Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,158 detections
Filters
Last updated
All Time
Detection languages
2,304
1,070
640
289
288
Contributors
918
814
769
696
224
Categories
20,460
11,847
5,879
5,158
4,866
Platforms
2,861
2,017
816
524
213
Products / Services
1,339
1,144
831
576
366
MITRE Techniques
1,825
1,307
787
747
577
CVEs
9
7
7
6
6
IDS Classtypes
538
151
101
57
48
IDS Protocols
375
373
132
64
42
Detects a specific DNS AAAA record response containing a hardcoded sentinel value (2001:4998:44:3507::8000) associated with the CAV3RN framework, which signals a failed configuration recovery process.
Detects the combined msaRAT CDP C2 sequence within a single event - Page.setBypassCSP disabling Content Security Policy, all five Runtime.addBinding callback registrations (msaOpen, msaClose, msaError, msaMessage, dataAck), and a Runtime.evaluate call injecting JavaScript that establishes an RTCPeerConnection. All three behaviors must be present together, reducing false positives from unrelated CDP activity.
Anomalously large outbound transfers over the WebRTC DataChannel from a Chrome/Edge process launched with --headless and --remote-debugging-port flags (no visible window), indicating exfiltration rather than routine interactive or automation-only browser use.
Detects established TLS connections to known malicious infrastructure associated with PureRAT and DlrtyGames RAT. The rules identify suspicious patterns such as connections without a Server Name Indication (SNI) and specific JA3 hashes indicative of malware beacons.
This rule detects DNS queries for the domain 'terezo-kb.org', which is associated with the NodeSnake Remote Access Trojan (RAT), often utilized by the INTERLOCK ransomware group for command and control (C2) communication.
The aim of this query is detect SSH connections attempts where the external sources are specifying babeld (Network Protocol) or Conker (Network Conf. Manager) as parameters to establish a connection, is detect suspicious activity such as:
Unauthorized SSH connections.
Malicious use of SSH for lateral movement within a network.
Exfiltration attempts via SSH tunneling.
Unauthorized SSH connections.
Malicious use of SSH for lateral movement within a network.
Exfiltration attempts via SSH tunneling.
This rule detects network traffic patterns associated with BlueNoroff ClickFix C2 communications. It specifically identifies GET requests to endpoints containing an 'ft?id=' parameter followed by a base64-encoded string, which indicates the delivery of encrypted tasking parameters to an infected system.
Detects instances where the 'claude' or 'claude-code' process initiates network connections to more than 20 distinct destination IP addresses within a short 5-minute window. This behavior is indicative of a tool performing automated network scanning or discovery activities.
Detects instances where the Microsoft Installer process (msiexec.exe) initiates a network connection to the local IPv4 loopback address (127.0.0.1). This behavior may indicate an MSI custom-action payload attempting to interact with a web browser through the Chrome DevTools Protocol (CDP) to establish a covert command-and-control channel.
A non-browser process pivoting through the browser's CDP loopback debug port, so the RAT's own traffic never leaves 127.0.0.1. Tightened to exclude known developer tooling and browser automation frameworks (VS Code debugger, Chrome DevTools frontend, Selenium/Puppeteer/Playwright drivers) that legitimately attach to the local CDP debug port.
This rule detects potential Active Directory enumeration activity by monitoring ADWS (Active Directory Web Services) port 9389. It captures activity where Microsoft.ActiveDirectory.WebServices.exe is engaged, and correlates this with Windows Event ID 1644, which identifies LDAP queries being executed. The rule specifically looks for local loopback connections often used to proxy and obfuscate the origin of these LDAP queries, helping to identify enumeration patterns that might be intended to hide the source workstation.
Detects network traffic containing a characteristic 'Loading in progress...' string, which is associated with the 'Kratos' animated envelope loading screen used in fake Microsoft 365 credential harvesting pages.
This rule detects network activity associated with a phishing campaign impersonating the RENAPO CURP lookup service. It monitors for TLS SNI and HTTP Host headers containing the typosquatted domain 'gobf.mx', as well as HTTP responses containing specific keywords related to the Mexican CURP registration form originating from this domain.
Detects the creation of specific RabbitMQ AMQP exchanges and bindings often associated with C2 communication patterns, such as the use of 'fanout' or 'topic' exchange types paired with common internal naming conventions or payload keywords.
Detects anomalous Redis network traffic containing structures associated with GigaWiper, specifically monitoring for 'cmd.Result' fields used by the malware to exfiltrate command output from compromised systems to a C2 server.
Detects network communication associated with the Blind Eagle (APT-C-36) threat actor's use of AsyncRAT. This rule identifies DNS queries for a specific DuckDNS domain, matching TLS SNI for the same domain, and network connections to a known historic C2 IP address historically used via a shared VPN egress.
This rule detects access to known adversary-in-the-middle (AiTM) phishing infrastructure mimicking Microsoft login pages. It identifies malicious URLs matching specific randomized path token patterns or those hosting a known phishing domain, while also monitoring for associated session-specific parameters such as 'rt=', 'PHPSESSID', and 'preload=1' cookies, as well as traffic interacting with legitimate 'login.microsoftonline.com' domains in a proxy context.
Anomalously large outbound transfers over the WebRTC DataChannel from a Chrome/Edge process launched with --headless and --remote-debugging-port flags (no visible window), indicating exfiltration rather than routine interactive or automation-only browser use.
A non-browser process pivoting through the browser's CDP loopback debug port, so the RAT's own traffic never leaves 127.0.0.1. Tightened to exclude known developer tooling and browser automation frameworks (VS Code debugger, Chrome DevTools frontend, Selenium/Puppeteer/Playwright drivers) that legitimately attach to the local CDP debug port.
Detects outbound network connections to hard-coded IP addresses associated with GigaWiper malware C2 infrastructure on specific ports, which may indicate active backdoor communication.
Detects outbound network connections to hard-coded IP addresses associated with GigaWiper malware C2 infrastructure on specific ports, which may indicate active backdoor communication.
Page 85 of 246