Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,879 detections
Filters
Last updated
All Time
Detection languages
2,954
1,378
313
289
239
Contributors
1,807
1,529
1,304
180
173
Categories
20,462
11,849
5,879
5,158
4,866
Platforms
3,747
1,857
1,076
782
160
Products / Services
2,241
1,434
1,273
746
582
MITRE Techniques
2,448
2,151
1,129
937
790
CVEs
19
15
9
7
5
IDS Classtypes
834
334
94
23
20
IDS Protocols
689
276
235
117
23
Detects browser navigation to sensitive Google account pages (e.g., myaccount.google.com/contactemail) occurring within 10 seconds of a browser extension installation. This pattern is consistent with automated redirects used to trigger Cross-Site Scripting (XS-Leak) vulnerabilities, potentially allowing attackers to exfiltrate sensitive user data or information via malicious extensions before the user can intervene.
This rule monitors DNS query traffic to detect potential C2 beaconing or exfiltration attempts by identifying source IP addresses that query a high volume of unique domains within a short, one-hour time window. It triggers when a host performs at least 10 unique domain queries within 60 minutes.
Detects potential exfiltration activity involving PowerShell scripts interacting with a specific remote IP address, using System.Net.WebClient to upload file contents, and referencing a common local staging file (C:\ProgramData\log.txt).
Detects HTTP traffic containing a User-Agent string associated with the NetSupport Manager remote access tool. This activity is indicative of the tool being used for unauthorized remote access or as a C2 channel, often seen in the context of the ClickFix campaign.
Detects outbound network communication to ports 80 or 443 that lacks standard application-layer protocol signatures (HTTP/HTTPS/TLS). This behavior is characteristic of the Gh0stRAT malware, which uses a non-standard zlib-compressed protocol with a specific 'Gh0st' header, commonly observed in TA4922 operations.
Detects the execution, network activity, or installation of GSocket (gsocket/gs-netcat) tools used for creating remote access tunnels. The rule also identifies instances where the legitimate 'uptime' binary is masqueraded to execute GSocket commands or establish unauthorized network connections.
This rule monitors network traffic for DNS queries or remote IP connections to domains that appear to be typosquatting or lookalike domains targeting specific organizations (Boeing, Airbus, Teledyne FLIR). The rule identifies potential phishing or malicious infrastructure by looking for the string 'career' combined with specific entity names or specific suspicious TLD patterns like '.com.de'.
Detects wscript.exe or powershell.exe processes exfiltrating system reconnaissance inventory (computer, OS, process, and directory listings) via HTTP POST requests using multipart/form-data. The activity involves Base64-encoded payloads transmitted to PHP endpoints (e.g., finalservice.php) hosted on dynamic DNS (dynv6.net) infrastructure, often associated with the Kimsuky threat group.
Detects the creation of a specifically named exfiltration file ('edgeLog.txt') followed by an outbound network connection over port 443 originating from the same process storyline. This pattern is indicative of a process staging stolen data to disk and subsequently exfiltrating it over an encrypted channel to an external destination.
This rule detects potential lateral movement attempts originating from IIS web servers (identified by 'w3wp.exe' as the initiating process) to other internal IP addresses using common lateral movement ports (SMB, RDP, WinRM, SSH). It specifically looks for successful network connections from an IIS server to a private IP address on one of the specified ports, where the remote IP is not the local IP.
Detects outbound HTTP POST requests to a /gallery URI endpoint, which is associated with Cavern Manticore C2 beacons. The detection logic inspects the HTTP request body for a specific Base64-encoded pattern following XOR 0x48 encoding, indicating potential command-and-control communication.
Detects network, DNS, proxy, and email interactions with known Microsoft-themed lookalike domains used in Adversary-in-the-Middle (AiTM) phishing campaigns. These domains impersonate Microsoft login portals to facilitate credential and session token harvesting by kits such as EvilProxy, Sneaky2FA, and Tycoon.
Detects a potential SSRF-based exfiltration attempt by correlating DNS traffic. The rule identifies a browser session that accesses M365 Copilot (m365.cloud.microsoft) followed by a connection to Bing (bing.com), which is indicative of the exfiltration technique associated with CVE-2026-42824 involving the Bing 'searchbyimage' feature.
Detects network proxy requests from Go-based HTTP clients targeting Dropbox and gofile.io, which are common indicators of VILE ransomware communication or data exfiltration activities.
This rule identifies network connections over port 1313 that initiate a Socket.io WebSocket upgrade request. The detection checks for the presence of the '/socket.io/' URI path, the 'EIO=4' protocol version parameter, and the 'transport=websocket' requirement, which are characteristic of Socket.io communication. This can be used to monitor for potentially unauthorized C2 channels or application-specific tunneling.
This rule detects potential phishing activity by correlating emails containing links to a specific suspicious domain and path with network activity (DNS queries or direct network connections) to the same domain. It targets both the initial email delivery and subsequent user interaction (e.g., clicking the link or downloading files).
Detects indicators of exploitation attempts against the CVE-2026-55200 libssh2 heap out-of-bounds write vulnerability. The rule identifies the creation of known PoC artifacts on disk, execution of exploit harnesses or probe binaries, Python scripts masquerading as or interacting with the PoC server, and libssh2-dependent client applications making network connections to the non-standard port 2222 used by the exploit scaffold.
This rule detects successful outbound SSH (port 22) connections originating from a private IP address on a device to a public IP address. This could indicate unauthorized remote access, data exfiltration, or command and control activity.
This rule detects scenarios where Microsoft Office applications (Word, Excel, Outlook, PowerPoint, OneNote) spawn known suspicious child processes (LOLBAS) that exhibit command-line flags indicative of remote content retrieval or script execution (e.g., download strings, encoded commands) and subsequently initiate network connections to public IP addresses or URLs within a 15-minute window.
Detects potential data exfiltration (CVE-2026-42824) where an attacker leverages an SSRF vulnerability in Bing's search-by-image functionality to relay sensitive M365 Copilot data. The rule identifies outbound network requests to the image search endpoint containing a suspicious 'imgurl' parameter pointing to non-Microsoft infrastructure, initiated by common web browser processes.
Detects potential Millenium RAT activity where a process masquerading as a legitimate system file (e.g., svchost.exe or MsEdgeUpdate.exe) is executed from a non-standard directory and subsequently initiates network communication with the Telegram Bot API within a one-hour window. This behavior is indicative of malware beaconing and exfiltrating victim profiling data.
Page 170 of 280