Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,879 detections
Filters
Last updated
All Time
Detection languages
2,954
1,378
313
289
239
Contributors
1,807
1,529
1,304
180
173
Categories
20,462
11,849
5,879
5,158
4,866
Platforms
3,747
1,857
1,076
782
160
Products / Services
2,241
1,434
1,273
746
582
MITRE Techniques
2,448
2,151
1,129
937
790
CVEs
19
15
9
7
5
IDS Classtypes
834
334
94
23
20
IDS Protocols
689
276
235
117
23
Detects a code editor process (VS Code, Cursor, Windsurf, VSCodium) reading the MachineGuid registry value followed within 3-8 seconds by an outbound network connection to a non-private IP from the same process on the same host, consistent with Open VSX evil-twin extensions harvesting developer machine identifiers and exfiltrating fingerprinting data.
Detects network communication associated with the TOKYOCORE malware C2 infrastructure. The rule monitors for specific API endpoints (/api/victim/(log|data|command|archive)) combined with known malicious User-Agent strings (RansomAgent or fsociety/1.0), as well as suspicious multipart form data uploads that may indicate data staging or exfiltration.
Detects outbound network traffic to the 'logfriend[.]com' domain, specifically to endpoints used by the Forg365 'ForgCookie' browser extension. This extension is known to facilitate the automated refreshing of Microsoft SSO cookies, potentially enabling persistent session hijacking and bypassing MFA.
Detects network connections originating from processes named 'sftunneld' or connections to public IP addresses over specific ports (443, 8305). This pattern is often used to identify potentially suspicious outbound communication, such as tunneling or C2 activity, particularly when observed from non-standard internal processes.
Detects outbound FOFA asset-search traffic containing an exact title="Langflow" query directed at the FOFA API host (fofa.info), indicating reconnaissance for Langflow deployments.
Detects suspicious processes that repeatedly enumerate installed software via registry Uninstall keys and access sensitive browser data (History, cookies, and web-data files) over a period of multiple days, while simultaneously generating consistent outbound network beaconing. This behavior is indicative of data-stealing malware, such as the Dolphin X 'AI Profiler', which profiles victims based on their application usage and browsing habits.
Detects outbound HTTP/proxy connections to gouvvbo.top, the JadeProx AdaptixC2 C2 domain also hosting a credential-harvesting phishing portal that impersonates the Piar Municipality (Venezuela) tax administration system.
Detects execution of a bash reverse shell using /dev/tcp TCP redirection, a persistence/backdoor technique used by TA458 SpyPress operators on compromised webmail servers to connect back to C2 infrastructure.
Detects network activity associated with the Dolphin X malware, including DNS queries, TLS SNI requests, and direct TCP traffic to known C2 infrastructure patterns on specific ports.
Detects the use of built-in Windows Living-off-the-Land binaries (LOLBins) to initiate outbound network connections to public infrastructure for file downloads. The rule correlates process execution, network connections, and subsequent file creation to identify potentially malicious ingress tool transfer. It includes risk-based scoring to prioritize events where files are dropped in user-writable paths or subsequently executed.
Detects outbound HTTP/proxy connections to gouvvbo.top, the JadeProx AdaptixC2 C2 domain also hosting a credential-harvesting phishing portal that impersonates the Piar Municipality (Venezuela) tax administration system.
Detects HTTP GET requests with an Upgrade: websocket header directed at known UNC6692 Edgecution/SNOWBELT malware command-and-control infrastructure hosted on CloudFront subdomains via the /ws URI path. This indicates active WebSocket-based communication between an infected host and the threat actor's C2 server.
UNC6692 Edgecution phishing/payload page hosted on AWS S3 static website hosting (patch.html/.a payload)
Detects the use of PowerShell to perform a fileless download-and-execute operation, characterized by the presence of web-based download cmdlets alongside in-memory execution primitives. This pattern is commonly used for staging malicious payloads such as Cobalt Strike, Sliver, or other offensive tooling while avoiding file-based detection.
Detects a suspicious proxy authentication negotiation pattern involving multiple HTTP 407 challenges followed by a WebSocket upgrade and the establishment of a SOCKS5 tunnel, indicative of the BridgeHead adversary toolset.
Detects outbound HTTPS traffic to api.telegram.org originating from non-standard or unsigned processes. This rule is designed to identify potential data exfiltration by malware (such as stealers or trojans) using the Telegram Bot API as a C2 or exfiltration channel. It relies on a companion rule to establish flowbits for legitimate client traffic.
Detects high-frequency outbound HTTP traffic matching specific URI patterns associated with potential Adaptix C2 beaconing behavior. The rule uses a sliding window threshold (10 requests within 600 seconds) to identify repetitive check-in patterns, which is a common characteristic of malware command-and-control channels.
Detects the legacy SourTrade Mark-of-the-Web spoofing variant, where a downloaded file's Zone.Identifier data or an observed network request references the jimmywarting.github.io/StreamSaver.js helper path with an embedded attacker domain, date, and installer.exe filename — used to disguise the true download provenance of browser-assembled malware.
Detects high-volume outbound SYN packet bursts from internal hosts to external networks, excluding known service ports. This behavior is indicative of a compromised host acting as part of a botnet conducting a SYN flood Denial of Service attack.
Detects an attempt to connect to the Chrome Remote Debugging port (9222) on the local loopback address (127.0.0.1) from an process other than the standard Chrome or Edge browsers. This behavior is often indicative of an adversary attempting to interact with or hijack a running browser session to exfiltrate cookies or session information.
Detects outbound HTTP GET requests to google.com that utilize a bare 'Mozilla/5.0' User-Agent header, which is indicative of the TOKYOCORE malware performing network connectivity checks. This behavior is atypical for standard browsers and can be used to identify potential beaconing activity.
Page 163 of 280