Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,879 detections
Filters
Last updated
All Time
Detection languages
2,954
1,378
313
289
239
Contributors
1,807
1,529
1,304
180
173
Categories
20,462
11,849
5,879
5,158
4,866
Platforms
3,747
1,857
1,076
782
160
Products / Services
2,241
1,434
1,273
746
582
MITRE Techniques
2,448
2,151
1,129
937
790
CVEs
19
15
9
7
5
IDS Classtypes
834
334
94
23
20
IDS Protocols
689
276
235
117
23
Detects network handshake patterns associated with the Fast Reverse Proxy (FRP) client, specifically identifying outbound traffic containing identifiers used in common FRP reverse tunnel configurations. This behavior is indicative of unauthorized remote access tools or tunneling software establishing a connection to an external command-and-control server.
This rule detects network traffic indicative of the HEAVYGRAM malware beaconing to Telegram's API. It identifies HTTP requests to api.telegram.org containing specific URI strings and parameters, which suggests the bot is performing check-in activities or sending status updates via a Telegram bot channel.
Detects network communications associated with the MovieReaper C2 framework. The rule identifies HTTP requests to specific fake cloud UI assets, connections to the domain 'deadhub.org', and fallback communication attempts to a known hardcoded IP address (193.23.118.155).
Detects lateral movement activity where a host identified as running the Langflow framework attempts to connect to internal MySQL (3306) or Nacos (8848) services while utilizing root credentials, potentially indicating an attacker pivoting from a compromised application server.
Detects lateral movement activity where a host identified as running the Langflow framework attempts to connect to internal MySQL (3306) or Nacos (8848) services while utilizing root credentials, potentially indicating an attacker pivoting from a compromised application server.
Detects network traffic indicating a HEAVYGRAM malware instance communicating with the Telegram Bot API. This is identified by monitoring encrypted TLS traffic to api.telegram.org, which is a common technique used by malware to establish a command-and-control channel using legitimate web services.
Detects network traffic indicating a HEAVYGRAM malware instance communicating with the Telegram Bot API. This is identified by monitoring encrypted TLS traffic to api.telegram.org, which is a common technique used by malware to establish a command-and-control channel using legitimate web services.
Detects network traffic indicating a HEAVYGRAM malware instance communicating with the Telegram Bot API. This is identified by monitoring encrypted TLS traffic to api.telegram.org, which is a common technique used by malware to establish a command-and-control channel using legitimate web services.
Detects outbound network traffic to the Telegram Bot API (api.telegram.org) indicative of long-polling command and control (C2) communication. This behavior is associated with the HEAVYGRAM malware and its use of Telegram as a C2 channel.
Detects outbound HTTP requests to the 'itorrents.org' repository for files with the '.torrent' extension, which may indicate the retrieval of malicious payload components associated with the MovieReaper supply chain campaign.
Detects network activity associated with the Handala Loader malware, specifically identifying attempts to download disguised shellcode or malicious payloads from deadhub.org and associated infrastructure. The rule monitors for specific URI patterns mimicking UI assets and fallback communication attempts to known C2 IP addresses.
Detects indicators of the MovieReaper loader, specifically the downloading of shellcode fragments disguised as image assets from known malicious C2 infrastructure, and the masquerading of a malicious binary as 'msedge.exe' within the Windows Telemetry folder for persistence. The rule specifically targets the loader's behavior of using PEB Ldr traversal to resolve APIs and evade hooking-based security controls.
This rule detects outbound TLS connections from the internal network to external destinations where the server certificate is self-signed. It identifies connections where both the certificate issuer and subject common names (CN) are present, which is often indicative of opportunistic encryption used by C2 infrastructure or malicious payloads. The rule includes a threshold to reduce noise by limiting alerts for the same source over a specific window.
Detects outbound network traffic attempting to reach known public DNS-over-HTTPS (DoH) resolvers. This rule monitors for specific SNI fields in TLS handshakes or HTTP/2 :authority headers that indicate communication with common third-party DoH services, which may be used to bypass internal DNS filtering and monitoring controls.
Detects DNS queries and TLS SNI traffic directed towards domains identified as part of Storm-3121/Storm-3032 phishing campaigns. These domains are themed around passkey management and single sign-on (SSO) services, likely intended for credential harvesting.
This rule detects DNS queries and network connections to a curated list of domains identified as malicious. It correlates events from DNS logs and device network logs to identify potential command-and-control (C2) or malicious infrastructure interaction.
Detects outbound network connections over TCP port 445 directed toward common internal IP address ranges (RFC 1918) by processes other than standard system binaries. This pattern is characteristic of SMB network scanning or lateral movement activities, such as those used by the DragonForce locker ransomware to discover target hosts within a network.
This rule monitors for outbound network connections to domains and IP addresses associated with known phishing, loader, and C2 infrastructure, including specific ClickFix patterns.
Detects potential exfiltration activity by identifying HTTP POST/PUT requests to known suspicious domains, including specific operator-controlled hosts and anonymous file sharing services, as well as the use of HTTP Range headers for bulk API data exfiltration.
Detects a network connection to potentially malicious infrastructure or non-standard ports following a request to ipify.org, which is commonly used for external IP reconnaissance by malware and C2 frameworks.
Detects repeated, non-interactive requests to the Google Sheets Visualization API (gviz/tq) originating from common web browsers. This pattern is indicative of a malicious browser extension attempting to reconstruct or reinject payloads when a user visits specific targeted websites.
Page 127 of 280