the deployment of ScreenConnect components (identified by specific process names and image paths) with subsequent network communication to a known ScreenConnect C2 server (meeting.bulletmailer.net on port 8041). It aims to detect suspicious ScreenConnect activity, potentially indicating unauthorized remote access or control.
Detects network connections from the Notepad++ updater process (gup.exe) to domains that are not part of the official update infrastructure. The primary attack vector for this threat involves intercepting GUP traffic to redirect downloads to malicious third-party servers.
Detects network traffic to or from known IP addresses associated with TA584 command and control (C2) servers and hosting infrastructure. This actor is a known initial access broker, and infections can lead to ransomware.
Detects network connections to Polygon (MATIC) blockchain RPC endpoints. The DeadLock ransomware strain has been observed using smart contracts on the Polygon network to retrieve C2 proxy server addresses, making this a key indicator of compromise.
This rule detects network connections to known malicious IP addresses and domains, as well as the presence of files with known malicious hashes. It specifically looks for indicators associated with the Amatera Stealer, including specific domains, an IP address, and file hashes. The rule correlates network events (DeviceNetworkEvents) and file events (DeviceFileEvents) to identify these indicators of compromise (IOCs).
The goal of this detection is to alert on activity associated with the ClickFix social engineering technique, where a user is coerced into manually executing attacker-controlled commands via the Windows Run dialog after interacting with a malicious website reached through a phishing email. More details can be found in the reference URL linked below
Detects network connections initiated by Microsoft Office applications that may indicate CVE-2026-21509 exploitation. The Shell.Explorer.1 embedded browser component can establish outbound connections to attacker-controlled servers without user awareness. This rule monitors for Office processes making HTTP/HTTPS connections, especially to non-Microsoft and non-CDN destinations.
Detects network traffic to known Tier One Command and Control (C2) domains used by IPIDEA-affiliated SDKs (PacketSDK, CastarSDK, EarnSDK, HexSDK) for device enrollment and tasking.
Detects various activities associated with the ShadowHS fileless Linux post-exploitation framework, including fileless execution, specific command-line patterns, covert exfiltration, and connections to known C2 infrastructure.
Page 196 of 246