Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,879 detections
Filters
Last updated
All Time
Detection languages
2,954
1,378
313
289
239
Contributors
1,807
1,529
1,304
180
173
Categories
20,460
11,847
5,879
5,158
4,866
Platforms
3,747
1,857
1,076
782
160
Products / Services
2,241
1,434
1,273
746
582
MITRE Techniques
2,448
2,151
1,129
937
790
CVEs
19
15
9
7
5
IDS Classtypes
834
334
94
23
20
IDS Protocols
689
276
235
117
23
This rule detects instances where a process associated with a known StealC command-and-control (C2) IP address subsequently spawns a hidden cmd.exe instance. It correlates network connections to known malicious infrastructure with the creation of hidden command shells within the same device session, specifically looking for common parent processes like web browsers or system utilities.
Detects the use of PowerShell to perform recursive file/directory enumeration within sensitive user profile directories (Desktop, Documents, Downloads, Pictures, OneDrive) immediately followed by a network connection over port 443. This behavior is indicative of potential data staging and exfiltration activity performed by a malicious script or threat actor.
Detects network communication with infrastructure associated with the Transparent Tribe threat group (APT36), including C2 traffic to a known malicious IP and DNS resolution for the sharema128.net domain, which are indicative of CrimsonRAT or Doxc malware activity.
Detects periodic beaconing and C2 communication patterns associated with the RapidRust Golang RAT, attributed to the APT36 (Transparent Tribe) threat group. The rule monitors for specific DNS queries to typosquatted domains, TLS SNI mismatches, and specific HTTP API polling activities commonly used by this malware for C2 tasking.
Detects host-enumeration activities performed by PowerShell processes, including anti-virus queries, system information gathering, network configuration checks, and file/drive enumeration, specifically when correlated with suspicious outbound network connections to common task-runner C2 infrastructure.
This rule identifies successful network connections from local devices to a predefined list of known malicious IP addresses within the last 7 days. Such connections often indicate active communication between a compromised endpoint and adversary-controlled infrastructure.
Detects phishing emails purportedly from Docusign that contain malicious links which redirect users through legitimate identity provider domains (e.g., login.microsoftonline.com, accounts.google.com) before landing on non-trusted infrastructure. This redirect-chain pattern is indicative of NovaCookies Adversary-in-the-Middle (AiTM) delivery, used to facilitate credential or session cookie theft.
Detects high-frequency outbound TCP connection attempts from a WSO2 API Gateway or Traffic Manager host to multiple sensitive internal management and administrative ports (22, 445, 3389, 5985, 5986). This behavior is indicative of a compromised gateway being used for lateral movement across the network.
Detects potential C2 activity associated with MQTTDoor or MatrixDoor malware by monitoring suspicious network traffic patterns. This includes unauthorized processes connecting to MQTT brokers (hivemq.com), non-chat applications interacting with a Matrix homeserver, and geo-location lookups (ip-api.com) occurring shortly after process execution.
Detects outbound network connections from internal devices to a set of known malicious IP addresses (45.151.45.31 and 46.166.79.31) which may indicate command and control communication or other malicious activity.
Detects potential C2 activity associated with MQTTDoor or MatrixDoor malware by monitoring suspicious network traffic patterns. This includes unauthorized processes connecting to MQTT brokers (hivemq.com), non-chat applications interacting with a Matrix homeserver, and geo-location lookups (ip-api.com) occurring shortly after process execution.
Detects unauthorized devices or processes attempting to communicate with the Telegram Bot API (/sendMessage or /sendDocument) and monitors for credential-related terms within the request metadata. This often indicates the use of Telegram as a command-and-control (C2) channel for data exfiltration or credential theft.
Detection of suspicious DNS queries associated with Adversary-in-the-Middle (AiTM) phishing infrastructure. The rules monitor for suspicious subdomains and TLD patterns targeting Microsoft login services, as well as behavioral sequences involving initial Google Ads traffic redirection followed by rapid lookups of suspected malicious or newly registered domains and external geolocation services.
Detects outbound HTTP requests to api.telegram.org containing 'sendMessage' patterns in the URI and suspicious query parameters like 'VIEW' or 'MOBILE'. This behavior is characteristic of malicious scripts or applications using the Telegram Bot API as a command-and-control (C2) or exfiltration channel.
Detects outbound network traffic from internal hosts to the known MoneroOcean mining pool over TLS (port 443). This behavior is indicative of XMRig or other cryptomining software communicating with a mining pool to exchange job data, often a sign of unauthorized resource hijacking.
Detects network traffic consistent with the download of XMRig cryptocurrency miner release tarballs from GitHub, typically used in malicious deployment scenarios including automated cron-triggered installations.
Detects outbound HTTP GET requests containing a specific '/ping' URI pattern and 'h=' query string parameter, characteristic of Redis-based cryptomining botnet C2 heartbeat check-ins.
Detects network traffic (DNS, TLS SNI, and HTTP Host headers) attempting to communicate with infrastructure associated with the EvilTokens Phishing-as-a-Service (PhaaS) platform. This activity is indicative of credential harvesting or adversary-in-the-middle (AiTM) attacks.
Detects network communication with known malicious domains and IP addresses, as well as the presence of known malicious file hashes on the system. The rule correlates network connection events, file creation events, and process creation events against predefined lists of C2 infrastructure and malware indicators.
Detects the creation of a 'config.ini' file within the 'UBP-Asset' directory, correlated with subsequent FTP network activity from known associated binaries (UBPUpdater.exe, UBPPatch.Psh, cmd.exe, or UBP.exe). This behavioral pattern is indicative of Quasar RAT being delivered or updated through a fraudulent install path.
Detects the creation of a 'config.ini' file within the 'UBP-Asset' directory, correlated with subsequent FTP network activity from known associated binaries (UBPUpdater.exe, UBPPatch.Psh, cmd.exe, or UBP.exe). This behavioral pattern is indicative of Quasar RAT being delivered or updated through a fraudulent install path.
Page 100 of 280