Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,155 detections
Filters
Last updated
All Time
Detection languages
2,301
1,070
640
289
288
Contributors
918
814
769
696
224
Categories
20,456
11,839
5,876
5,155
4,865
Platforms
2,858
2,017
816
524
213
Products / Services
1,336
1,144
831
576
366
MITRE Techniques
1,822
1,307
787
747
577
CVEs
9
7
7
6
6
IDS Classtypes
538
151
101
57
48
IDS Protocols
375
373
132
64
42
Detects network traffic to known Transparent Tribe (APT36) C2 IP addresses and DNS resolution attempts for their associated command and control domains. This rule monitors for communication with identified malicious infrastructure often used by the group for C2 activity.
This rule detects network traffic containing the 'HCENC1' signature prefix within the payload, which is associated with the RUSTYSHADE malware family. This pattern indicates an encrypted communication channel used for command and control (C2) purposes.
This rule detects network traffic containing the 'HCENC1' signature prefix within the payload, which is associated with the RUSTYSHADE malware family. This pattern indicates an encrypted communication channel used for command and control (C2) purposes.
Detects network activity associated with the RUSTYSHADE malware, specifically identifying the 'HCENC1:' prefix used in HTTP requests to encapsulate AES-256-GCM encrypted command and control traffic directed towards GitHub API channels.
This rule detects network traffic patterns indicative of the Transparent Tribe threat group using the GitHub API for command-and-control (C2) operations. It specifically identifies HTTP requests to GitHub's content API that attempt to access or exchange files named 'command.txt', 'results.txt', 'heartbeat.txt', or 'screenshot.png', which are known indicators of this actor's C2 communication strategy.
Detects network activity (DNS, TLS SNI, and direct TCP connections) associated with the Transparent Tribe threat group's command-and-control infrastructure, specifically targeting the domain 'sharema128.net' and its associated IP address.
This rule monitors network traffic to GitHub API endpoints and categorizes the activity based on APT36's known operational window (weekdays, 04:00-11:00 UTC). Traffic patterns deviating from this schedule are flagged as anomalous, helping to identify potential C2 communication outside of established threat actor activity windows.
This rule monitors for network connections, firewall traffic, and Entra ID authentication events involving known malicious IP addresses (the 'Wall of Shame'). The rule specifically flags interactions occurring over common VPN ports, suggesting potential unauthorized access or persistence attempts via VPN services.
This rule identifies network activity, email URLs, and DNS queries associated with a specific set of known malicious domains often used in phishing or credential harvesting campaigns. By aggregating telemetry from EmailUrlInfo, EmailEvents, DeviceNetworkEvents, and DnsEvents, the rule flags any interactions with these indicators of compromise.
Detects network connection events to known domains and subdomains associated with the SilkParasite threat actor. The rule specifically monitors for connections to specific parent domains (natcommunzu.com, kginfocom.com, mfa-uz.com) and subdomains utilizing service-oriented naming patterns (e.g., mail, service, help, storage, support, microsoft, post) commonly used by this actor for command and control infrastructure.
This rule monitors network traffic logs for HTTP requests directed toward domains identified as potentially malicious (gstatcs.com, webfaset.com, bulder.online). It further filters for events involving common web activity patterns, such as Google Tag Manager references or general HTTP/web traffic, which may indicate command and control communication or beaconing behavior.
This rule detects network connections or process command lines associated with known malicious domains, IP addresses, or payload URLs. Additionally, it correlates connections to common public file-sharing platforms or APIs (e.g., Gofile, Telegram) if these events occur on the same device within a 60-minute window of a confirmed malicious infrastructure event, reducing false positives from legitimate uses of shared infrastructure.
This rule detects network connections or process command lines associated with known malicious domains, IP addresses, or payload URLs. Additionally, it correlates connections to common public file-sharing platforms or APIs (e.g., Gofile, Telegram) if these events occur on the same device within a 60-minute window of a confirmed malicious infrastructure event, reducing false positives from legitimate uses of shared infrastructure.
This rule monitors endpoint telemetry for known indicators of compromise associated with the Casbaneiro/Ousaban banking trojan. It identifies activity across network connections (IPs and domain patterns), DNS queries for specific C2 domains, and the presence or execution of known malicious file hashes (e.g., PDF lures, HTA, AutoIt scripts, and payload binaries).
This rule detects network communication (via DNS queries, web logs, or device network events) with a list of known malicious domains associated with Command and Control (C2) activity.
Detects network communication with Google Sheets API endpoints that contain specific indicators of C2 behavior, such as suspicious User-Agents, specific spreadsheet cell references, or input options characteristic of automated data exfiltration or command retrieval.
Detects network connections to command-and-control infrastructure associated with the JeetBot/Twitch Enhanced Viewer malicious browser extension. The rule triggers on connections to known malicious domains or IPs, as well as specific API endpoints on ambiguous domains that are used for exfiltrating Twitch OAuth tokens.
Detects network connections to command-and-control infrastructure associated with the JeetBot/Twitch Enhanced Viewer malicious browser extension. The rule triggers on connections to known malicious domains or IPs, as well as specific API endpoints on ambiguous domains that are used for exfiltrating Twitch OAuth tokens.
Detects network connections to command-and-control infrastructure associated with the JeetBot/Twitch Enhanced Viewer malicious browser extension. The rule triggers on connections to known malicious domains or IPs, as well as specific API endpoints on ambiguous domains that are used for exfiltrating Twitch OAuth tokens.
Detects network connections to command-and-control infrastructure associated with the JeetBot/Twitch Enhanced Viewer malicious browser extension. The rule triggers on connections to known malicious domains or IPs, as well as specific API endpoints on ambiguous domains that are used for exfiltrating Twitch OAuth tokens.
Detects network connections to command-and-control infrastructure associated with the JeetBot/Twitch Enhanced Viewer malicious browser extension. The rule triggers on connections to known malicious domains or IPs, as well as specific API endpoints on ambiguous domains that are used for exfiltrating Twitch OAuth tokens.
Page 61 of 246