Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,158 detections
Filters
Last updated
All Time
Detection languages
2,304
1,070
640
289
288
Contributors
918
814
769
696
224
Categories
20,460
11,847
5,879
5,158
4,866
Platforms
2,861
2,017
816
524
213
Products / Services
1,339
1,144
831
576
366
MITRE Techniques
1,825
1,307
787
747
577
CVEs
9
7
7
6
6
IDS Classtypes
538
151
101
57
48
IDS Protocols
375
373
132
64
42
Detects DNS requests or network connections to the typosquatted domain and hardcoded IP associated with the DAEMON Tools supply chain attack, as well as additional network relations tied to the installer.
This rule detects potential bulk domain registration activity by grouping registrations by registrar, name server, and a 18-minute window. It specifically flags cases where multiple domains are registered with privacy protection enabled, which is a common tactic for adversaries setting up large-scale C2 or phishing infrastructure.
Detects excessive network activity patterns by ff-agent which may indicate beaconing or unauthorized scanning activity. Note that this rule requires a backend capable of correlation or statistical aggregation.
Detects network activity (DNS queries, HTTP requests, and TLS SNI) associated with the PamStealer malware communicating with its known command and control domain maccyapp.com.
This rule detects the execution of mitmproxy, mitmweb, or mitmdump in reverse-proxy mode configured specifically to target login.microsoftonline.com. This behavior is highly characteristic of an adversary setting up an Adversary-in-the-Middle (AiTM) platform to perform TLS interception on authentication traffic, potentially leading to credential and session cookie theft.
Detects the use of Microsoft lookalike domains for command and control (C2) communication in the context of wiper malware.
Attackers may register domains that closely resemble legitimate Microsoft domains to evade detection and facilitate malicious activities, such as data exfiltration or remote control of compromised systems.
Attackers may register domains that closely resemble legitimate Microsoft domains to evade detection and facilitate malicious activities, such as data exfiltration or remote control of compromised systems.
Detects potential exploitation attempts against FortiClient EMS versions 7.4.5-7.4.6, specifically targeting the administration API on port 8013. The detection identifies unauthorized access attempts indicated by the log entry 'Certificate not found in request header', which correlates with exploit behavior for CVE-2026-35616.
Detects network connection events where the requested URL contains 'dogleash' and includes common architecture suffixes (mips, arm, x64) or shell script extensions (.sh), often indicative of downloading stage payloads associated with the Dogleash malware family.
Detects network traffic associated with Cavern Manticore command-and-control communication. The rule identifies a specific HTTP request pattern characterized by a static User-Agent string resembling a Chrome/Edge browser on Windows and the inclusion of a specific 'X-User-token' header in the HTTP request.
This rule detects HTTP GET requests for specific file paths associated with known malicious lure archives (e.g., YEPlayer.rar, Pis2rayVPN.zip, YEMPlayer.msi). These files are typically used in social engineering campaigns to trick users into downloading and executing malware.
Detects periodic, low-variance network beaconing behavior indicative of the SnappyClient RAT, specifically monitoring for simultaneous connections to control (port 3333) and data (port 3334) ports. The detection utilizes statistical analysis of inter-arrival times (low coefficient of variation) and restricts alerts to rare destination IP addresses contacted by a limited number of internal hosts.
This rule detects potentially malicious network traffic that suggests command and control or data exfiltration. It identifies connections using non-standard ports (above 1024, excluding common ports) or abnormally long DNS queries, often associated with DNS tunneling. The rule aggregates these events by host and destination to identify persistent or high-volume patterns indicative of covert channels.
Detects anomalous internal network activity where a single host attempts to connect to multiple unique internal IP addresses across various ports within a short timeframe. This behavior is indicative of lateral movement reconnaissance or port scanning within the internal network.
Detects rapid SMB (port 445) connect/disconnect patterns originating from processes that have loaded mpr.dll. This behavior is indicative of credential spraying tools, such as the Cavern Manticore NetUseBrute module, which utilizes WNetAddConnection2 and WNetCancelConnection2 to cycle through credentials against multiple endpoints.
Detects the execution of 'FortiGateSniffer', a tool identified as Golang-based, used to perform passive network packet capture on compromised FortiGate devices. The rule also analyzes captured traffic for sensitive authentication protocols including RADIUS, Kerberos, and NTLM.
Detects the initialization of the PromptSpy malware's custom 'IpcSocket' class, which establishes a TCP listener bound to the localhost (127.0.0.1) address. This mechanism is utilized for inter-process communication between various components of the PromptSpy malware to coordinate malicious activities on the Android platform.
This rule detects potential network port scanning behavior by identifying a host that initiates connections to both ports 3333 and 3334 on a remote destination within a short time window (15 seconds). This specific pattern is often associated with automated discovery or lateral movement tools probing for specific services.
Detects a specific network handshake pattern indicative of the Cavern Manticore malware establishing a SOCKS5-over-WebSocket tunnel. The rule monitors for a WebSocket upgrade request followed by the initial SOCKS5 connection authentication byte sequence.
Detects a script interpreter wscript/cscript opening a network connection to a non-local network. Adversaries may use script to download malicious payloads.
This rule detects the use of GSocket and GS-Netcat utilities, which are often used for creating reverse shells and persistent network tunnels. It monitors for either direct network connections associated with these tools or command-line activity indicating these tools are being configured for persistence using cron jobs, systemd services, or @reboot triggers.
Detects SSH traffic originating from designated edge appliances (e.g., firewalls, NAS devices) directed towards internal network destinations. This pattern is often indicative of network pivoting, lateral movement, or unauthorized remote access from exposed or compromised perimeter assets.
Page 88 of 246