Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,879 detections
Filters
Last updated
All Time
Detection languages
2,954
1,378
313
289
239
Contributors
1,807
1,529
1,304
180
173
Categories
20,460
11,847
5,879
5,158
4,866
Platforms
3,747
1,857
1,076
782
160
Products / Services
2,241
1,434
1,273
746
582
MITRE Techniques
2,448
2,151
1,129
937
790
CVEs
19
15
9
7
5
IDS Classtypes
834
334
94
23
20
IDS Protocols
689
276
235
117
23
This rule detects command line patterns associated with common Impacket tools (wmiexec, psexec, smbexec) executed via Windows processes (cmd.exe, powershell.exe) or via network connections to ports 445 and 135 initiated by Python processes. These tools are frequently used by adversaries for lateral movement, remote service execution, and command execution on compromised systems.
This rule detects suspicious usage of certutil.exe for file downloading or the execution of the Chisel proxy tool, specifically targeting connections or authentication towards the suspicious IP address 69.48.228.86. This behavior is indicative of C2 communication or ingress tool transfer.
Detects outbound network traffic consistent with the Chisel proxy/tunneling tool establishing a connection to an external VPS associated with the Miku threat actor. The rule monitors for established TCP connections to a specific remote IP address on port 443, utilizing a threshold to reduce noise by ensuring multiple connection attempts occur.
Detects the initialization of an FRP (Fast Reverse Proxy) protocol connection, characterized by a specific 3-byte null sequence followed by the 'frp' string marker in the packet header. This pattern is often associated with the RatHat malware using FRP to establish covert reverse tunnels for command-and-control communication.
This rule detects potentially malicious activity by monitoring for a specific executable file name ('msedge.exe') located in a non-standard path ('ProgramData'), as well as network connections to a known malicious IP address ('193.23.118.155') and DNS requests for a domain associated with suspicious activity ('deadhub.org').
This rule detects the execution of a file with a suspicious media-themed filename (e.g., related to 1080p, BluRay, etc.) from a known BitTorrent client process, followed by an immediate network connection to a known malicious C2 IP address or domain within a 10-minute window. This behavior is indicative of a user downloading and executing a malicious file disguised as pirated media.
This rule detects the execution of a specific known malicious file (identified by MD5 hash A0B13781EDD7CFDAB13D79AFFF3C83C1) followed by an outbound network connection to a suspicious IP address (193.23.118.155) or domain (deadhub.org) within a 10-minute window. This behavior is indicative of a malicious loader establishing a command and control (C2) channel.
This rule detects potential credential exfiltration by the RatHat malware, which attempts to upload 'cert.pem' and 'private.key' files to a remote server using a POST request to '/api/adbk/upload'.
Detects network beaconing and command-and-control (C2) communication patterns consistent with the HEAVYGRAM backdoor, which utilizes the Telegram Bot API for remote interaction. This rule monitors for encrypted SNI traffic directed at api.telegram.org, as well as specific HTTP polling and command execution patterns (e.g., /getUpdates, /bot<token>/) indicating automated interaction with a Telegram bot controlled by an adversary.
Detects the GHAPPIER loader pattern: a top-level require('https').get() call to the primevector-app924560.vercel.app C2 that evals the response, disguised inside a large benign-looking JavaScript benchmark file
Detects the GHAPPIER loader pattern: a top-level require('https').get() call to the primevector-app924560.vercel.app C2 that evals the response, disguised inside a large benign-looking JavaScript benchmark file
Detects the GHAPPIER loader pattern: a top-level require('https').get() call to the primevector-app924560.vercel.app C2 that evals the response, disguised inside a large benign-looking JavaScript benchmark file
This rule monitors for network connections to known malicious domains and IP addresses, as well as the presence or execution of files with specific SHA256 hashes known to be associated with threat activity. The indicators focus on Vercel-hosted domains and specific file hashes linked to recent campaign activity.
This rule detects outbound TLS connections from server-role assets to 'devtunnels.ms', a service that facilitates temporary public tunnels to internal services. This behavior is flagged as a potential indicator of unauthorized command-and-control (C2) tunneling, particularly when originating from critical infrastructure like Domain Controllers or Exchange OWA servers.
Detection of suspicious network traffic directed toward Slack APIs, characterized by the use of hardcoded Slack bot tokens and specific communication patterns associated with the 'indexed-btree' npm malware family, indicating potential C2 communication or data exfiltration.
Detects network traffic associated with the malicious npm package 'indexed-btree', which uses the Telegram Bot API to exfiltrate data. The rules monitor for connections to api.telegram.org via HTTPS and identify specific hardcoded bot tokens and chat IDs associated with the malicious campaign.
Detects network traffic attempting to use 'dl.google.com' as the TLS Server Name Indication (SNI) header, which is a common indicator of Xray-core C2 tunneling or obfuscation. This rule identifies traffic attempting to masquerade as legitimate Google traffic and should be correlated with endpoint process information to confirm the initiating process is not a browser or authorized Google-related application.
Detects established SSH network connections originating from the internal network to external destinations on ports other than the standard port 22. This behavior is often associated with unauthorized SSH tunneling or command-and-control (C2) communication intended to bypass standard firewall egress filtering.
This rule monitors network traffic and internal logs for connections to known malicious IP addresses or domain names associated with 'ClickFix' social engineering campaigns (often impersonating services like HBO Max). The logic explicitly filters out known threat intelligence scanners and security researcher probes. It performs correlation by requiring domain/message matches for generic IP-based alerts to reduce noise, and aggregates events per host over 15-minute windows to produce consolidated alerts.
Detects network communication with domains and IP addresses known to be associated with 'ClickFix' social engineering campaigns (specifically those masquerading as legitimate HBO Max or macOS related updates). The rule applies a strict correlation between observed malicious IP traffic and specific DNS requests to reduce noise from IP address reuse or threat intelligence feed probes, while also excluding known security-related processes.
Detects network traffic matching a list of known malicious domains and IP addresses observed in CommonSecurityLog events, tightened to reduce noise from scanners/TI feeds, sinkholed infrastructure, and generic reused IPs by requiring domain-specific selectors and deduplicating repeated matches per host.
Page 112 of 280