Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,158 detections
Filters
Last updated
All Time
Detection languages
2,304
1,070
640
289
288
Contributors
918
814
769
696
224
Categories
20,460
11,847
5,879
5,158
4,866
Platforms
2,861
2,017
816
524
213
Products / Services
1,339
1,144
831
576
366
MITRE Techniques
1,825
1,307
787
747
577
CVEs
9
7
7
6
6
IDS Classtypes
538
151
101
57
48
IDS Protocols
375
373
132
64
42
Detects processes making HTTP/HTTPS requests to localhost on ports 40341 or 40342 for '/metadata'. This pattern can indicate local service discovery, inter-process communication, or potentially malicious activity attempting to interact with local services, possibly for credential access or privilege escalation.
This rule detects network connections to specific deep link patterns associated with messaging applications like Telegram, WhatsApp, and Signal. Such deep links can be used in phishing attempts or to initiate actions on a user's device through these applications.
This rule detects attempts to authenticate to SSH using GSSAPI (Generic Security Service Application Programming Interface). While GSSAPI can be used for legitimate authentication, its presence in logs might indicate an attacker attempting to use alternative authentication methods, potentially for lateral movement or privilege escalation, especially if unexpected in the environment.
This rule detects network connections and user sign-ins originating from IP addresses identified as belonging to Iran. It also identifies sign-ins where the reported country is Iran, but the IP address is not found within the provided Iranian IP list, which could indicate IP geolocation discrepancies or obfuscation attempts.
This rule detects potential Adversary-in-the-Middle (AiTM) session hijacking by monitoring for successful multi-factor authentication (MFA) events on unmanaged or non-compliant devices, followed within 30 minutes by an API request from a geographically distant location. It includes logic to flag suspicious User-Agent strings often associated with automated AiTM tools.
Detects the execution of the 'diagnose sniffer packet' command on FortiOS devices. This command can be abused by malware, such as FortigateSniffer, to intercept authentication traffic, as observed in campaigns like FortiBleed.
This rule monitors network logs (from proxies and firewalls) for web traffic (HTTP GET requests) containing suspicious JavaScript code injection patterns in the request context or message fields. It specifically looks for common XSS indicators such as <script tags, eval(), document.write(), fromCharCode(), and atob().
This rule detects network connections made to specific non-standard ports (7777, 8080, 8443) where the remote URL contains substrings associated with proxy or tunneling activities ('proxy', 'tunnel', 'hide'). This behavior is commonly associated with malware attempting to evade security controls by routing traffic through unauthorized intermediaries or obfuscated tunnels.
Detects network traffic associated with known Cobalt Strike Beacon request URI patterns. This rule utilizes network signature inspection to flag outbound connections containing URI fragments commonly used by Cobalt Strike default profiles.
Detects outbound network connections over standard SSH ports (22, 2222) initiated by process names typically associated with web requests or package management (curl, git, php), potentially indicating unauthorized remote access, lateral movement, or data exfiltration from a compromised host to an external, non-private network address.
Detects DNS queries originating from endpoints to common URL shortening services such as bit.ly, goo.gl, and others. These services are frequently abused by adversaries for C2 communications, distributing malware, or phishing, as they can mask malicious destination URLs.
Detects network activity associated with the Grandoreiro banking trojan, specifically identifying C2 communication tunneled over WebRTC/STUN (port 3478) or MQTT (Azure/Google Cloud services) originating from processes executing out of the AppData\Local directory. This behavior aligns with Grandoreiro's known DLL side-loading mechanism where legitimate but vulnerable binaries are used to load malicious libraries.
This rule monitors DeviceNetworkEvents for connections to domains that match naming patterns and TLDs frequently associated with the Ghostwriter/UNC1151 threat group. The rule specifically looks for URLs containing common credential-harvesting keywords (e.g., login, verify, account) combined with specific TLDs (e.g., .digital, .icu, .cc.cd). Connections to known common public DNS providers are excluded.
Detects DNS queries and network connection attempts to a set of known malicious domains associated with the threat actor UNC1151 (Ghostwriter). This rule monitors both DNS resolutions and direct network connection attempts to these indicators of compromise (IOCs), which are commonly used in spearphishing campaigns.
Detects suspicious command execution patterns, including reverse shell techniques (/dev/tcp, bash -i), DNS-based C2 communication (axiom-config, m100.cloud), and fileless payload retrieval (dig TXT queries). It specifically highlights commands initiated by common AI developer tools or runtimes (claude, node, python) that correlate with known adversarial setup scripts or potential prompt injection outcomes.
This rule monitors DeviceNetworkEvents for connections to domains that match naming patterns and TLDs frequently associated with the Ghostwriter/UNC1151 threat group. The rule specifically looks for URLs containing common credential-harvesting keywords (e.g., login, verify, account) combined with specific TLDs (e.g., .digital, .icu, .cc.cd). Connections to known common public DNS providers are excluded.
USB worm and loader leveraging living-off-the-land binaries
LockBit C2Beacon
YARA
High-velocity ransomware-as-a-service with aggressive leak-site extortion
Campaign converting compromised FortiGate firewalls into credential stealers
Detects malicious URLs sent via Microsoft Teams direct messages that contain known phishing TLDs, indicating potential phishing attempts or the use of Phishing-as-a-Service (PhaaS) infrastructure. The rule specifically targets one-on-one chats and filters for a broad list of suspicious top-level domains.
Dridex C2Beacon
YARA
Banking trojan and loader using malicious Office macro delivery
Page 97 of 246