Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,158 detections
Filters
Last updated
All Time
Detection languages
2,304
1,070
640
289
288
Contributors
918
814
769
696
224
Categories
20,460
11,847
5,879
5,158
4,866
Platforms
2,861
2,017
816
524
213
Products / Services
1,339
1,144
831
576
366
MITRE Techniques
1,825
1,307
787
747
577
CVEs
9
7
7
6
6
IDS Classtypes
538
151
101
57
48
IDS Protocols
375
373
132
64
42
This rule detects the execution of the QEMU virtualization engine (qemu-system-x86_64.exe) when associated with specific toolset files (e.g., BloodHound, Metasploit) or suspicious network activity patterns indicative of lateral movement, such as connecting to administrative ports (SMB, RDP, WinRM) on external or sensitive network ranges. The rule calculates a risk score based on the presence of these indicators.
This rule detects a high volume of UDP network connections originating from a single process on a device. A count exceeding 50 UDP connections from the same process to the same remote IP address is considered anomalous and could indicate a UDP flood or other denial-of-service attempt.
This rule detects potential SSH brute force attacks by identifying multiple failed password attempts from a single source IP address to a specific computer within a 5-minute window. It specifically looks for 'Failed password' messages in syslog entries from the 'sshd' process.
Detects network traffic containing a potentially malicious Microsoft Excel (.xlsx) OOXML file being downloaded. The rule identifies the presence of the 'Content-Disposition' header with an '.xlsx' extension, combined with a file signature matching the ZIP format (often used by OOXML files) and a file size exceeding 500KB, which may indicate an attempt to exploit CVE-2025-60727.
Detects network traffic containing a potentially malicious Microsoft Excel (.xlsx) OOXML file being downloaded. The rule identifies the presence of the 'Content-Disposition' header with an '.xlsx' extension, combined with a file signature matching the ZIP format (often used by OOXML files) and a file size exceeding 500KB, which may indicate an attempt to exploit CVE-2025-60727.
Detects anomalous ICMP Echo Request packets (type 8, code 0) that contain payloads exceeding 64 bytes. ICMP Echo requests with large, non-standard payloads are a classic indicator of ICMP tunneling, which can be used to bypass network firewalls and encapsulate non-ICMP traffic for command and control (C2) or data exfiltration. The rule includes a threshold to reduce noise by alerting only when multiple such packets are seen from the same source.
This rule detects potential lateral movement by monitoring for successful Remote Desktop Protocol (RDP) logons (Event ID 4624, Logon Type 10) occurring directly between workstations, excluding connections where the destination computer name indicates a typical server or infrastructure naming convention (e.g., ends with $).
This rule monitors DNS query traffic for unusually long, encoded subdomain labels (50 characters or more). Such patterns are indicative of data exfiltration or command-and-control (C2) communication using DNS tunneling tools like iodine or dnscat2, which encapsulate non-DNS protocols within the DNS query structure to evade network inspection.
This rule detects file system artifacts and network activity associated with a malicious Chromium-based browser extension (ID: flkebkiofojicogddingbdmcmkpbplcd). The extension utilizes service workers to intercept browser search queries and capture keystrokes, subsequently exfiltrating the data to an attacker-controlled domain.
This rule monitors network traffic to detect potential scanning activity by identifying single remote IP addresses communicating with more than 50 distinct internal hostnames within the observed timeframe. This behavior is often indicative of automated reconnaissance, such as vulnerability scanning or network discovery, performed by an adversary attempting to map the environment.
Detects anomalous SSH connections originating from internal network appliances or DMZ-segment devices (e.g., storage, firewalls) to multiple internal network hosts. This behavior is indicative of lateral movement or SSH tunneling as observed in the VerdantBamboo BRICKSTORM campaign, where edge devices are leveraged as pivot points.
This rule detects successful authentication attempts directed at network devices from sources not explicitly marked as authorized management systems. It identifies users or systems that are not recognized service accounts authenticating against network infrastructure and flags activity that involves multiple unique destination targets as high risk.
This rule detects potential unauthorized remote access activity by correlating the execution or network activity of known remote access tools (Tailscale) or suspicious network patterns (DuckDNS, port 4444) with the subsequent execution or network activity of secondary RAT/remote desktop software (RustDesk, AnyDesk, TeamViewer) on the same host within a 10-minute window. This behavior is indicative of an adversary establishing an initial C2 connection followed by deploying secondary remote access tools for persistent remote control.
This rule detects potential Domain Generation Algorithm (DGA) activity by analyzing network connection logs. It identifies suspicious domains based on their structure (length, character set) and then filters them using a trigram analysis. Domains with non-repeating trigrams and rare trigrams (not found in a baseline of Alexa Top 1M domains) are flagged as DGA candidates. The rule then joins these candidates back to the original network logs to identify actual connections to these suspicious domains.
This rule detects URLs that contain common redirection or link parameters (u=, url=, redirect=, r=, link=, target=, dest=) where the value of the parameter is a long, alphanumeric string that appears to be an encoded domain. This pattern can indicate attempts to obfuscate the true destination of a link, often seen in phishing campaigns or malicious redirection attempts. The rule specifically looks for encoded parameters containing common top-level domains like .com, .net, or .org.
This rule detects suspicious access patterns to Windows administrative shares (C$, D$, E$, IPC$, ADMIN$). It specifically looks for multiple access attempts (10 or more within an hour) involving read or write operations (AccessMask contains '0x0001' or '0x0002') from a single source IP address and account. This behavior can indicate lateral movement, data exfiltration, or other malicious activity.
Detects HTTP traffic initiating a WebSocket protocol upgrade with a specific 'binary' subprotocol header, characteristic of the Brickstorm backdoor used by the UNC5221 threat actor for command and control (C2) communication.
Detects reconnaissance and enumeration activities targeting Active Directory Web Services (ADWS) on port 9389. This includes specific detection of the SharpADWS tool and anomalous processes that connect to ADWS, a technique used to bypass standard LDAP monitoring by encapsulating AD queries within SOAP messages.
Detects HTTP GET requests for .msc (Microsoft Management Console) files, which can be leveraged as part of an attack chain to abuse the mmc.exe binary for proxy execution of malicious configurations.
Detects the execution and network activity of known reverse tunneling and proxy tools such as Chisel, Ngrok, and FRP. These tools are commonly abused by adversaries to establish persistence, bypass firewalls, and facilitate command and control (C2) communication. The rule monitors for specific process names, command-line arguments, and DNS requests related to these services.
This rule detects potentially malicious use of libcurl or curl.exe involving mTLS-related flags (e.g., --cert, --key, --cacert) in non-browser processes. It specifically flags instances where such processes perform repeated HTTPS connections to remote hosts, which may indicate exploitation of CVE-2026-8932 related to mTLS connection reuse and authentication bypass.
Page 90 of 246