Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,879 detections
Filters
Last updated
All Time
Detection languages
2,954
1,378
313
289
239
Contributors
1,807
1,529
1,304
180
173
Categories
20,462
11,849
5,879
5,158
4,866
Platforms
3,747
1,857
1,076
782
160
Products / Services
2,241
1,434
1,273
746
582
MITRE Techniques
2,448
2,151
1,129
937
790
CVEs
19
15
9
7
5
IDS Classtypes
834
334
94
23
20
IDS Protocols
689
276
235
117
23
This rule detects potential NTLM relay activity directed toward WSUS servers by monitoring network connections. It specifically identifies Windows devices identified as 'wsus' that communicate over both SMB (TCP 445) and Microsoft SQL Server (TCP 1433) ports within a 10-minute window, suggesting an attacker attempting to relay authentication to the WSUS backend database.
Detects the execution of processes related to 'SKILL.md', 'npx', 'mcp-server', or 'invoke_skill' followed closely by read or copy actions on sensitive file locations (SSH keys, AWS credentials, environment files, or AppData). The rule further correlates this activity with subsequent outbound network connections from the same device.
This rule detects high-volume outbound network traffic from a Google Cloud Platform (GCP) source IP to external (non-private/non-internal) destinations. It establishes a baseline of daily outbound traffic per source IP over time and triggers an alert if the current daily outbound volume exceeds 500MB and shows a significant increase (more than 3x the established average) compared to previous days. This behavior is often indicative of unauthorized data exfiltration or abnormal network activity.
This rule detects sustained network communication (at least 5 connections within a 300-second window) between internal hosts and a specific list of IP addresses identified by Unit 42 as malicious infrastructure used for AI token jacking. These servers operate as transfer stations, likely utilizing platforms like new-api or one-api to facilitate the illicit resale of stolen frontier-AI API keys. The rule incorporates an exclusion for internal security scanning and proxy infrastructure to minimize false positives, and it is specifically designed to flag exfiltration or unauthorized API usage patterns associated with stolen credentials (T1539) and potential proxy-based obfuscation of command and control or data relay (T1090).
Detects anomalous network behavior where a python.exe process initiates connections to multiple internal hosts across sensitive ports (135/445/3389) in a short time frame. This pattern is indicative of reconnaissance or lateral movement staging, commonly observed with portable Python interpreters used by malware suites like Edgecution.
This rule detects attempts to access cloud instance metadata services (specifically Google Cloud's metadata service) initiated by processes commonly associated with Adobe Campaign Classic (nlserver or w3wp.exe). Such requests are often indicative of Server-Side Request Forgery (SSRF) attempts, where an attacker leverages an application-level vulnerability to probe internal cloud infrastructure for sensitive data or credentials.
UNC6671 - Outbound connection to known automated SaaS data exfiltration IP, excluding maintained allowlist of legitimate backup/sync/CDN and sanctioned bulk-transfer destinations
This rule detects potentially malicious outbound network activity associated with the ScreenConnect (ConnectWise Control) remote administration tool. It flags connections to a specific malicious domain or any connection made by the ScreenConnect process to destinations outside of a defined organizational allow-list domain.
This rule detects suspicious activity originating from the Node.js runtime environment. It specifically monitors for 'node.exe' or 'node' processes accessing sensitive credential-related files (such as .npmrc, .netrc, .git-credentials, or id_rsa) followed closely (within 5 minutes) by network connections to public IP addresses. This behavior is indicative of an npm-based malware or malicious package attempting to harvest locally stored credentials and exfiltrate them to an external, potentially attacker-controlled server.
Detects malicious certificate enrollment requests targeting Active Directory Certificate Services (AD CS) that utilize legacy 'cdc' (Client DC) or 'rmd' (Remote Domain) request attributes, a technique associated with the 'Certighost' exploit (CVE-2026-54121). Additionally, the rule monitors the CA process (certsrv.exe) for suspicious outbound SMB or LDAP connections, which may indicate the abuse of AD CS chase fallback logic to coerce authentication.
Detects the execution of the rclone utility followed by successful outbound network connections occurring outside of standard business hours (8:00 PM to 6:00 AM). Rclone is a legitimate cloud storage synchronization tool frequently abused by adversaries for data exfiltration. This pattern identifies potential unauthorized data staging and egress to remote cloud storage services during times when activity is less likely to be monitored.
Detects python.exe executing from unusual locations (AppData, Temp, or ProgramData directories) that subsequently establish outbound network connections, consistent with DeviceManager RAT behavior delivered via the DOUBLECUP loader.
Detects network connections to known Generative AI API endpoints (OpenAI, Anthropic, Google, Mistral) from devices that have not exhibited such activity in the past 30 days. This rule excludes common browser processes and email/messaging clients to identify potentially anomalous or unapproved use of AI services.
This rule detects potentially suspicious data exfiltration activities by identifying a pattern where a user authenticates or interacts with the Microsoft Purview service, followed closely (within 15 minutes) by a connection to an external domain that the organization has not established a historical communication pattern with in the last 30 days. This behavior may indicate an adversary is attempting to exfiltrate session tokens or sensitive data to an external server.
This rule monitors for known file hashes and network indicators associated with Bindcloak malware. It alerts on endpoint file execution events matching specific SHA256/MD5/SHA1 hashes and network connection events to suspicious domains or a specific malicious IP address.
Detects the execution of processes related to 'SKILL.md', 'npx', 'mcp-server', or 'invoke_skill' followed closely by read or copy actions on sensitive file locations (SSH keys, AWS credentials, environment files, or AppData). The rule further correlates this activity with subsequent outbound network connections from the same device.
This rule detects potential NTLM relay activity directed toward WSUS servers by monitoring network connections. It specifically identifies Windows devices identified as 'wsus' that communicate over both SMB (TCP 445) and Microsoft SQL Server (TCP 1433) ports within a 10-minute window, suggesting an attacker attempting to relay authentication to the WSUS backend database.
This rule detects the execution of potentially malicious command-line patterns (involving base64 decoding, pipes to sh/zsh, and network-fetching utilities like curl) within Terminal.app processes on macOS. It correlates these command executions with prior web browser activity within a 5-minute window, effectively identifying potential 'ClickFix' social engineering lures where users are coerced into copying and pasting malicious instructions into their shell.
Detects outbound HTTP POST requests associated with the ChainDrop/Shai-Hulud malware family. The rule looks for 'eth_call' JSON-RPC method calls targeting a specific Ethereum smart contract address known to be used for EtherHiding C2 infrastructure, where malicious payloads or commands are embedded within blockchain interactions.
This rule monitors for known file hashes and network indicators associated with Bindcloak malware. It alerts on endpoint file execution events matching specific SHA256/MD5/SHA1 hashes and network connection events to suspicious domains or a specific malicious IP address.
Detects a process that queries a public IP lookup service (ipify.org, ifconfig.me) and, within 30 seconds, initiates a second distinct network connection from the same causality/actor process chain that transfers data, consistent with environmental-keying techniques used by DOUBLECUP to fetch secondary-stage payloads keyed to the victim's public IP.
Page 161 of 280