Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,158 detections
Filters
Last updated
All Time
Detection languages
2,304
1,070
640
289
288
Contributors
918
814
769
696
224
Categories
20,460
11,847
5,879
5,158
4,866
Platforms
2,861
2,017
816
524
213
Products / Services
1,339
1,144
831
576
366
MITRE Techniques
1,825
1,307
787
747
577
CVEs
9
7
7
6
6
IDS Classtypes
538
151
101
57
48
IDS Protocols
375
373
132
64
42
Detects a high volume of successful network connections to multiple unique cloud storage services (Dropbox, Box.com, OneDrive) from a single device and user account within an hour. This could indicate data exfiltration or unauthorized access to cloud storage.
Detects execution of the SSH binary with command-line arguments indicative of port forwarding, specifically remote port forwarding (-R) or use of specific ports and IP addresses often associated with unauthorized proxying or command and control tunnels.
Detects high-volume, potentially automated enumeration of Microsoft Graph API endpoints targeting sensitive personnel data (payroll, HR, finance). This rule identifies requests using non-standard or suspicious user agents—such as curl, python-requests, or common web client patterns—when interacting with user and group directories in the Microsoft 365 environment, characteristic of the 'Payroll Pirate' (Storm-2755/Storm-2657) campaign patterns.
This rule detects network connections to a specific Discord webhook URL and another suspicious domain (78smp.com/m/). This pattern is often associated with malware attempting to exfiltrate data or establish command and control (C2) via Discord webhooks, or other suspicious domains.
This rule detects potential RDP lateral movement by identifying accounts that log on to multiple distinct workstations via RDP (LogonType 10) within a one-hour window, where the workstation name is different from the computer name. A logon chain of more than two distinct computers for the same account and IP address within an hour is flagged as suspicious.
This rule monitors network traffic for HTTP requests or DNS queries targeting 'nacos', a popular service discovery and configuration management platform. The rule specifically flags potential interaction attempts and identifies whether the activity includes login-related path patterns, which could indicate unauthorized access attempts or reconnaissance against a Nacos instance.
Detects email bombing attacks via automated subscription signups
This rule detects processes running from non-standard locations (specifically within application data directories) that perform both file system write operations for media or image formats (indicative of screen, audio, or video capture) and simultaneously initiate outbound network connections to non-private IP addresses. This behavior is often characteristic of spyware, unauthorized remote access tools, or malware attempting to capture and exfiltrate user activity.
Detects anomalous HTTP upgrade requests (h2c, websocket) targeting potentially vulnerable web infrastructure (e.g., nghttpx). The rule correlates abnormal 'Upgrade' header usage, suspicious request paths (/poisoned, /upgrade), and subsequent 400 error codes, which are indicative of HTTP request smuggling attempts aimed at desynchronizing frontend and backend request queues.
Detects a malicious Chrome extension exfiltrating keystrokes entered into the browser's Omnibox. The rule monitors for high-frequency GET requests (indicative of keystroke-by-keystroke transmission) from chrome.exe to a specific C2 domain (perplexity-ai.online), correlated with DNS resolution of that domain within the same session.
Detects network connections from internal endpoints to Filen.io cloud storage domains and subdomains. The rule specifically flags interactions involving common API endpoints for file operations (upload, download, directory listing) as 'Critical' risk, while generic traffic to the domain is classified as 'High' risk.
Detects the execution of QEMU processes configured with specific network redirection flags (hostfwd) targeting standard SSH ports, or utilizing suspicious file paths (e.g., .db, .dll) as virtual disk backing files. This behavior is indicative of adversaries utilizing QEMU to establish covert reverse SSH tunnels or staging malicious artifacts within virtualized environments.
Detects administrative commands (e.g., showing running configuration, copying startup configuration, or accessing enable secret) executed via SSH or Telnet on network devices from non-baseline management IP addresses.
This query detects multiple TTPs associated with the Storm-2561 campaign that uses SEO poisoning to distribute fake VPN clients for credential theft. It looks for known file hashes, a specific code-signing certificate, malicious DLL side-loading and C2 communication patterns.
This rule detects network connections to suspicious domains or IP addresses associated with potentially compromised or malicious VPN infrastructure. Specifically, it looks for connections to 'vpn-fortinet.com', 'ivanti-vpn.org', 'forticlient-vpn.de', or the IP address '194.76.226.93'. These indicators may suggest attempts to establish command and control, exfiltrate data, or engage in other malicious activities via compromised VPN services.
This rule detects a high volume of network share connections (SMB/CIFS) from a single device to multiple remote IPs within a short timeframe. This behavior can be indicative of ransomware attempting to encrypt files across network shares, or other forms of rapid lateral movement and data access. The rule specifically looks for connections on ports 445 or 139 initiated by common user or system processes like explorer.exe, cmd.exe, or powershell.exe.
This rule detects a high volume of successful network connections to common web ports (80, 443, 8080, 8443) where the remote URL contains keywords like 'version' or 'software'. This pattern could indicate an adversary performing reconnaissance to identify installed software and their versions, potentially looking for vulnerabilities or specific applications to target. The threshold of 10 such activities within an hour for a single device is set to flag anomalous behavior.
This rule detects network communication with known malicious command-and-control (C2) infrastructure identified by specific domains and IP addresses. The detection logic calculates a confidence score based on the presence of identified malicious C2 domains or IPs, specific suspicious cookies (zd_cs_pm, euconsent-v2), and known C2 URI paths.
Detects execution and file artifacts associated with the GSocket (gs-netcat) utility, often used by threat actors like Velvet Ant (Operation Highland) for establishing SOCKS proxies, tunneling, and persistent remote access. The rule monitors process creation, file modifications, and network connections related to the tool's binary names, command-line arguments, and specific file paths.
Detects network connections originating from a process and directed towards the local loopback interface (127.0.0.1 or ::1) on non-privileged, non-SMB ports (>= 1024 and != 445). This pattern can identify inter-process communication (IPC) over local network sockets which may be used by malware or malicious scripts to bypass security controls or communicate with local services.
This rule detects anomalous, high-frequency HTTP POST requests directed at sensitive API endpoints related to payment, billing, or administration. By calculating requests per minute and identifying unique source IP behavior, it aims to flag potential automated brute-force attacks, unauthorized API discovery, or data exfiltration attempts against critical system management interfaces.
Page 92 of 246