Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,158 detections
Filters
Last updated
All Time
Detection languages
2,304
1,070
640
289
288
Contributors
918
814
769
696
224
Categories
20,460
11,847
5,879
5,158
4,866
Platforms
2,861
2,017
816
524
213
Products / Services
1,339
1,144
831
576
366
MITRE Techniques
1,825
1,307
787
747
577
CVEs
9
7
7
6
6
IDS Classtypes
538
151
101
57
48
IDS Protocols
375
373
132
64
42
Detects developer tooling processes such as Node.js, npm, and yarn—or processes spawned by code editors like VS Code and Cursor—establishing network connections to specific blockchain API endpoints (Tron, Binance Smart Chain, Aptos). This behavior is associated with the DEV#POPPER RAT, which utilizes these blockchain transaction channels to stage encrypted payloads and retrieve configuration keys.
Detects network connections, DNS resolutions, or TLS SNI values matching known TWINLOOT command-and-control infrastructure, including the attacker-registered domains sharepointx.th2ch.com and lpi-web.com and the failover IP 193.24.211.221. TWINLOOT is a modular Python implant that hides its C2 inside trusted Microsoft cloud services (Graph API, SharePoint Online, Teams TURN relay) while also relying on dedicated attacker-controlled infrastructure for direct TLS/WebSocket tunneling and failover.
Detects domain fronting abuse of Cloudflare CDN where the TLS SNI (outer front domain) differs from the inner HTTP Host header actually requested, a technique used to smuggle C2 traffic behind a trusted Cloudflare-fronted domain
Detects S7comm 'PUT' or 'Write Var' commands directed at a PLC via port 102 when no authorized maintenance window is active, indicating potentially unauthorized industrial control system (ICS) modifications.
This rule detects network connections using the S7comm protocol (typically on TCP port 102) directed at Siemens S7 PLCs from source hosts that are not identified as authorized engineering workstations. This behavior may indicate unauthorized access, reconnaissance, or lateral movement within an Industrial Control System (ICS) environment.
Detects the execution of pythonw.exe, which is used as a host process for the SynkLoader RAT, initiating outbound network connections to identified adversary-controlled C2 domains. This behavior is indicative of an established command-and-control channel for command retrieval and data exfiltration.
This rule monitors firewall traffic logs to identify connections directed at managed internal endpoints originating from devices not tracked by the endpoint management system. It flags potential rogue or unauthorized devices performing multi-target reconnaissance or communication across the internal network.
This rule monitors network connections for traffic directed towards domains and IP addresses associated with a known malicious campaign distributing fake VPN browser extensions, as identified by Socket.dev. These domains and IPs are used for command and control or malicious communication by the browser extensions.
This rule monitors Microsoft Teams communication logs to identify messages containing URLs. By parsing the message content and extracting domains, this rule facilitates the detection of potentially malicious links, phishing attempts, or unauthorized data sharing within the organization's Teams environment.
Detects unauthorized S7comm 'GET' or 'Read' operations directed at Siemens S7 Series PLCs over TCP port 102. These commands are often used in reconnaissance phases of ICS/OT attacks to map memory blocks, read ladder logic, or identify system state before executing more disruptive operations.
Detects outbound network connections to known command-and-control infrastructure associated with the Aeza Group bulletproof hosting provider. The rule monitors for connections to specific malicious IP addresses, traffic on TCP port 8133, and requests to the domain 'profitnow.io'.
Detects attempts to perform GraphQL introspection or discover schema details by monitoring Caddy web server logs for requests containing common GraphQL-related paths or keywords.
This KQL query identifies potentially suspicious inbound connection attempts to internet-facing devices. It filters and correlates data from DeviceInfo (device metadata) and DeviceNetworkEvents (network activity) to pinpoint external threats based on multiple connection attempts (3+) from the same public IP address. It also provides geographical context for the source of threats.
This rule detects a multi-stage attack pattern associated with Akira ransomware, including AD enumeration using PowerShell, data staging with WinRAR, S3 exfiltration via s5cmd, AnyDesk service installation, registry manipulation for persistence via Safe Mode, and boot configuration changes to facilitate EDR bypass. It also incorporates detection for specific IOCs like attacker jump host RDP connections and malicious file hashes.
This rule detects the use of raw sockets by 'ERAAgent.exe' by monitoring for socket I/O control (Ioctl) operations involving 'SIO_RCVALL'. This configuration, often associated with promiscuous mode, allows an application to capture all network traffic received by the network interface, a behavior commonly used by network sniffing tools or malicious implants to intercept sensitive data.
Detects Microsoft-branded phishing pages served from non-Microsoft domains, the subsequent credential submission, and the establishment of a WebSocket relay connection characteristic of the Mirage2FA Adversary-in-the-Middle (AiTM) toolkit. This rule correlates multiple stages of the phishing flow to identify active proxy-based credential and MFA bypass attempts.
Detects unauthorized network sessions targeting Siemens S7 PLCs. The rule specifically identifies unauthenticated S7comm protocol traffic on TCP port 102 and the usage of default SNMP community strings ('public' or 'private') on port 161, which are indicative of exploitation attempts or unauthorized access to industrial control system (ICS) hardware.
Detects unauthorized S7comm 'PUT' or 'Write' operations to Programmable Logic Controller (PLC) data blocks or configuration memory that occur outside of defined maintenance or change windows, specifically when no valid work order is associated with the event.
Detects a high-frequency burst of S7comm protocol connection attempts directed at TCP port 102 from a single source to a specific destination PLC. This pattern of rapid, repeated connection attempts is indicative of automated exploit-variant testing or fuzzing against industrial control systems.
Detects anomalous S7comm (Siemens S7 Communication) traffic directed to port 102, which is commonly used by PLCs and ICS devices. The rule identifies potential automated, scripted, or unauthorized activity by monitoring for connections occurring outside of standard business hours (6 PM to 8 AM) or exhibiting high-frequency connection patterns (exceeding 1 connection per second), which may indicate scanning, brute-forcing, or interaction with ICS hardware by unauthorized actors.
Detects outbound network connections initiated by the 'build-script-build' executable, which is the compiled output of a Rust 'build.rs' script. While legitimate build scripts may fetch dependencies, unexpected network activity from this process could indicate malicious code injection during the build process, such as a software supply chain attack attempting to download secondary payloads.
Page 79 of 246