Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,879 detections
Filters
Last updated
All Time
Detection languages
2,954
1,378
313
289
239
Contributors
1,807
1,529
1,304
180
173
Categories
20,460
11,847
5,879
5,158
4,866
Platforms
3,747
1,857
1,076
782
160
Products / Services
2,241
1,434
1,273
746
582
MITRE Techniques
2,448
2,151
1,129
937
790
CVEs
19
15
9
7
5
IDS Classtypes
834
334
94
23
20
IDS Protocols
689
276
235
117
23
Detects outbound web requests directed at public NPM mirrors and CDNs (unpkg, npmmirror, yarnpkg, jsdelivr) that contain strings matching known malicious package names associated with the 'Beamglea/ClickFix' campaign. This activity is typically indicative of a victim visiting a deceptive Cloudflare CAPTCHA phishing page designed to execute malicious scripts in the browser.
Detects anomalous outbound network connections from the Grafana MCP (Model Context Protocol) server process to internal private IP address ranges. The rule compares current network activity against a 14-day baseline to filter out known data sources, identifying potentially unauthorized lateral movement or internal network probing via server-side request forgery (SSRF) vulnerabilities.
KQL Query from file: grafana-mcp-server-mediated-probing-of-internal-ip-ranges-lateral-movement.kql
Detects the download of ZIP files with filenames matching known phishing patterns associated with NFe (Nota Fiscal Eletrônica) campaigns, correlated with access to specific malicious or suspicious download URLs within a 15-minute window.
Detects the execution of a reverse shell on Linux systems utilizing a common technique involving mkfifo (named pipe) to redirect input/output for a shell session to a netcat network connection. This is often used by attackers to gain interactive remote access to a compromised host.
Detects the suspicious execution of cmd.exe with piped stdio handles (indicative of a reverse shell) initiated by non-standard parent processes associated with the GRAYRABBIT malware, correlated with an immediate outbound network connection from the same process.
Detects emails delivering links to IronToll government-impersonation traffic-fine/payment portals (Egyptian and Moroccan justice-ministry lures), correlated with Safe Links click-through telemetry for the same URLs.
This rule detects unauthorized or suspicious automated scraping behavior by identifying periodic, non-interactive tasks that perform high-volume outbound network requests to multiple external hosts. It specifically filters for processes launched via scheduling mechanisms (Task Scheduler, cron) that exhibit indicators of anti-bot or proxy-rotation bypass techniques (such as usage of headless browser tools or proxy-related keywords in command lines). The rule is tuned to ignore legitimate system maintenance, update, and monitoring processes.
This rule detects potential Server-Side Request Forgery (SSRF) activity where web application or runtime processes attempt to access the Cloud Instance Metadata Service (IMDS) or container task metadata endpoints. By monitoring network connections and application logs, the rule filters out known legitimate metadata clients and identifies suspicious processes frequently associated with web-based vulnerabilities that are repeatedly querying sensitive metadata paths.
This rule detects potential Server-Side Request Forgery (SSRF) attempts targeting specific UK council ModernGov websites (e.g., Lambeth, Wandsworth, Southwark). It looks for outbound HTTP requests from non-browser clients (specifically identifying 'Ruby' in the User-Agent string) to these specific gov.uk domains, with a threshold to catch repeated attempts.
This rule detects potential Server-Side Request Forgery (SSRF) attempts targeting specific UK council ModernGov websites (e.g., Lambeth, Wandsworth, Southwark). It looks for outbound HTTP requests from non-browser clients (specifically identifying 'Ruby' in the User-Agent string) to these specific gov.uk domains, with a threshold to catch repeated attempts.
Detects instances where PowerShell is used to download an executable named 'svchost.exe' from an external IP address (103.86.86.244). The rule monitors for network connections to this IP, file creation events matching specific download patterns in fonts directories, and direct command-line arguments involving the suspicious IP and file path, indicating potential malware dropper activity.
Detects an HTTP POST request targeting the host 'tt.yeyoujs.com' at the URI path '/api/agent/enroll', containing a specific Python aiohttp User-Agent string. This pattern is characteristic of a C2 agent attempting to register or enroll with an external command-and-control server.
Detects outbound network traffic from internal hosts to known MeshCentral Command and Control (C2) infrastructure. MeshCentral is legitimate remote monitoring and management (RMM) software that is frequently abused by threat actors to maintain persistent remote access to victim environments. This rule monitors for established TCP connections on specific ports associated with MeshCentral C2 nodes.
Detects outbound network traffic from internal hosts to known MeshCentral Command and Control (C2) infrastructure. MeshCentral is legitimate remote monitoring and management (RMM) software that is frequently abused by threat actors to maintain persistent remote access to victim environments. This rule monitors for established TCP connections on specific ports associated with MeshCentral C2 nodes.
Detects the creation, modification, or execution of a hidden file named '.rc' located in '/usr/local/bin/'. This behavior is suspicious as it may indicate an attempt to establish persistence or run malicious scripts via hidden configuration files, especially when performed by non-standard installers.
Detects the creation, modification, or execution of a hidden file named '.rc' located in '/usr/local/bin/'. This behavior is suspicious as it may indicate an attempt to establish persistence or run malicious scripts via hidden configuration files, especially when performed by non-standard installers.
Detects instances where internal devices access the 3BB sales portal (agent.3bb.co.th) while demonstrating signs of compromise. The rule correlates the portal access with recent network activity involving identified MeshCentral attacker infrastructure (ayuthayatech.com or 92.63.180.133) and further filters for behavioral anomalies such as off-hours access, the use of non-standard browser processes, or the use of unexpected service accounts.
Detects instances where internal devices access the 3BB sales portal (agent.3bb.co.th) while demonstrating signs of compromise. The rule correlates the portal access with recent network activity involving identified MeshCentral attacker infrastructure (ayuthayatech.com or 92.63.180.133) and further filters for behavioral anomalies such as off-hours access, the use of non-standard browser processes, or the use of unexpected service accounts.
Detects execution of the JITTERLY Linux backdoor masquerading as 'configd' (with its -nodel fallback flag) and/or beaconing to its hardcoded C2 domain (s2.981666.xyz:8082), matching Red Heron's observed tradecraft.
Detects execution of the JITTERLY Linux backdoor masquerading as 'configd' (with its -nodel fallback flag) and/or beaconing to its hardcoded C2 domain (s2.981666.xyz:8082), matching Red Heron's observed tradecraft.
Page 139 of 280