Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,155 detections
Filters
Last updated
All Time
Detection languages
2,301
1,070
640
289
288
Contributors
918
814
769
696
224
Categories
20,456
11,839
5,876
5,155
4,865
Platforms
2,858
2,017
816
524
213
Products / Services
1,336
1,144
831
576
366
MITRE Techniques
1,822
1,307
787
747
577
CVEs
9
7
7
6
6
IDS Classtypes
538
151
101
57
48
IDS Protocols
375
373
132
64
42
This rule detects interaction with specific infrastructure identified as deceptive dating applications. It monitors network communication, sign-in attempts, email interactions, and endpoint execution associated with known malicious domains (e.g., archat.us, heyhru.com, sitin.ai), specific IP addresses (38.129.138.244), and unique package identifiers (com.cavalier.nalo, com.qiga.vio). The detection logic spans across DeviceNetworkEvents, EntraIdSignInEvents, EmailUrlInfo, EmailEvents, DeviceEvents, and DeviceProcessEvents to identify exposure to these Indicators of Compromise (IOCs) across both network and endpoint layers.
This rule monitors network connections and DNS query responses for activity associated with known suspicious domains: 'getmacouscloud.com', 'ferncore13.com', and 'grove-89.com'. It identifies communication attempts (successes, failures, or DNS lookups) between endpoints and these domains, which is indicative of potential command and control (C2) activity.
Detects TLS connections using suspicious certificates identified as belonging to the SilkParasite threat actor. The rule monitors for specific certificate issuer strings paired with either malicious subject domain patterns (targeting Central Asian entities) or specific JA4X fingerprints associated with known malicious activity.
Detects network activity associated with the SloppyRAT malware, specifically tracking the polling mechanism for reverse SOCKS proxy tasks and subsequent acknowledgment of these tasks via HTTP requests.
Detects outbound network activity on TCP port 79 (finger) initiated by a client to the domain 'finger.linked4x.com'. This behavior is associated with the SloppyRAT 'ClickFix' campaign, where attackers use social engineering to trick users into executing commands, leading to payload staging and tool retrieval.
Detects anomalous Telnet (TCP port 23) traffic associated with Mirai-variant botnet propagation, such as scanning for new targets or inbound compromise attempts, often following cPanel/WHM vulnerabilities.
This rule detects network connections or process command lines associated with known malicious domains, IP addresses, or payload URLs. Additionally, it correlates connections to common public file-sharing platforms or APIs (e.g., Gofile, Telegram) if these events occur on the same device within a 60-minute window of a confirmed malicious infrastructure event, reducing false positives from legitimate uses of shared infrastructure.
Detects network activity and HTTP traffic associated with the Iron Man System kit, specifically targeting hardcoded C2 infrastructure (IP-based) and lure domain patterns involving specific brand tokens combined with disposable TLDs.
Detects outbound network communication attempts by the SilverFox malware to known Cloudflare Workers relay infrastructure, specifically targeting hostnames associated with 'noah-relay' instances. The rule monitors DNS lookups, TLS SNI headers, and HTTP Host headers to identify potential Command and Control (C2) traffic.
Detects DNS queries and TLS SNI traffic directed towards known phishing domains associated with credential harvesting campaigns (specifically those attributed to Storm-3121/Storm-3032). These domains are used to lure users into providing credentials under the guise of SSO or passkey setup.
Detects high-frequency outbound TCP connection attempts from a WSO2 API Gateway or Traffic Manager host to multiple sensitive internal management and administrative ports (22, 445, 3389, 5985, 5986). This behavior is indicative of a compromised gateway being used for lateral movement across the network.
Detects the installation or modification of a browser extension (manifest.json file creation) followed by network activity from the browser to trusted AI assistant domains within a five-minute window. This behavior is indicative of potentially malicious browser extensions or content scripts being introduced to intercept or manipulate user interaction with AI services.
Detects process and file creation activity matching known MovieReaper loader and downstream module file hashes (MD5/SHA256). C2 IP/domain network indicators for this campaign require a separate network_connection-category rule, since Sigma logsource categories cannot be mixed within a single rule.
Detects activity associated with the 'MovieReaper' threat campaign by identifying known malicious file hashes, command and control (C2) IP addresses, and communication with identified malicious domains. This rule monitors process execution, file operations, and network connections within the campaign's active timeframe.
Detects network traffic indicative of an adversary using the Ethereum blockchain as a dead-drop C2 channel. The rules identify specific JSON-RPC methods (eth_getTransactionByHash, eth_call) typically associated with querying blockchain data for C2 instructions, as well as non-browser processes initiating these requests to external endpoints.
Detects activity associated with the 'MovieReaper' threat campaign by identifying known malicious file hashes, command and control (C2) IP addresses, and communication with identified malicious domains. This rule monitors process execution, file operations, and network connections within the campaign's active timeframe.
Detects activity associated with the 'MovieReaper' threat campaign by identifying known malicious file hashes, command and control (C2) IP addresses, and communication with identified malicious domains. This rule monitors process execution, file operations, and network connections within the campaign's active timeframe.
Movie Reaper Activity
YARA-L
Detects activity associated with MovieReaper campaign including process, file, and network indicators
Movie Reaper Activity
YARA-L
Detects activity associated with MovieReaper campaign including process, file, and network indicators
Movie Reaper Activity
YARA-L
Detects activity associated with MovieReaper campaign including process, file, and network indicators
Movie Reaper Activity
YARA-L
Detects activity associated with MovieReaper campaign including process, file, and network indicators
Page 51 of 246