Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,879 detections
Filters
Last updated
All Time
Detection languages
2,954
1,378
313
289
239
Contributors
1,807
1,529
1,304
180
173
Categories
20,460
11,847
5,879
5,158
4,866
Platforms
3,747
1,857
1,076
782
160
Products / Services
2,241
1,434
1,273
746
582
MITRE Techniques
2,448
2,151
1,129
937
790
CVEs
19
15
9
7
5
IDS Classtypes
834
334
94
23
20
IDS Protocols
689
276
235
117
23
This rule detects the execution of processes associated with CLI proxy routers (such as CLIProxyAPI or router-for-me) that establish network connections to multiple AI provider APIs (e.g., Anthropic, OpenAI, Google Gemini) within a short window. This pattern is indicative of efforts to bypass rate-limiting or allowlisting mechanisms commonly used by corporate environments to control and audit AI service interactions.
This rule detects the execution of processes associated with CLI proxy routers (such as CLIProxyAPI or router-for-me) that establish network connections to multiple AI provider APIs (e.g., Anthropic, OpenAI, Google Gemini) within a short window. This pattern is indicative of efforts to bypass rate-limiting or allowlisting mechanisms commonly used by corporate environments to control and audit AI service interactions.
This rule detects the execution of processes associated with CLI proxy routers (such as CLIProxyAPI or router-for-me) that establish network connections to multiple AI provider APIs (e.g., Anthropic, OpenAI, Google Gemini) within a short window. This pattern is indicative of efforts to bypass rate-limiting or allowlisting mechanisms commonly used by corporate environments to control and audit AI service interactions.
Detects anomalous TLS traffic characterized by an empty Server Name Indication (SNI) field in the TLS handshake, combined with a high frequency of such connections. This behavior is indicative of certain proxy protocols like Xray VLESS with REALITY, which are often used to evade Deep Packet Inspection (DPI) and traffic shaping policies by disguising C2 or tunneling traffic as legitimate-looking TLS connections.
This rule detects potential Adversary-in-the-Middle (AiTM) activity by monitoring for a two-stage pattern: a SignalR negotiation POST request followed by a WebSocket upgrade request to a suspicious domain structure. The pattern specifically targets lookalike domains featuring a random subdomain of at least 12 alphanumeric characters, which is indicative of ORAX-style AiTM infrastructure.
Detects network connections to command-and-control infrastructure associated with the JeetBot/Twitch Enhanced Viewer malicious browser extension. The rule triggers on connections to known malicious domains or IPs, as well as specific API endpoints on ambiguous domains that are used for exfiltrating Twitch OAuth tokens.
Detects network connections to command-and-control infrastructure associated with the JeetBot/Twitch Enhanced Viewer malicious browser extension. The rule triggers on connections to known malicious domains or IPs, as well as specific API endpoints on ambiguous domains that are used for exfiltrating Twitch OAuth tokens.
Detects outbound TLS traffic behavior consistent with the WaterPlum RAT, characterized by periodic, low-volume connections to non-CDN/cloud providers. The rule identifies potential beaconing activity by monitoring TLS SNI fields against a list of known legitimate service providers and applying a frequency threshold.
Detects network requests to script.google.com that include a specific action parameter indicating potential interaction with Google Apps Script web macros. Attackers often use Google Apps Script as a proxy or webhook for C2 communication, data exfiltration, or to serve malicious payloads due to its reputation and ease of use in bypass scenarios.
Detects network requests to script.google.com that include a specific action parameter indicating potential interaction with Google Apps Script web macros. Attackers often use Google Apps Script as a proxy or webhook for C2 communication, data exfiltration, or to serve malicious payloads due to its reputation and ease of use in bypass scenarios.
Detects persistent, periodic network communication patterns to remote IPs on common ports (443, 8080) that deviate from known administrative remote access tools. The rule identifies processes communicating with a consistent, low-frequency interval, which is highly indicative of automated Command and Control (C2) beaconing behavior.
Detects network traffic associated with the SparroWocky/FamousSparrow C2 framework, including HTTP CONNECT proxy tunneling, SOCKS5 handshakes, and established TLS sessions to known malicious infrastructure.
Detects potential ClickFix-style social engineering attacks where a victim is prompted to execute an encoded PowerShell command (often via copy-paste into a terminal). The rule specifically monitors PowerShell processes initiated by shell environments (explorer.exe, cmd.exe, or WindowsTerminal.exe) that execute encoded, hidden scripts to perform multiple suspicious network requests for files (e.g., .zip, .enc, .bin) from non-standard domains.
This rule monitors DeviceNetworkEvents for any outbound network connections to a specific list of known malicious domains. The rule identifies potential command and control (C2) communication by matching remote URLs against a hardcoded set of domains associated with known threats.
This rule detects network activity associated with the PlugX RAT, specifically monitoring for DNS lookups of 'images.hcgtest.net', direct IP connections to '104.21.77.221', and HTTP requests to '/download/ar96rhqjgw2' using a user-agent containing 'curl'. This pattern indicates a compromised host attempting to download a PlugX archive.
This rule detects activities associated with the AMOS (Atomic macOS Stealer) malware family by monitoring for known malicious file hashes on endpoints and network communication with domains linked to its command-and-control infrastructure.
Detects outbound network traffic to the Telegram Bot API characteristic of malware command and control (C2). This rule specifically identifies Python-based requests using the 'python-requests' user agent performing common Telegram API operations (getUpdates, sendDocument, sendPhoto, getFile) typical of C2 frameworks like HEAVYGRAM or CHOSEN BRICK.
This rule monitors for execution of files with specific SHA256 hashes known to be malicious, and network connections to a known malicious domain associated with Vultr storage. It aggregates file creation, process execution, and network connection events to detect potential threat activity.
Detects outbound HTTP GET requests to a specific C2 domain 'luizestrelhashapr.online' masquerading as CSS file fetches. The request pattern uses a specific path '/google_api/' followed by predefined alphanumeric filenames, consistent with the KREMLIN malware browser extension's C2 polling mechanism.
Detects network connections to known remote tunneling and relay services (e.g., ngrok, Cloudflare Tunnel) initiated by commonly abused LOLBins or processes running from user-writable directories. This behavior is often indicative of an adversary establishing persistent remote access or egress channels for command-and-control communication.
Detects coordinated behavioral signals associated with the CVE-2025-25249 campaign, which deploys the PivotC2 Node.js RAT on FortiGate devices. The rule correlates anomalous inbound CAPWAP (UDP/5246) traffic, Node.js process execution, suspicious JavaScript file writes, and unauthorized access to Fortinet configuration files, followed by long-lived outbound TLS beacons to non-standard ports.
Page 108 of 280