Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,879 detections
Filters
Last updated
All Time
Detection languages
2,954
1,378
313
289
239
Contributors
1,807
1,529
1,304
180
173
Categories
20,462
11,849
5,879
5,158
4,866
Platforms
3,747
1,857
1,076
782
160
Products / Services
2,241
1,434
1,273
746
582
MITRE Techniques
2,448
2,151
1,129
937
790
CVEs
19
15
9
7
5
IDS Classtypes
834
334
94
23
20
IDS Protocols
689
276
235
117
23
Detects large outbound network transmissions occurring on a host shortly after the creation of staged or archive files. This behavior is indicative of an attacker consolidating sensitive data (such as credentials or intelligence) into an archive and subsequently exfiltrating it over a Command and Control (C2) or other established network channel.
Detects established TLS connections to external networks where the server certificate subject contains a Common Name (CN) but lacks Organization (O) or Organizational Unit (OU) fields. This pattern is characteristic of basic, potentially malicious self-signed certificates used by command-and-control (C2) frameworks to mask communication.
Detects network connection events where the requested URL contains 'dogleash' and includes common architecture suffixes (mips, arm, x64) or shell script extensions (.sh), often indicative of downloading stage payloads associated with the Dogleash malware family.
Detects network communication with the Telegram API (api.telegram.org) originating from processes located in suspicious, user-writable directories such as Downloads, Temp, or AppData. This behavior is indicative of potential command and control (C2) communication or data exfiltration via the Telegram Bot API by malware.
Detects DNS queries for known typosquatted domains associated with Command and Control (C2) activity. The rule monitors for queries targeting lookalike domains impersonating well-known brands such as Microsoft, Google, Facebook, and various VPN services.
Detects the download of a Mach-O executable file over unencrypted HTTP. The rule identifies the Mach-O magic byte header ('CF FA ED FE') within the first few bytes of the HTTP response body, indicating a file download originating from an external network source.
Detects the execution of an AppleScript file via the osascript utility that initiates a network connection within a 5-minute window of execution. This behavior is often indicative of automated script-based network activity, such as command-and-control communication or data exfiltration.
Detects instances where a PowerShell process makes an outbound network connection shortly after its initial launch. This behavior is consistent with ClickFix campaigns or other malicious activity where PowerShell is utilized to download secondary payloads, such as stealers or loaders, directly from the internet.
Detects execution of processes associated with the CrySome Remote Access Trojan (RAT), identified by known binary names ('patch_diag.exe', 'patch.exe') or file hash. Additionally, it monitors for outbound network connections to a specific, hardcoded C2 IP address (193.26.115.42) on port 5555, which is associated with CrySome RAT's hVNC-enabled client.
Detects anomalous internal lateral movement activity where the Remote Desktop client (mstsc.exe) establishes network connections to multiple distinct internal destinations within a short window, potentially indicating an attacker traversing the network.
Detects HTTP GET requests to the URI '/beacon' destined for a known JadePuffer command-and-control server IP address (45.131.66.106) on port 4444. This signature identifies potential beaconing activity, which is a common communication pattern for malware implants communicating with an adversary-controlled server.
This rule detects processes that load Pluggable Authentication Modules (PAM) libraries (libpam) and subsequently initiate network connections within a 30-minute window. This behavior is often associated with credential dumping tools or malicious implants attempting to exfiltrate cached credentials or session information from memory on Linux and macOS systems.
Detects outbound network traffic originating from internal assets destined for IP addresses identified as Command and Control (C2) infrastructure associated with the UAT-7810 threat actor group.
Detects instances where known post-exploitation tools or techniques (AD Explorer snapshots, staging of screen captures in public directories, or credential stealer execution) are followed by successful outbound network connections from the same device within a 30-minute window. This behavior often correlates with the collection and subsequent exfiltration of sensitive information.
Detects mpr.dll loaded by non-standard processes followed by an SMB (port 445) connection from the same process, consistent with Cavern Manticore's WNetAddConnection2 routine that lazily resolves the API via P/Invoke (bypassing the static import table) and marshals stolen credentials to authenticate to remote network resources.
This rule detects a multi-stage attack pattern involving the execution of PowerShell via explorer.exe, followed by subsequent sub-process activity that attempts to access sensitive browser-stored credentials (Login Data or Cookies) or specific cryptocurrency wallet data, combined with a concurrent network connection attempt, indicative of credential exfiltration via a command-and-control (C2) beacon.
Detects network activity initiated by a process named 'Trustrap' communicating over common ports (80, 443, 53). The rule aggregates data by endpoint, process, and port, sorting by the frequency of connections to highlight potentially high-volume communication patterns.
Detects the execution of PowerShell commands that utilize the .NET TCPClient class to initiate network connections. This behavior is frequently associated with reverse shell activity where a command shell (cmd.exe) spawns PowerShell to establish a remote connection to an attacker-controlled listener.
Detects recurring connection patterns characteristic of the SnappyClient RAT, specifically monitoring for heartbeat-like beaconing at regular intervals on ports 3333/tcp and 3334/tcp. The rule correlates traffic across both ports from the same device to the same destination to identify potential command-and-control communication.
Detects instances where the Claude Code AI agent process spawns shell interpreters (bash, sh) or network utilities (curl, wget, dig, nslookup) with potentially malicious command line arguments. This behavior can be indicative of indirect prompt injection or unauthorized remote code execution attempts, such as reverse shells, base64 encoded payloads, or DNS-based exfiltration.
Detects HTTP GET requests to signindat.com for suspected malicious payloads, including executables (.exe) and scripts (.ps1), as well as a decoy PDF document. The rule identifies communication with an external host using generic User-Agent strings, characteristic of the CrySome RAT multi-stage download process.
Page 169 of 280