Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,879 detections
Filters
Last updated
All Time
Detection languages
2,954
1,378
313
289
239
Contributors
1,807
1,529
1,304
180
173
Categories
20,462
11,849
5,879
5,158
4,866
Platforms
3,747
1,857
1,076
782
160
Products / Services
2,241
1,434
1,273
746
582
MITRE Techniques
2,448
2,151
1,129
937
790
CVEs
19
15
9
7
5
IDS Classtypes
834
334
94
23
20
IDS Protocols
689
276
235
117
23
Detects network traffic on TCP port 3308 consistent with VectraRAT beaconing, utilizing MessagePack-over-TCP. The rule monitors for established connections to external networks with specific stream size and content characteristics typical of this C2 communication channel.
Detects network traffic on TCP port 3308 consistent with VectraRAT beaconing, utilizing MessagePack-over-TCP. The rule monitors for established connections to external networks with specific stream size and content characteristics typical of this C2 communication channel.
Detects network traffic on TCP port 3308 consistent with VectraRAT beaconing, utilizing MessagePack-over-TCP. The rule monitors for established connections to external networks with specific stream size and content characteristics typical of this C2 communication channel.
Detects HTTP GET requests to '/api.php?t=' containing a 13-digit timestamp identifier, followed by a response body containing 'download_link'. This pattern is indicative of the SilverFox malware relaying instructions or stage-two payload delivery.
Detects network traffic associated with SloppyRAT C2 beacons by identifying specific user-agent strings ('CommandExecutor/1.0', 'Mozilla/5.0 (compatible; DLLMemLoader/1.0)') or anomalous API path requests containing 'X-API-Key' or 'Authorization: Bearer' headers.
Detects network connections initiated by common web browsers to a specific LinodeObjects domain or any subdomains within the linodeobjects.com infrastructure, which may indicate command and control communication or data exfiltration via legitimate cloud storage providers.
Detects the early-stage HTTP beaconing behavior of the CRPx0 ClickFix social engineering campaign. This rule monitors for specific request patterns to 'relay.php' that include session identifiers and indicators of the lure, such as 'WINUPDATE_TRACK' or 'CAPTCHA_WEB'. This signal represents the initial interaction with the malicious infrastructure before the victim is coerced into running commands.
This rule detects network connections to known CRPx0 relay or Command and Control (C2) IP addresses, as well as DNS requests to domains associated with the CRPx0 infrastructure, including relay nodes, leak sites, and TLD-rotation services.
Detects network communication with a known CRPx0 clearnet relay (207.180.29.236:8080) coupled with evidence of local Tor SOCKS5 proxy activity (ports 9050/9150) on the same host, indicating the bridging of traffic to an onion-hosted C2 server.
Detects a host making 3 or more outbound connections within 5 minutes to AWS-hosted IP addresses known to host NJRAT C2 infrastructure from the GTA6 lure campaign, consistent with periodic RAT beaconing rather than a one-off incidental connection.
Detects a host making 3 or more outbound connections within 5 minutes to AWS-hosted IP addresses known to host NJRAT C2 infrastructure from the GTA6 lure campaign, consistent with periodic RAT beaconing rather than a one-off incidental connection.
Detects instances where the outbound byte count to external (non-private) IP addresses for a source host significantly exceeds its historical hourly baseline. This detection is designed to identify potential data exfiltration stages occurring after system or network compromise.
Detects instances where the outbound byte count to external (non-private) IP addresses for a source host significantly exceeds its historical hourly baseline. This detection is designed to identify potential data exfiltration stages occurring after system or network compromise.
This rule identifies potential phishing emails that impersonate OneDrive sharing notifications. It correlates email messages containing keywords typically associated with document sharing (e.g., 'OneDrive', 'shared', 'file') with subsequent user URL clicks. Crucially, the rule filters for clicks to domains that are not explicitly related to legitimate OneDrive, SharePoint, or 1drv.ms hosting, indicating a potential attempt to lure users to a malicious third-party site under the guise of file sharing.
This rule monitors for web server exploit attempts (indicated by patterns like JNDI lookups or SQL injection sequences in URI/cookie data) that correlate with a surge in server-side errors (400+ status codes) and subsequent anomalous process creation or outbound network connections from the web server process.
This rule detects potential exploitation or unauthorized interaction with an HAProxy service. It correlates process execution on Linux systems involving the HAProxy PID file with subsequent network traffic containing the suspicious string 'writeservice_info' within a one-hour window.
Detects network activity associated with the CurlRAT malware during its beaconing phase. The rule monitors for process command line arguments containing 'writeservice_info' or 'atd_get_system_info', which indicate the collection of system information, and correlates this with network connections that potentially transmit a ~10KB data payload characteristic of its check-in mechanism.
Detects the specific execution pattern associated with CurlRAT, where common Linux daemons (crond, atd, agetty, polkitd) perform an outbound network connection and subsequently spawn an interactive shell (sh, bash, dash) as the root user within a 5-minute window.
Detects processes that access sensitive browser credential or cookie files (e.g., Login Data, Cookies) followed by network activity within a 10-minute window, which is a common behavior pattern of information-stealing malware such as Amatera or ACR Stealer.
This rule detects network connections or DNS queries to known phishing domains (typosquatted Microsoft login domains), DeadDrop Resolver domains, and suspicious HTML payloads served from common CDN/package hosting sites (e.g., unpkg.com, npmmirror.com, cdn.jsdelivr.net, yarnpkg.com). These patterns are indicative of initial access attempts via phishing or the secondary stage of malware C2 communication.
Detects instances where an Artifactory process or user accesses highly sensitive configuration files (system.yaml, join.key) or API endpoints containing configuration data, followed closely (within 15 minutes) by an outbound network connection to a non-standard or external destination. This pattern is indicative of a potential credential theft attempt targeting the Artifactory join key, which is used to authenticate Artifactory nodes in a cluster, followed by potential data exfiltration or C2 communication using these credentials.
Page 132 of 280