Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,879 detections
Filters
Last updated
All Time
Detection languages
2,954
1,378
313
289
239
Contributors
1,807
1,529
1,304
180
173
Categories
20,462
11,849
5,879
5,158
4,866
Platforms
3,747
1,857
1,076
782
160
Products / Services
2,241
1,434
1,273
746
582
MITRE Techniques
2,448
2,151
1,129
937
790
CVEs
19
15
9
7
5
IDS Classtypes
834
334
94
23
20
IDS Protocols
689
276
235
117
23
This rule monitors for outbound network connections to domains and IP addresses associated with known phishing, loader, and C2 infrastructure, including specific ClickFix patterns.
This rule identifies potential command and control (C2) activity by correlating DNS over HTTPS (DoH) requests initiated by non-browser or unsigned processes with subsequent network connections to a known malicious C2 domain (gw.proxyvector.cc) within a 15-minute window.
Detects outbound HTTP POST requests to suspicious .ru domains and DNS queries for these domains, indicative of C2 beaconing activity likely associated with a supply chain compromise affecting the Pub.dev ecosystem.
Detects network connection attempts to specific external domains associated with suspicious JavaScript payloads. The rule filters for specific file paths (e.g., mpackage.js, bsc-loader.js) linked to known malicious or suspicious URL patterns on cdn.claritydelivr.com, rcrsinnovations.com, konverto.in, and cdn.api-middle-connect.com, which may indicate C2 beaconing or malware infection.
This rule identifies potential command and control (C2) activity by correlating DNS over HTTPS (DoH) requests initiated by non-browser or unsigned processes with subsequent network connections to a known malicious C2 domain (gw.proxyvector.cc) within a 15-minute window.
Detects network connection attempts or established connections to a specific remote IP (103.141.13.26) on UDP port 3479. This pattern is often associated with command and control infrastructure or unauthorized data communication.
This rule monitors for DNS queries, HTTP requests to '/cli/check', and TLS SNI traffic directed towards the domain 'coder-infra.com', which is associated with a suspected compromise of a Coder registry.
Detects the execution of Terraform commands (init, apply, plan) that interact with the 'registry.coder.com' domain, or direct network connections to the associated infrastructure. This may indicate the use of unauthorized or compromised Infrastructure-as-Code (IaC) modules or malicious supply chain activity involving Terraform configurations.
Detects network activity (TCP, DNS, and HTTP) directed towards a known rogue infrastructure IP identified in a supply chain compromise affecting the Coder registry. The rule alerts on attempts to resolve or communicate with this infrastructure to download backdoored Terraform modules or interact with malicious resources.
Detects network activity (TCP, DNS, and HTTP) directed towards a known rogue infrastructure IP identified in a supply chain compromise affecting the Coder registry. The rule alerts on attempts to resolve or communicate with this infrastructure to download backdoored Terraform modules or interact with malicious resources.
Detects the initialization of containerized LLM-based gateway services (e.g., litellm, ollama) followed closely in time by high-volume network traffic containing suspicious web injection payloads (e.g., SQLi, XSS, SSRF). The rule correlates process execution events for container launches with network activity originating from the same device to identify potential unauthorized or unsupervised automated exploitation.
Detects the initialization of containerized LLM-based gateway services (e.g., litellm, ollama) followed closely in time by high-volume network traffic containing suspicious web injection payloads (e.g., SQLi, XSS, SSRF). The rule correlates process execution events for container launches with network activity originating from the same device to identify potential unauthorized or unsupervised automated exploitation.
This rule detects potential command and control (C2) activity associated with the CurlRAT malware. It monitors for both the execution of 'curl' or 'curl.exe' processes with command lines containing known C2 domains, and network traffic originating from internal devices directed toward those same domains.
Detects network activity communicating with Google Drive domains (drive.google.com and www.googleapis.com). This rule monitors outbound traffic, which may indicate the use of Google Drive as a command-and-control (C2) channel or for unauthorized data exfiltration.
Detects network connections from common Linux system binaries (agetty, atd, polkitd, crond) to identified suspicious external domains. These binaries typically do not communicate with external internet services, suggesting potential process masquerading or compromise.
Detects high-frequency PUT requests to known S3-compatible cloud storage providers using the rclone user-agent, which is a common indicator of bulk data exfiltration or unauthorized backup activity by attackers.
Detects high-frequency PUT requests to known S3-compatible cloud storage providers using the rclone user-agent, which is a common indicator of bulk data exfiltration or unauthorized backup activity by attackers.
Detects high-frequency PUT requests to known S3-compatible cloud storage providers using the rclone user-agent, which is a common indicator of bulk data exfiltration or unauthorized backup activity by attackers.
This rule detects the use of the curl command-line utility to communicate with a specific IP address (162.0.239.85) on port 3000, specifically targeting a path associated with 'mac' tasks. This pattern is indicative of a downloader or a staged payload retrieval from an external command-and-control server.
This rule detects suspicious activity associated with JSCeal proxy handlers. It identifies Node.js or Electron processes running from non-standard, user-writable directories (such as AppData, ProgramData, or Temp folders) that actively delete or modify browser cookie files within standard web browser profile paths, often indicative of session hijacking or data tampering.
Detects outbound web requests directed at public NPM mirrors and CDNs (unpkg, npmmirror, yarnpkg, jsdelivr) that contain strings matching known malicious package names associated with the 'Beamglea/ClickFix' campaign. This activity is typically indicative of a victim visiting a deceptive Cloudflare CAPTCHA phishing page designed to execute malicious scripts in the browser.
Page 147 of 280