Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,879 detections
Filters
Last updated
All Time
Detection languages
2,954
1,378
313
289
239
Contributors
1,807
1,529
1,304
180
173
Categories
20,462
11,849
5,879
5,158
4,866
Platforms
3,747
1,857
1,076
782
160
Products / Services
2,241
1,434
1,273
746
582
MITRE Techniques
2,448
2,151
1,129
937
790
CVEs
19
15
9
7
5
IDS Classtypes
834
334
94
23
20
IDS Protocols
689
276
235
117
23
Anomalously large outbound transfers over the WebRTC DataChannel from a Chrome/Edge process launched with --headless and --remote-debugging-port flags (no visible window), indicating exfiltration rather than routine interactive or automation-only browser use.
Detects outbound HTTP POST requests to a Polygon blockchain JSON-RPC endpoint containing the eth_call method and a specific hardcoded smart contract address and function selector associated with the TELEPUZ malware command-and-control communication.
Detects network connections originating from browser processes to domains associated with ModHeader-related C2 activity, specifically 'stanfordstudies.com' and 'extensions-hub.com'. This pattern is indicative of malicious browser extensions exfiltrating data or reaching out to command and control infrastructure.
Detects established TLS connections to known malicious infrastructure associated with PureRAT and DlrtyGames RAT. The rules identify suspicious patterns such as connections without a Server Name Indication (SNI) and specific JA3 hashes indicative of malware beacons.
This rule detects a specific WebSocket handshake pattern associated with the NodeSnake RAT. It specifically identifies an HTTP GET request containing a 'Sec-WebSocket-Key' header and a specific URI query parameter '?v=4|3b|', which indicates beaconing activity characteristic of this RAT's communication channel.
Detects outbound HTTP requests to a specific Telegram channel (chanadarkpart) commonly associated with the TELEPUZ malware (used by SCMBANKER), indicating a potential command-and-control (C2) dead-drop resolver communication attempt.
Detects network activity associated with BlueNoroff ClickFix campaigns, specifically targeting the download of suspicious Windows PE files from typosquatted CDN/payload URIs. The rule uses session tracking to correlate the initial URI request with the subsequent retrieval of executable content.
This rule detects network traffic patterns where an internal host initiates an HTTP connection to a specific Steam Community profile, which is used as a dead-drop resolver by the TELEPUZ malware (associated with the CLICKFIX-VIDAR campaign) to retrieve secondary command-and-control infrastructure information.
Detects an outbound HTTP GET request containing a .jpg extension in the URI, initiated by a user agent string containing 'PowerShell'. This pattern is commonly associated with attackers downloading images intended to serve as carriers for steganographic payloads, which are then parsed or executed by malicious PowerShell scripts.
Detects instances where the Microsoft Installer process (msiexec.exe) initiates a network connection to the local IPv4 loopback address (127.0.0.1). This behavior may indicate an MSI custom-action payload attempting to interact with a web browser through the Chrome DevTools Protocol (CDP) to establish a covert command-and-control channel.
Detects instances where a user receives an email containing a link to SharePoint or OneDrive, but upon clicking the link, the user is redirected to a different, non-Microsoft domain. This behavior is indicative of a phishing attempt using legitimate file-sharing services to bypass initial URL filtering.
This rule detects scenarios where an email containing a specific URL has been soft or hard deleted from a user's mailbox (often by security automated systems), but a user has subsequently clicked that same URL. This often indicates a race condition or a failure in security controls where a malicious link was delivered and accessed before or during the removal process.
Detects network activity associated with the TELEPUZ malware communicating with public Polygon blockchain RPC nodes. The malware interacts with a specific smart contract (0xf55Bea1FdCf1c3ABb39ab92567C09aC1BFf6753E) to resolve its AES-encrypted Command and Control (C2) server address.
Detects communication between suspicious processes (rundll32.exe, svchost.exe, dllhost.exe, install.exe) and the Steam Community website, specifically targeting a known TELEPUZ malware dead-drop profile ID used to resolve XOR-encoded C2 addresses.
Detects a renamed Plink/PuTTY binary (frontpage.exe) launched from C:\users\public\music\ with command-line flags -C -N -R establishing a remote SSH port-forward tunnel to a sftp@ destination on port 3522, consistent with HelloNet C2/data exfiltration tunneling.
This rule monitors for suspicious activity often associated with credential or sensitive information discovery in development environments. It identifies: 1) Access to configuration files or directories related to AI-powered development tools (e.g., Cursor, Windsurf, Zed) which may store environment variables or API keys; 2) Network connections to common cloud instance metadata endpoints; and 3) Execution of command-line tools attempting to access AWS secrets or configuration management APIs (Secrets Manager, SSM).
Detects rundll32.exe making outbound network connections to public IP addresses, excluding cases where the parent process is svchost.exe. This indicates the abuse of "rundll32.exe" as a proxy execution binary for defense evasion, payload execution, or suspicious network communication.
This rule monitors and aggregates external network connections originating from a specific host. It specifically highlights connections to external domains or IPs that have a low frequency (1-10 connections), which may indicate beaconing activity, command and control (C2) communication, or low-and-slow data exfiltration attempts.
This rule detects outbound HTTP requests using the WebDAV protocol that target specific directory paths associated with the Stealth Falcon campaign staging activity. Such traffic may indicate a compromised host attempting to download tools or payloads from an adversary-controlled infrastructure.
This rule monitors for processes making requests to cloud instance metadata services (GCP) or accessing sensitive secrets and parameters via AWS CloudTrail. Such activity may indicate an attacker attempting to enumerate instance identities, retrieve temporary security credentials, or access managed configuration secrets.
Detects outbound TLS traffic directed toward ngrok.io infrastructure originating from Azure Container Instances. Ngrok is frequently used by adversaries to establish reverse proxies and tunnels to maintain persistent command-and-control access to compromised cloud-hosted containers.
Page 165 of 280