Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,879 detections
Filters
Last updated
All Time
Detection languages
2,954
1,378
313
289
239
Contributors
1,807
1,529
1,304
180
173
Categories
20,462
11,849
5,879
5,158
4,866
Platforms
3,747
1,857
1,076
782
160
Products / Services
2,241
1,434
1,273
746
582
MITRE Techniques
2,448
2,151
1,129
937
790
CVEs
19
15
9
7
5
IDS Classtypes
834
334
94
23
20
IDS Protocols
689
276
235
117
23
Detects outbound network traffic to a specific .onion domain associated with underground ransomware or crypter sales. This suggests potential interaction with C2 or malicious infrastructure hosted via the Tor network.
Detects outbound network traffic containing the specific string 'Secret: ' using raw TCP, often indicative of data exfiltration or unauthorized command-and-control communication via tunneling tools like netcat or ngrok.
This rule monitors for a high volume of WebDAV PROPFIND HTTP requests directed toward a specific domain associated with malware staging activities. The detection threshold is set to 50 requests within a 300-second window, which is indicative of automated attempts to enumerate or download malicious content using the WebDAV protocol.
Detects outbound TCP network traffic originating from internal assets to known hardcoded IP addresses and ports associated with PureRAT and DlrtyGames RAT malware families, indicating active command and control (C2) communication.
Detects the execution of XMRig cryptocurrency miner or network connections to known mining pool endpoints associated with XMRig, masquerading as or originating from the legitimate Windows process 'fontdrvhost.exe'. This behavior indicates potential resource hijacking.
Detects network connections to Zoho WorkDrive (workdrive.zoho.com) initiated by processes other than standard web browsers. This activity may indicate the use of unauthorized or automated tools to access cloud storage, potentially for data exfiltration or staging.
Detects potential anonymization attempts by identifying systems that connect to the Tor network check service followed closely by processes accessing local machine identifiers, such as machine-id or board serial numbers. This behavior may indicate an actor attempting to verify anonymity or fingerprint a host while routing traffic through Tor.
Detects the download and execution of the malicious v7.msi installer from the domain camorreado.click. This file acts as a loader for the EtherRAT Node.js RAT, often delivered in the context of fake IT support phishing campaigns. The rule monitors both network connection events to the malicious domain and process creation events involving msiexec.exe execution of the specific MSI payload.
Detects the installation or network activity associated with the malicious npm packages 'nodemon-sudo' (v3.1.16) and 'tslint-conf' (v7.2.1). These packages use typosquatting or brand impersonation (targeting 'nodemon' and 'pino') by leveraging forged maintainer and author metadata to trick developers into installing them.
Detects HTTP POST requests indicative of credential exfiltration associated with the Kratos phishing kit. The rule monitors for specific endpoint patterns (e.g., next.php, nex.php, n3xt.php, or officers*eur.php) commonly utilized by this kit to receive stolen credentials.
Detects node.exe processes fetching remote content from specific IPFS dead-drop domains where the executing process does not write a corresponding script file to disk. This behavior is indicative of a fileless execution pattern where a 'caller.js' script fetches a payload and executes it directly in memory using the JavaScript Function constructor, bypassing traditional on-disk detection mechanisms.
Detects ClickFix-style social engineering attacks where users are coerced into pasting and executing malicious commands (PowerShell/mshta) via the Windows Run dialog (explorer.exe), or instances where PowerShell processes spawned from the Run dialog perform network communication over suspicious ports commonly associated with this campaign.
Detects inbound emails with document-related subjects that contain links to the systeme.io platform, which are subsequently clicked and redirected to a different destination. This pattern is commonly used in phishing campaigns to bypass initial security inspection by leveraging reputable hosting platforms as a redirector.
Detects DNS queries for domains associated with Kratos Phishing-as-a-Service (PhaaS) hosting infrastructure. This activity is indicative of a user or system attempting to resolve domains used for phishing campaigns or command and control communication.
Correlates multiple suspicious behavioral patterns characteristic of the 'ClickFix' attack chain. The rule detects techniques such as PowerShell execution via RunMRU or Windows Terminal, CAPTCHA-lure download cradles, hidden-window PowerShell execution, fileless AES/TripleDES runspace payloads, COM hijacking, and suspicious LOLBin usage. The detection logic uses a 1-hour sliding window to aggregate these patterns on a per-device basis, assigning a higher confidence score as more stages of the attack chain are observed.
Detects the 'ff-agent' process exhibiting unusual network behavior, specifically involving multiple network protocols or connections to a high number of distinct remote ports within a one-hour window. This behavior is indicative of potential command and control (C2) communication, network reconnaissance, or proxy activity.
Detects instances where a Java process (java.exe/java) spawns common network utilities such as FTP, SFTP, or Netcat. This activity is often associated with exploitation of Java-based applications, potentially indicating post-exploitation behavior such as data exfiltration or manual command and control communication.
This rule detects node.js processes that either attempt to read sensitive cloud credential or configuration files (AWS, Google Cloud, Azure) or establish network connections to a specific remote IP address (85.137.53.71) on ports 8080 or 8081. This behavior is indicative of credential theft or potential command and control (C2) activity from a compromised node environment.
Detects repeated outbound HTTPS connections to api.github.com from a single source within a 60-second window. This pattern may indicate automated data exfiltration using the GitHub Contents API, as attackers often leverage legitimate code repository services to mask data exfiltration traffic.
Detects established TLS traffic over WebSockets where the certificate subject field lacks a common name (CN), often indicative of non-standard, self-signed, or improperly generated TLS certificates used by command-and-control (C2) agents to bypass standard certificate validation or hide within encrypted channels.
This rule monitors outbound HTTP POST requests and flags URLs that contain strings indicative of sensitive personal identifiable information (PII) such as national IDs, passports, or financial data including credit cards and bank account details. This is often an indicator of potential data exfiltration where sensitive information is being transmitted via URL parameters.
Page 167 of 280