Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,879 detections
Filters
Last updated
All Time
Detection languages
2,954
1,378
313
289
239
Contributors
1,807
1,529
1,304
180
173
Categories
20,462
11,849
5,879
5,158
4,866
Platforms
3,747
1,857
1,076
782
160
Products / Services
2,241
1,434
1,273
746
582
MITRE Techniques
2,448
2,151
1,129
937
790
CVEs
19
15
9
7
5
IDS Classtypes
834
334
94
23
20
IDS Protocols
689
276
235
117
23
This rule monitors outbound TLS traffic for Server Name Indication (SNI) fields matching known C2 or phishing domains associated with the JadeProx activity. This indicates a potential connection from an internal host to malicious infrastructure.
Detects PHP process execution invoking fsockopen() to establish an outbound reverse shell connection, consistent with SpyPress backdoor persistence mechanisms deployed by TA458 on compromised Roundcube webmail servers.
Anomalously large outbound transfers over the WebRTC DataChannel from a Chrome/Edge process launched with --headless and --remote-debugging-port flags (no visible window), indicating exfiltration rather than routine interactive or automation-only browser use.
Detects the creation and immediate execution of an unsigned binary on a system within two minutes of that system establishing an outbound network connection to port 32768, which is the command and control (C2) port associated with the Dolphin X stealer. This rule aims to identify the behavior of a secondary payload being fetched and launched by the initial loader.
Detects a non-browser process establishing a loopback connection to a Chrome or Edge remote-debugging (CDP) endpoint. Malicious processes may abuse the Chrome DevTools Protocol to drive a headless browser, allowing the attacker to perform browser-based actions or use the browser as a covert C2 channel. This rule monitors for HTTP requests to /json/list/ or /devtools/ on 127.0.0.1 originating from processes other than chrome.exe or msedge.exe.
Detects ChonkyChicken's recon module by correlating TCP port scanning with ARP sweep or SMB share enumeration from the same host.
Detects rapid outbound meeting-invite fan-out from a Telegram account to numerous contacts (RecipientCount >= 10), excluding accounts flagged as known legitimate bulk-messaging/bot accounts, consistent with BlueNoroff's GhostCall self-propagation pipeline where compromised trusted-contact accounts distribute fake meeting invites. This rule captures only the fan-out behavior; for full GhostCall self-propagation confirmation it should ideally be paired with a companion rule detecting Telegram session reuse on a new device/IP (same UserId, within approximately 15 minutes), since that temporal join between session hijack and invite fan-out cannot be expressed as a single Sigma query.
This rule monitors DNS queries for the domain 'veyko-service.org', which is identified as being associated with the NodeSnake RAT (Remote Access Trojan). The detection indicates potential command-and-control (C2) activity where an infected host attempts to reach a malicious infrastructure domain.
Detects a suspicious PowerShell execution sequence initiated by explorer.exe that exhibits multiple indicators of malicious behavior within a short timeframe. The detection logic correlates PowerShell process creation (using obfuscated arguments or common attack flags) with subsequent network connections (C2), file writes to temporary directories, and execution of child processes from those same directories. This pattern is characteristic of multi-stage malware loaders, such as Vidar Stealer, staging payloads and executing them.
Detects outbound HTTP POST requests directed to Discord webhooks containing specific indicators associated with the TOKYOCORE ransomware, specifically identifying a unique User-Agent and a hardcoded exfiltration/C2 string in the request body.
Detects an unsigned process performing a specific behavioral sequence indicative of AI-assisted target profiling: high-volume software enumeration via registry keys, unauthorized access to browser data (history, cookies, bookmarks), and periodic C2-like network beaconing. The rule requires these actions to correlate within a tight 6-hour burst and exhibit persistent beaconing behavior over at least 3 days.
Detects HTTP GET requests to a known malicious endpoint attempting to download a file named 'update_ms.msi', associated with the Chaos msaRAT trojan.
This rule detects the execution of the Screaming Frog SEO Spider application followed by outgoing network traffic to web ports (80/443). Screaming Frog is a legitimate web crawler often repurposed by adversaries for internal or external network reconnaissance and site scraping.
This rule detects potential command and control (C2) beaconing activity associated with the AdaptixC2 framework. It identifies HTTP requests containing a specific 'X-Beacon-Id' header combined with known C2 URI patterns and a specific User-Agent string commonly observed in AdaptixC2 traffic.
Detects network traffic consistent with the SleeperGem loader communicating with a Forgejo instance hosted on git.disroot.org. The detection looks for GET requests containing specific path patterns (e.g., '/git-ecosystem/', '/raw/branch/main/') and file extensions (deploy.sh or git-credential-manager), along with a 'Git' user-agent, which is characteristic of the loader's C2 retrieval activity.
Detects network indicators related to the BlueNoroff ClickFix Kit, specifically targeting malicious TURN relay domains (edensun.xyz) used for WebRTC-based webcam exfiltration and Command and Control (C2) traffic involving Socket.IO signals that trigger malicious UI modals.
Project CAV3RN
Cortex XDR
This rule monitors for indicators of compromise (IOCs) associated with a specific malicious activity or campaign, designated as 'Project CAV3RN'. It flags network communication with known malicious domains and IP addresses, as well as the execution or presence of specific file hashes and filenames (e.g., AzureCommunication.dll, logAzure.txt, NewProject.dll) related to the threat.
Detects HTTP GET requests associated with the Blind Eagle (APT-C-36) campaign JC-46, specifically targeting GitHub for payload delivery and fetching dropper files (such as .vbs, .bat, .js, or .pif) from known command-and-control staging infrastructure.
Detects outbound HTTP/proxy connections to gouvvbo.top, the JadeProx AdaptixC2 C2 domain also hosting a credential-harvesting phishing portal that impersonates the Piar Municipality (Venezuela) tax administration system.
Detects indicators of the Miasma worm compromise on Windows and macOS systems. This includes the execution of malicious Spectral CLI payloads from npm npx cache directories, the staging and execution of sync.js payloads, the creation of Miasma-specific lock files and Cryptnet cache artifacts, and persistence established via Windows Registry Run keys.
Detects the HTTP POST exfiltration pattern used by the mrmustard stealer to send harvested credentials/host data to its C2 endpoint at metrics.femboy.energy/v1/collect.
Page 164 of 280