Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,158 detections
Filters
Last updated
All Time
Detection languages
2,304
1,070
640
289
288
Contributors
918
814
769
696
224
Categories
20,460
11,847
5,879
5,158
4,866
Platforms
2,861
2,017
816
524
213
Products / Services
1,339
1,144
831
576
366
MITRE Techniques
1,825
1,307
787
747
577
CVEs
9
7
7
6
6
IDS Classtypes
538
151
101
57
48
IDS Protocols
375
373
132
64
42
Detects a specific fingerprinting activity by the ClickFix Traffic Direction System (TDS) within HTTP POST request bodies. The rule identifies the combination of 'mode:php', a 'MacIntel' platform string (spoof-check), and WebGL rendering fields ('webglVendor', 'webglRenderer') in a JSON-encoded body, which is characteristic of the macOS ClickFix infostealer campaign delivery.
This rule detects network connections to known malicious IP addresses, domains, and URLs, as well as the execution or presence of files with known malicious SHA256 hashes. It correlates network and file events to identify potential compromise indicators.
Detects network, process, and file activity referencing the specific hard-coded VAPID public key used by SNOWBELT in the UNC6692/Edgecution campaign for push-notification-based registration, correlating browser extension file drops (background.js, extension.log) with the key's appearance in network traffic or process command lines.
This rule detects the execution of the Cloudflare Tunnel utility (cloudflared.exe) or similarly named binaries from non-standard, suspicious locations like temporary directories or public user folders. This pattern is commonly used by attackers to establish unauthorized persistent network tunnels (reverse proxies) into the victim's environment, bypassing firewall restrictions.
This rule detects potential Web Proxy Auto-Discovery (WPAD) abuse by monitoring for network requests to 'wpad.dat' or 'wpad' resources on port 80, specifically on endpoints that have been tagged as connected to untrusted or public networks (e.g., guest, hotel, public). WPAD abuse is a common technique used by attackers to force devices to use a malicious proxy, enabling traffic interception and potential credential theft.
Detects HTTP traffic to the hardcoded Heroku-hosted SNOWGLAZE C2 endpoint (sad4w7h913-b4a57f9c36eb.herokuapp.com) where the client requests a WebSocket upgrade on the /ws URI and sends a JSON body containing login, password, and uuid fields used to authenticate the tunnel to the actor's C2 infrastructure.
This rule detects the execution of the Cloudflare Tunnel utility (cloudflared.exe) or similarly named binaries from non-standard, suspicious locations like temporary directories or public user folders. This pattern is commonly used by attackers to establish unauthorized persistent network tunnels (reverse proxies) into the victim's environment, bypassing firewall restrictions.
This query performs comprehensive field extraction and normalization on SentinelOne Deep Visibility raw logs. It acts as a parsing and preparation layer to structure diverse event categories (process, network, file, registry, authentication, and task events) into a standardized format for security analysis, triage, and threat hunting.
This rule monitors Zscaler web proxy logs to identify potential unauthorized account access by flagging two types of anomalous geographic activity: Impossible Travel (user access from two different countries within a short time window) and New Country for Identity (the first instance of an account accessing resources from a specific country).
SNOWBELT time-based DGA S3 bucket manifest retrieval
Detects multiple stages of the ChocoShell credential and token theft framework, including SYSTEM token impersonation for DPAPI key access, VSS shadow copy abuse to extract browser databases, malicious use of browser remote debugging ports (CDP) for cookie exfiltration, and unauthorized access to browser profile files or Token Broker cache (.tbres) files.
Detects initiated network connections to crypto mining pools
Detects a non-root local process gaining a root shell or executing a SUID-root binary shortly after AF_RXRPC (rxrpc) network socket activity on the same device, consistent with exploitation of the DirtyDecrypt RxGK decrypt-before-authentication flaw to corrupt page-cache pages of SUID-root binaries and gain root.
Detects the SourTrade browser-side build-pipeline setup sequence: a ServiceWorker registered at /sw.js immediately followed, within the same page load, by a SharedWorker instantiated from an in-page Blob URL carrying an application/javascript MIME type — restricted to domains flagged as newly-registered or low-reputation — consistent with the pre-download preparation stage of browser-assembled malware.
Detects a shell process (sh, bash, cmd.exe, powershell.exe) spawned by a web application server process (java, node, python) that establishes an outbound connection to a non-private IP address, excluding known CI/CD and health-check command-line patterns — consistent with a reverse shell delivered via web application exploitation.
Detects the creation of explorer.exe processes on non-default Windows desktops, which is a known indicator of Hidden VNC (HVNC) activity often utilized by the Dolphin X stealer. The rule mitigates false positives by excluding legitimate non-default desktop uses (like RDP/Citrix/VDI brokers) and requires correlation with a recent network connection from the newly spawned explorer.exe process.
Detects a CountLoader command-and-control pattern where a process issues an HTTP GET to a /connect endpoint with XOR-hex-style query parameters, followed within one hour by an Authorization: Bearer JWT token reused by the same process, host, and agent.
Detects outbound HTTPS traffic to api.telegram.org originating from non-standard or unsigned processes. This rule is designed to identify potential data exfiltration by malware (such as stealers or trojans) using the Telegram Bot API as a C2 or exfiltration channel. It relies on a companion rule to establish flowbits for legitimate client traffic.
This rule monitors Zscaler web proxy logs to identify potential unauthorized account access by flagging two types of anomalous geographic activity: Impossible Travel (user access from two different countries within a short time window) and New Country for Identity (the first instance of an account accessing resources from a specific country).
This rule detects potential command-and-control (C2) activity related to the NodeSnake RAT. It specifically identifies cleartext HTTP requests attempting to initiate a WebSocket upgrade (using the Sec-WebSocket-Key header) while the target host is specified as an IP address literal rather than a domain name, which is a common indicator of hardcoded or non-DNS-dependent C2 infrastructure.
Anomalously large outbound transfers over the WebRTC DataChannel from a Chrome/Edge process launched with --headless and --remote-debugging-port flags (no visible window), indicating exfiltration rather than routine interactive or automation-only browser use.
Page 83 of 246