Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,158 detections
Filters
Last updated
All Time
Detection languages
2,304
1,070
640
289
288
Contributors
918
814
769
696
224
Categories
20,460
11,847
5,879
5,158
4,866
Platforms
2,861
2,017
816
524
213
Products / Services
1,339
1,144
831
576
366
MITRE Techniques
1,825
1,307
787
747
577
CVEs
9
7
7
6
6
IDS Classtypes
538
151
101
57
48
IDS Protocols
375
373
132
64
42
Detects telemetry consistent with GigaWiper's command 8 'route manager' function, which binds or unbinds targeted routing keys against a RabbitMQ 'Topic' exchange using a mode of operation (1/2/3) to enable non-broadcast, targeted command delivery over AMQP C2 channels.
Detects outbound network connections to hard-coded IP addresses associated with GigaWiper malware C2 infrastructure on specific ports, which may indicate active backdoor communication.
Detects outbound HTTP POST requests destined for 'webhook.site' containing the string 'secret' in the request body. This is a common pattern used by attackers to exfiltrate small amounts of sensitive data or credentials to a public web service for collection.
Detects instances where users click links directing to Proton Drive domains, a common vector for device code phishing and credential harvesting attacks.
Detects potential residential proxy usage based on network connections to known proxy-related ports and proxy infrastructure indicators in CrowdStrike Falcon logs.
This rule monitors network response bodies for the presence of a specific HTML title indicating an authentication page. This can be used to identify potential entry points for brute force or credential harvesting attacks against exposed authentication interfaces.
This rule monitors network traffic for DNS queries and HTTP requests directed toward known malicious domains associated with phishing campaigns, specifically those leveraging OAuth device code authorization flows (e.g., /devicelogin, /deviceauth) and credential harvesting sites.
This rule identifies AnyDesk remote access software activity by correlating process execution with network connection events between hosts. It tracks the AnyDesk application attempting to establish a network connection within a 5-minute window, effectively monitoring potential interactive remote access sessions across the network.
This rule retrieves a collection of raw telemetry events including process, file, registry, and network information for a specific host (ex. HostName123). It acts as a diagnostic or hunting query to list the most recent 5,000 activities performed on the specified machine.
This rule identifies emails containing URLs that point to known malicious domains used in phishing campaigns. It joins email URL information with core email event details to report the sender, recipient, subject, and the specific malicious domain associated with the URL.
Detects instances where a user receives an email containing a link to 'canva.com' with subject lines suggestive of document sharing or invoicing, and subsequently clicks a URL that redirects them away from the 'canva.com' domain. This behavior is indicative of potential document-based phishing where attackers use legitimate document hosting platforms as a lure to redirect users to malicious or credential-harvesting websites.
This rule identifies network traffic utilizing the WebSocket (wss://) protocol. WebSockets are commonly used for real-time web communications, but adversaries may also use them to establish C2 channels or tunnel traffic to bypass security controls by blending in with standard web traffic.
Detects network connections to Zoho WorkDrive (workdrive.zoho.com) initiated by processes other than standard web browsers. This activity may indicate the use of unauthorized or automated tools to access cloud storage, potentially for data exfiltration or staging.
Detects the creation of specific RabbitMQ AMQP exchanges and bindings often associated with C2 communication patterns, such as the use of 'fanout' or 'topic' exchange types paired with common internal naming conventions or payload keywords.
Detects anomalous Redis network traffic containing structures associated with GigaWiper, specifically monitoring for 'cmd.Result' fields used by the malware to exfiltrate command output from compromised systems to a C2 server.
Detects DNS query attempts to a known malicious IP address (179.43.166.242) associated with the CrashStealer malware campaign, indicating potential command-and-control communication.
Detects telemetry consistent with GigaWiper's command 8 'route manager' function, which binds or unbinds targeted routing keys against a RabbitMQ 'Topic' exchange using a mode of operation (1/2/3) to enable non-broadcast, targeted command delivery over AMQP C2 channels.
Detects the creation of specific RabbitMQ AMQP exchanges and bindings often associated with C2 communication patterns, such as the use of 'fanout' or 'topic' exchange types paired with common internal naming conventions or payload keywords.
Detects anomalous Redis network traffic containing structures associated with GigaWiper, specifically monitoring for 'cmd.Result' fields used by the malware to exfiltrate command output from compromised systems to a C2 server.
Detects telemetry consistent with GigaWiper's command 8 'route manager' function, which binds or unbinds targeted routing keys against a RabbitMQ 'Topic' exchange using a mode of operation (1/2/3) to enable non-broadcast, targeted command delivery over AMQP C2 channels.
This rule is designed to reconstruct an investigative timeline around a specific device and timestamp identified by an initial network event. It aggregates process execution, file activity, network connections, and alert evidence from the affected device within a specified time window before and after the triggered pivot event, facilitating incident investigation and root cause analysis.
Page 86 of 246