Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,155 detections
Filters
Last updated
All Time
Detection languages
2,301
1,070
640
289
288
Contributors
918
814
769
696
224
Categories
20,456
11,839
5,876
5,155
4,865
Platforms
2,858
2,017
816
524
213
Products / Services
1,336
1,144
831
576
366
MITRE Techniques
1,822
1,307
787
747
577
CVEs
9
7
7
6
6
IDS Classtypes
538
151
101
57
48
IDS Protocols
375
373
132
64
42
Detects HTTP requests to a Cloudflare Workers subdomain
(*.workers.dev) targeting the /token/v1/{UID} signaling endpoint, originating
from a headless Chrome user agent. Chaos ransomware's msaRAT offloads all C2
signaling to the browser via CDP-injected JavaScript, performing WebRTC SDP
Offer/Answer exchange through this trusted developer platform to evade domain
reputation blocking.
(*.workers.dev) targeting the /token/v1/{UID} signaling endpoint, originating
from a headless Chrome user agent. Chaos ransomware's msaRAT offloads all C2
signaling to the browser via CDP-injected JavaScript, performing WebRTC SDP
Offer/Answer exchange through this trusted developer platform to evade domain
reputation blocking.
Detects script-driven (curl, wget, python) outbound connections to
AI/LLM API endpoints. The campaign uses legitimate AI platform APIs as covert
command, control, and exfiltration channels, blending malicious traffic with
approved web services to evade network-based detection.
AI/LLM API endpoints. The campaign uses legitimate AI platform APIs as covert
command, control, and exfiltration channels, blending malicious traffic with
approved web services to evade network-based detection.
Correlates ARTEX tool artifacts on a device with that device contacting the ARTEX host, xcai.pro, or the DeepSeek API within 24 hours.
Detects network connections, process executions, file creations, and image loads associated with the UNC7017 AOMEI supply chain campaign IOC sweep, including specific malicious URLs, domains, IPs, file paths, and hashes.
The following analytic detects network traffic associated with known remote access software applications
that are covered by Cisco Secure Firewall Application Detectors, such as AnyDesk, GoToMyPC, LogMeIn, and TeamViewer.
It leverages Cisco Secure Firewall Threat Defense Connection Event.
This activity is significant because adversaries often use remote access tools to maintain unauthorized access to compromised environments.
If confirmed malicious, this activity could allow attackers to control systems remotely, exfiltrate
data, or deploy additional malware, posing a severe threat to the organization's security.
that are covered by Cisco Secure Firewall Application Detectors, such as AnyDesk, GoToMyPC, LogMeIn, and TeamViewer.
It leverages Cisco Secure Firewall Threat Defense Connection Event.
This activity is significant because adversaries often use remote access tools to maintain unauthorized access to compromised environments.
If confirmed malicious, this activity could allow attackers to control systems remotely, exfiltrate
data, or deploy additional malware, posing a severe threat to the organization's security.
Sweeps endpoint telemetry for known UAC-0099 MATCHBOIL/LONEPAGE indicators: SHA256 hashes, C2 IPs, C2 domains (including subdomains), and payload/C2 URLs. Matches are limited to public outbound connections, Defender self-activity is excluded from file hits, and repeat hits are collapsed to one row per device and indicator. The lists are a subset of the 142 IOCs in the source report.
Correlates a delivered PDF attachment with the same user's browser visiting Mir0Auth C2-style paths within 4 hours. Restricted to browser processes and successful connections, excludes dev/code-hosting domains, and matches users by mailbox alias (DeviceInfo LoggedOnUsers holds UserName, not full email).
Performs an IOC sweep for a known XMRig cryptojacking campaign exploiting a REDCap vulnerability (CVE-2026-90817), detecting matching network connections, file hashes, and process activities across endpoints.
IOC sweep for ARTEX campaign indicators: C2 host, nine proxy IPs, xcai.pro and its subdomains, and the CLAUDE.md URL across Defender, CEF/firewall, DNS and Entra sign-in telemetry. Domains match on exact host or subdomain only, connection types are limited to real connection events, and sign-ins are limited to successes and credential failures.
Detects network connections to known Indicators of Compromise (IOCs) associated with the TraderTraitor campaign, including trojanized Terraform providers (FLATROOF/ROOFDECK malware families) using specific domains and URL paths.
Sweeps endpoint and firewall telemetry for connections to the two high-confidence BraZetsu infrastructure IPs. Review hits against the IP's first-seen date before blocking because the Njalla host has changed service.
Sweeps endpoint and firewall telemetry for connections to the two high-confidence BraZetsu infrastructure IPs. Review hits against the IP's first-seen date before blocking because the Njalla host has changed service.
Sweeps proxy, firewall and endpoint network telemetry for requests to the three published BraZetsu Pastebin dead-drop raw URLs used to retrieve the XOR-encrypted C2 config.
Sweeps DNS, endpoint network and proxy/firewall telemetry for BraZetsu C2, panel and shop domains using exact or subdomain matching. The apex installscenter.com remains active on Cloudflare with wildcard certificates.
Detects network, file, process, and email interactions associated with known IOCs related to Power BI phishing and rogue ScreenConnect campaigns over a 30-day lookback period.
This rule monitors endpoint telemetry (DNS queries, network connections, file creation, and process execution) to identify matches against a predefined list of known malicious indicators, including IP addresses, domains, and file hashes (SHA256). The rule differentiates between confirmed malicious activity and low-confidence indicators, providing a prioritized view of potential threats.
Detects the AdFection multi-stage infection chain where a device sequentially contacts advertising infrastructure, Candiru validator servers, exploit servers, and Candiru Command and Control domains within a short time window.
Detects the AdFection multi-stage infection chain where a device sequentially contacts advertising infrastructure, Candiru validator servers, exploit servers, and Candiru Command and Control domains within a short time window.
Detects anomalous process execution and loopback network activity associated with the Model Context Protocol (MCP) 'exec_in_session' method. This pattern indicates an adversary potentially abusing the AI coding assistant's MCP server capabilities to execute arbitrary commands as a C2 channel.
Performs an IOC sweep for a known XMRig cryptojacking campaign exploiting a REDCap vulnerability (CVE-2026-90817), detecting matching network connections, file hashes, and process activities across endpoints.
Performs an IOC sweep for a known XMRig cryptojacking campaign exploiting a REDCap vulnerability (CVE-2026-90817), detecting matching network connections, file hashes, and process activities across endpoints.
Page 7 of 246