Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,879 detections
Filters
Last updated
All Time
Detection languages
2,954
1,378
313
289
239
Contributors
1,807
1,529
1,304
180
173
Categories
20,462
11,849
5,879
5,158
4,866
Platforms
3,747
1,857
1,076
782
160
Products / Services
2,241
1,434
1,273
746
582
MITRE Techniques
2,448
2,151
1,129
937
790
CVEs
19
15
9
7
5
IDS Classtypes
834
334
94
23
20
IDS Protocols
689
276
235
117
23
This rule detects HTTP requests directed towards known malvertising domains that serve trojanized MSI installers. The rule identifies specific suspicious hostnames and a common URL pattern used for payload delivery.
This rule detects high volumes of network traffic originating from processes other than common web browsers (chrome, msedge, firefox) to specific edge computing and logging infrastructure (ingest.sentry.io, workers.dev, pages.dev). This behavior is indicative of non-browser processes, potentially malicious implants or scripts, using legitimate cloud-based edge services as command-and-control (C2) infrastructure or for data exfiltration.
This rule detects processes initiating network connections to standard POP3 (110, 995) and IMAP (143, 993) ports that are not identified as trusted, well-known mail clients. By filtering out connections from common email application paths and local IP ranges, it aims to identify potentially malicious processes, scripts, or non-standard tools attempting to perform email collection or exfiltration directly from mail servers.
This rule detects high volumes of network traffic originating from processes other than common web browsers (chrome, msedge, firefox) to specific edge computing and logging infrastructure (ingest.sentry.io, workers.dev, pages.dev). This behavior is indicative of non-browser processes, potentially malicious implants or scripts, using legitimate cloud-based edge services as command-and-control (C2) infrastructure or for data exfiltration.
This rule detects the installation of a new VS Code extension occurring in close temporal proximity to network communication with the official VS Code marketplace or unpkg domains. This pattern is designed to surface potential supply chain compromises where malicious extensions may be deployed to developers' machines.
Detects instances where a VS Code or similar IDE process launches suspicious child processes (Python or temporary executables) shortly after an extension installation or modification event, followed by an outbound network connection to a .workers.dev domain. This behavior is indicative of a malicious IDE extension establishing an interactive command and control (C2) channel or exfiltrating data.
This rule detects network communication attempts (connection success, request, or failure, or any traffic on port 443) targeting a specific malicious domain (notepadreleased.com) or IP address (85.158.110.78), while explicitly excluding common public DNS providers.
Detects network activity associated with the BumbleBee malware, including domain-generation algorithm (DGA) pattern matches within TLS Server Name Indication (SNI) fields and direct connections to known C2 infrastructure IP addresses over HTTPS.
This rule detects high-frequency, potentially malicious network connections to external infrastructure using unencrypted legacy mail protocols (SMTP: 25, POP3: 110, IMAP: 143). This pattern is consistent with an adversary-in-the-middle (AiTM) attack, where an attacker intercepts email traffic—often following DNS hijacking—to relay and potentially decrypt or harvest credentials and session tokens from plaintext sessions.
KQL Query
Detects potential data exfiltration attempts using PowerShell by identifying Invoke-WebRequest usage with specific flags (Put, ContentType, InFile) or encoding patterns (EncodedCommand) while targeting sensitive file extensions, directories, or suspicious network destinations.
This rule monitors DeviceNetworkEvents for outbound connections to specific known malicious IP addresses (31.97.137.157 and 46.183.25.232) on port 45000, or connections to the domain 'bet.slotgambit.com'. These indicators are consistent with command and control (C2) activity.
This rule detects outgoing TCP traffic to port 1082 that initiates or utilizes a SOCKS5 proxy connection, specifically identifying patterns associated with the Myxa VPN tool. The detection monitors for the specific SOCKS5 handshake byte and identifies known hardcoded IP addresses associated with this tool's proxy infrastructure.
Detects HTTP GET requests to a specific Cloudflare Workers domain ('is-01-ast.ols-img-12.workers.dev') used for msaRAT WebRTC signaling, characterized by the presence of spoofed 'Origin' and 'Referer' headers pointing to 'microsoft.com' alongside a 'HeadlessChrome' user agent, indicating malicious command-and-control behavior.
Detects outbound network connections initiated by a process identifying itself as 'HeadlessChrome' within the User-Agent string. This behavior is indicative of a headless browser being misused as a proxy for Command and Control (C2) communication, as observed in msaRAT infections.
This rule detects network communication attempts (connection success, request, or failure, or any traffic on port 443) targeting a specific malicious domain (notepadreleased.com) or IP address (85.158.110.78), while explicitly excluding common public DNS providers.
This rule detects network connections from common administrative processes (such as PowerShell, CMD, WScript, or Rundll32) to known dynamic DNS providers. This pattern is frequently indicative of malware beacons, command and control (C2) communication, or other unauthorized remote access tools utilizing dynamic DNS services to maintain connectivity to adversary infrastructure.
This rule identifies non-Microsoft processes (based on file name, file company name, and process signer) that initiate network connections to known Microsoft authentication endpoints. This behavior is often indicative of an adversary-controlled process attempting to leverage cloud services or perform authentication-related activities outside of expected system or productivity software.
Detects instances where a VS Code or similar IDE process launches suspicious child processes (Python or temporary executables) shortly after an extension installation or modification event, followed by an outbound network connection to a .workers.dev domain. This behavior is indicative of a malicious IDE extension establishing an interactive command and control (C2) channel or exfiltrating data.
Detects python.exe executing from unusual locations (AppData, Temp, or ProgramData directories) that subsequently establish outbound network connections, consistent with DeviceManager RAT behavior delivered via the DOUBLECUP loader.
This one's the interesting bit they're using Ethereum RPC calls as a C2channel and dumping stolen secrets to attacker-owned public repos tagged "Shai-Hulud: Here We Go Again". Also flags Claude/VS Code config file writes dropped by the worm for lateral persistence across dev machines.
Page 159 of 280