Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,879 detections
Filters
Last updated
All Time
Detection languages
2,954
1,378
313
289
239
Contributors
1,807
1,529
1,304
180
173
Categories
20,462
11,849
5,879
5,158
4,866
Platforms
3,747
1,857
1,076
782
160
Products / Services
2,241
1,434
1,273
746
582
MITRE Techniques
2,448
2,151
1,129
937
790
CVEs
19
15
9
7
5
IDS Classtypes
834
334
94
23
20
IDS Protocols
689
276
235
117
23
Detects network connections to known Generative AI API endpoints (OpenAI, Anthropic, Google, Mistral) from devices that have not exhibited such activity in the past 30 days. This rule excludes common browser processes and email/messaging clients to identify potentially anomalous or unapproved use of AI services.
This rule detects potentially malicious outbound network activity associated with the ScreenConnect (ConnectWise Control) remote administration tool. It flags connections to a specific malicious domain or any connection made by the ScreenConnect process to destinations outside of a defined organizational allow-list domain.
Detects HTTP GET requests to UNC6692 Edgecution phishing landing pages hosted on S3 buckets using the 'service-page-*-outlook.s3.us-west-2.amazonaws.com' naming pattern with an 'email=' parameter and '/update.html' URI, used to lure victims into downloading the Edgecution malware suite via fake Outlook/Mailbox Repair Utility pages.
This rule monitors for suspicious activity by detecting two distinct patterns: first, network connections initiated by Java processes located in tomcat/catalina directories on high-risk ports; second, suspicious administrative audit actions (Add admin, Modify credential, Export device list) within N-central where the initiating user context is missing.
Persistent multi-day exfil retry with per-package tracking ID beacon
This rule detects rapid, high-volume outbound network requests to a single remote host from common web browsers (msedge.exe, chrome.exe, outlook.exe, firefox.exe). It identifies suspicious behavior where a browser performs at least 10 requests to 10 distinct URLs in a 30-second window, which is indicative of potential per-keystroke exfiltration or automated data scraping.
This rule detects rapid, high-volume outbound network requests to a single remote host from common web browsers (msedge.exe, chrome.exe, outlook.exe, firefox.exe). It identifies suspicious behavior where a browser performs at least 10 requests to 10 distinct URLs in a 30-second window, which is indicative of potential per-keystroke exfiltration or automated data scraping.
Detects network connections to uncommon or suspicious top-level domains (TLDs) initiated by processes other than standard web browsers. The rule filters out known browser processes and analyzes network traffic patterns, including connection count and prevalence across the fleet, to identify potentially anomalous or malicious C2 activity.
Detects instances where a Python interpreter (python.exe/pythonw.exe) or an executable file launched from temporary, roaming, or public directories initiates an outbound network connection to common C2/high-risk ports. This behavior is indicative of potential malware staging or C2 communication from obfuscated or temporary locations.
This rule detects anomalous patterns of Microsoft Graph API activity involving the /calendar, /events, and /calendarView endpoints. It identifies application identities performing high-frequency create (POST/PATCH) and read (GET) operations within a short time window. This behavior is indicative of a compromised mailbox being used as a C2 dead-drop channel, where the calendar is used to exchange commands and results between the adversary and the compromised environment.
Detects DNS queries to mangorbit.com and its subdomains, C2 infrastructure associated with the Open VSX Evil Twin extensions campaign
This rule monitors for suspicious activity by detecting two distinct patterns: first, network connections initiated by Java processes located in tomcat/catalina directories on high-risk ports; second, suspicious administrative audit actions (Add admin, Modify credential, Export device list) within N-central where the initiating user context is missing.
Detects potential post-exploitation activity originating from the SharePoint worker process (w3wp.exe). The rule monitors for three primary indicators: w3wp.exe spawning command interpreters (cmd.exe or powershell.exe), unauthorized file modifications or creations within SharePoint web directories, and outbound network connections to public IP addresses initiated by w3wp.exe, which may indicate payload delivery or C2 communication. (CVE-2026-50522)
Detects HTTP traffic to the hardcoded Heroku-hosted SNOWGLAZE C2 endpoint (sad4w7h913-b4a57f9c36eb.herokuapp.com) where the client requests a WebSocket upgrade on the /ws URI and sends a JSON body containing login, password, and uuid fields used to authenticate the tunnel to the actor's C2 infrastructure.
Detects network connections originating from processes named 'sftunneld' or connections to public IP addresses over specific ports (443, 8305). This pattern is often used to identify potentially suspicious outbound communication, such as tunneling or C2 activity, particularly when observed from non-standard internal processes.
This rule detects DNS queries, HTTP Host headers, and TLS SNI values indicative of interaction with specific doppelganger domains designed to impersonate Microsoft online services (ms365-device.com, ms365-live.com, m365-owa.com, owa-ms365.com). Such activity is commonly associated with phishing or C2 infrastructure targeting Microsoft 365 environments.
Detects the download, file creation, or execution of known NirSoft credential and browser harvesting utilities (ChromePass, WebBrowserBookmarksView, Network Password Recovery, LastActivityView) from non-standard directories or identified malicious actor infrastructure.
SNOWBELT time-based DGA S3 bucket manifest retrieval
Detects instances where a Python interpreter (python.exe/pythonw.exe) or an executable file launched from temporary, roaming, or public directories initiates an outbound network connection to common C2/high-risk ports. This behavior is indicative of potential malware staging or C2 communication from obfuscated or temporary locations.
Detects malicious browser extension background scripts exfiltrating browser data by identifying specific message patterns (type 0x14/20 and event 0xc8/200 containing keyword, url, and count fields) or activity associated with known malicious extension IDs and native messaging hosts.
UNC6692 fake Outlook Updates Management Console phishing page served from S3
Page 162 of 280