Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,879 detections
Filters
Last updated
All Time
Detection languages
2,954
1,378
313
289
239
Contributors
1,807
1,529
1,304
180
173
Categories
20,460
11,847
5,879
5,158
4,866
Platforms
3,747
1,857
1,076
782
160
Products / Services
2,241
1,434
1,273
746
582
MITRE Techniques
2,448
2,151
1,129
937
790
CVEs
19
15
9
7
5
IDS Classtypes
834
334
94
23
20
IDS Protocols
689
276
235
117
23
Detects outbound network traffic consistent with the Chisel proxy/tunneling tool establishing a connection to an external VPS associated with the Miku threat actor. The rule monitors for established TCP connections to a specific remote IP address on port 443, utilizing a threshold to reduce noise by ensuring multiple connection attempts occur.
Bigbear V2 Ioc Hunt
Sigma
CloudSEK researchers uncovered BigBear 2.0, a global Microsoft 365 phishing-as-a-service operation targeting hundreds of organizations across 40+ countries. The investigation exposed the attacker’s admin panel, affiliate network, phishing infrastructure, and thousands of stolen credentials and session cookies, revealing how modern AiTM attacks can hijack authenticated sessions even after MFA.
CloudSEK researchers uncovered BigBear 2.0, a global Microsoft 365 phishing-as-a-service operation targeting hundreds of organizations across 40+ countries. The investigation exposed the attacker’s admin panel, affiliate network, phishing infrastructure, and thousands of stolen credentials and session cookies, revealing how modern AiTM attacks can hijack authenticated sessions even after MFA.
CloudSEK researchers uncovered BigBear 2.0, a global Microsoft 365 phishing-as-a-service operation targeting hundreds of organizations across 40+ countries. The investigation exposed the attacker’s admin panel, affiliate network, phishing infrastructure, and thousands of stolen credentials and session cookies, revealing how modern AiTM attacks can hijack authenticated sessions even after MFA.
Detects initial beaconing registration behavior associated with the CLEANGULP malware, specifically identifying outbound HTTP POST requests to the '/beacon/pre-register' URI path. The rule monitors network device events and can identify this activity even if the adversary switches C2 infrastructure, provided the specific beaconing URI remains constant.
Detects the CLEANGULP backdoor (masquerading as MicrosoftIME.exe) spawning administrative or discovery-related child processes (such as cmd.exe, powershell.exe, or wmic.exe) that are temporally associated with recent network activity, suggesting command execution tasks received from a C2 server.
This rule monitors for interactions with known malicious files (by SHA256 hash), connections to confirmed C2 infrastructure (specific IP address and domains), or requests to known malicious URLs. It aggregates indicators across file, process, network, and web browsing telemetry to identify potential threats or compromised systems communicating with known attacker infrastructure.
This rule monitors for interactions with known malicious files (by SHA256 hash), connections to confirmed C2 infrastructure (specific IP address and domains), or requests to known malicious URLs. It aggregates indicators across file, process, network, and web browsing telemetry to identify potential threats or compromised systems communicating with known attacker infrastructure.
This rule monitors for interactions with known malicious files (by SHA256 hash), connections to confirmed C2 infrastructure (specific IP address and domains), or requests to known malicious URLs. It aggregates indicators across file, process, network, and web browsing telemetry to identify potential threats or compromised systems communicating with known attacker infrastructure.
Detects unauthorized exfiltration of sensitive information, such as camera credentials or location data, directed to the Telegram Bot API as part of the 'Operation CameraSwarm' campaign.
Detects unauthorized exfiltration of sensitive information, such as camera credentials or location data, directed to the Telegram Bot API as part of the 'Operation CameraSwarm' campaign.
This rule monitors for known malicious file hashes, IP addresses, C2 domains, and specific URL markers associated with identified threat activity. It consolidates multiple detection vectors including file activity, process execution, network connections, and DNS queries to identify compromised devices communicating with attacker-controlled infrastructure.
Detects outbound network connections from devices to specific suspicious domains identified in the detection logic. This rule monitors for connections to 'ns2.asiainfo.it.com' and 'www.wordcheck.info', which may be indicative of malware communication, command and control, or malicious web activity.
Detects network and DNS activity associated with the SideCopy threat group, specifically monitoring for connections to known C2 domains, C2 IP addresses, or the usage of port 5863 typically associated with the ReverseRAT backdoor.
This rule detects periodic network beaconing patterns consistent with BabylonRAT malware. It flags established TCP connections to external networks that occur at a frequency exceeding 5 connections within a 300-second window, which may indicate a C2 check-in mechanism. Due to the heuristic nature of this detection, it is recommended to tune the threshold and correlate with payload analysis or entropy inspection to reduce noise.
This rule detects periodic network beaconing patterns consistent with BabylonRAT malware. It flags established TCP connections to external networks that occur at a frequency exceeding 5 connections within a 300-second window, which may indicate a C2 check-in mechanism. Due to the heuristic nature of this detection, it is recommended to tune the threshold and correlate with payload analysis or entropy inspection to reduce noise.
This rule performs a hunting activity across multiple telemetry sources (Network, Email, Endpoint) to detect known indicators of compromise (IOCs) associated with Anthropic threat intelligence reporting (September 2026). It looks for specific malware file names, command-line patterns, service installations, phishing email addresses, and C2 communication URLs.
This rule identifies potential malicious activity by detecting the presence of known malicious file hashes (SHA256 and MD5) on endpoints and monitoring for DNS queries or network connections to a known malicious staging domain (yapw.life). The detection correlates file execution, file activity, and network communication to identify stages of an attack such as malware installation or C2 communication.
This rule identifies potential malicious activity by detecting the presence of known malicious file hashes (SHA256 and MD5) on endpoints and monitoring for DNS queries or network connections to a known malicious staging domain (yapw.life). The detection correlates file execution, file activity, and network communication to identify stages of an attack such as malware installation or C2 communication.
This rule identifies potential malicious activity by detecting the presence of known malicious file hashes (SHA256 and MD5) on endpoints and monitoring for DNS queries or network connections to a known malicious staging domain (yapw.life). The detection correlates file execution, file activity, and network communication to identify stages of an attack such as malware installation or C2 communication.
This rule identifies potential malicious activity by detecting the presence of known malicious file hashes (SHA256 and MD5) on endpoints and monitoring for DNS queries or network connections to a known malicious staging domain (yapw.life). The detection correlates file execution, file activity, and network communication to identify stages of an attack such as malware installation or C2 communication.
Page 105 of 280