Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,158 detections
Filters
Last updated
All Time
Detection languages
2,304
1,070
640
289
288
Contributors
918
814
769
696
224
Categories
20,460
11,847
5,879
5,158
4,866
Platforms
2,861
2,017
816
524
213
Products / Services
1,339
1,144
831
576
366
MITRE Techniques
1,825
1,307
787
747
577
CVEs
9
7
7
6
6
IDS Classtypes
538
151
101
57
48
IDS Protocols
375
373
132
64
42
Loader malware delivering follow-on ransomware payloads
Detects network traffic associated with known Cobalt Strike Beacon request URI patterns. This rule utilizes network signature inspection to flag outbound connections containing URI fragments commonly used by Cobalt Strike default profiles.
Detects potential Command and Control (C2) infrastructure rotation and DNS exfiltration by correlating DNS-over-HTTPS (DoH) traffic to Google Public DNS (8.8.8.8) with concurrent outbound connections to a high count (>=5) of distinct external IP addresses within a one-hour window. This behavior is consistent with the Nightmare Eclipse/VerdantBamboo post-disclosure tactical shifts to obfuscate DNS queries and rotate C2 endpoints.
This rule monitors network traffic for activity related to the Tox decentralized protocol. It identifies specific domains (tox.chat) or known hex-encoded identifiers associated with Payouts King ransomware leak sites and ransom notes embedded in network requests or payloads.
Detects network, proxy, or DNS activity associated with .onion pseudo-top-level domains, which are typically used for Tor anonymity services. The rule distinguishes between generic access to the Tor network and specific high-confidence interactions with known malicious onion addresses associated with payout or extortion sites.
Open-source derived remote access trojan with plugin architecture
This rule detects potential lateral movement activities by monitoring Windows Event Logs for suspicious network logons combined with service installations typical of post-exploitation tools like Impacket (psexec.py, wmiexec.py, smbexec.py). It flags service names and paths that match known tool patterns, specifically looking for high-frequency lateral movement attempts within a 30-minute window, including specific command-line indicators in service image paths.
This rule detects successful authentication attempts directed at network devices from sources not explicitly marked as authorized management systems. It identifies users or systems that are not recognized service accounts authenticating against network infrastructure and flags activity that involves multiple unique destination targets as high risk.
Detects the execution of the Chisel proxy/tunneling tool and associated network activity. The rule monitors for processes named 'chisel' with command-line arguments indicative of server or client mode, as well as network connections initiated by such processes, specifically flagging non-standard ports or known tunneling indicators on standard ports.
Detects network communication with the Telegram API endpoints (api.telegram.org) originating from processes other than common web browsers. The rule specifically monitors DNS queries, network connections via Sysmon, and proxy/firewall logs for requests involving common Telegram bot API methods (getUpdates, sendMessage, sendPhoto, setWebhook). It also flags execution patterns associated with specific tools (e.g., PyInstaller, bqt.exe, start.exe) that may indicate automated C2 activity.
Detects outbound network connections from node.exe or npm related processes to domains associated with the Polymarket Trap supply chain attack. This detection highlights the malicious behavior of compromised npm packages that initiate C2 communication at import time, bypassing standard postinstall security scripts.
This rule detects multiple failed SSL login attempts from a single source IP to a destination IP within a 24-hour period. A threshold of 10 failed attempts is used to identify potential brute-force attacks or credential stuffing against SSL-enabled services.
This rule identifies if a given IP address falls within the known IP ranges used by Apple's iCloud Private Relay service. It retrieves a list of IPv4 and IPv6 ranges from a public GitHub repository and then checks if a specified IP address is contained within any of these ranges. This can be used to identify traffic potentially obfuscated by iCloud Private Relay.
This rule detects network connections or URL click events to a list of domains known to be associated with phishing or malware distribution. The rule specifically looks for connections to these domains that also contain certain path segments like '/wlc/', '/load/', or '/success/', which are often indicative of malicious activity or payload delivery. It also broadly checks for any URL click events containing these suspicious domains.
This rule detects multiple stages of activity associated with BaqiyatLock ransomware and Remcos RAT. It identifies the execution of known BaqiyatLock/Remcos files, attempts to bypass User Account Control (UAC) via ms-settings registry hijack, creation of files with the '.bqtlock' extension indicative of BaqiyatLock encryption, and network communication with 'icanhazip.com' for external IP discovery, which is a common reconnaissance step.
This rule detects network connections to specific deep link patterns associated with messaging applications like Telegram, WhatsApp, and Signal. Such deep links can be used in phishing attempts or to initiate actions on a user's device through these applications.
This rule detects the presence of Phoenix malware by identifying known SHA256 hashes of its components or network connections to its command and control (C2) infrastructure. It correlates file events with known malware hashes and network events with known C2 IP addresses.
Correlates phishing email delivery with subsequent communication to attacker-controlled domains.
Detects processes making HTTP/HTTPS requests to localhost on ports 40341 or 40342 for '/metadata'. This pattern can indicate local service discovery, inter-process communication, or potentially malicious activity attempting to interact with local services, possibly for credential access or privilege escalation.
Flags HarborWatch RAT C2 traffic from mysql.exe to known malicious IPs.
Detects S3 bucket lifecycle policies configured for automatic object deletion
Page 98 of 246