Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,879 detections
Filters
Last updated
All Time
Detection languages
2,954
1,378
313
289
239
Contributors
1,807
1,529
1,304
180
173
Categories
20,463
11,851
5,879
5,159
4,867
Platforms
3,747
1,857
1,076
782
160
Products / Services
2,241
1,434
1,273
746
582
MITRE Techniques
2,448
2,151
1,129
937
790
CVEs
19
15
9
7
5
IDS Classtypes
834
334
94
23
20
IDS Protocols
689
276
235
117
23
Detects potential data exfiltration activity to the file sharing service 'easyupload.io' by monitoring DNS queries, HTTP POST requests, and general network connections to the domain.
This rule detects unauthorized exfiltration of stolen browser and credential data by the Yuta/Glove Stealer malware (winupdate.exe). It identifies outbound HTTPS network connections from the specific indicator file path '%APPDATA%\.cache\winupdate.exe' to known C2 endpoints, including Discord webhooks, Telegram bot APIs, or connections utilizing the 'python-requests' user agent.
This rule monitors for potential C2 communications and tunneling activity associated with the STAC4713 campaign. It detects outgoing network connections to known malicious IP addresses, traffic over specific non-standard ports used for tunneling, or the execution of QEMU (qemu-system-x86_64.exe), which is often used by this threat actor to host malicious services or tunnels. The rule includes logic to suppress benign, internal-only QEMU activity.
Detects command-and-control (C2) communication patterns associated with the threat group Obsidian Sandstorm (Storm-2571). The rule monitors for network connections and DNS queries to various Azure App Services subdomains initiated by suspicious processes running from user-accessible temporary directories (AppData or Temp), excluding known browser processes. This technique leverages legitimate cloud infrastructure for malicious command delivery.
Detects suspicious behavior originating from Windows Package Manager (winget.exe) and associated DSC/Server processes. This rule identifies two specific patterns: 1) These processes spawning shells or interpreters (e.g., PowerShell, cmd, mshta) which may indicate command-line abuse or malicious script execution. 2) These processes making outbound network connections to non-private/external IP addresses, potentially indicating remote payload delivery or command and control activity.
Detects high-volume outbound network connections (exceeding 10MB) originating from processes associated with AI-driven chatbot or productivity applications (e.g., ChatGPT, Perplexity). This rule identifies potential data exfiltration occurring over legitimate, expected software channels.
This rule detects internal network traffic communicating with the Telegram Bot API endpoint 'api.telegram.org' using the 'getUpdates' method. This pattern is commonly used by malware for C2 polling to retrieve commands from an adversary-controlled Telegram bot.
This rule detects potential data exfiltration by monitoring for the creation of zip archives followed by an network connection to Telegram's API by the same device within a 10-minute window. This behavior often indicates that a user or an attacker is staging data in an archive and subsequently uploading it to a cloud file-sharing service.
Detects network communication associated with AsyncRAT command-and-control activity. The rule identifies established outbound connections on non-standard ports (6606, 7707, 8808) containing a specific 3-byte null sequence header, which is indicative of AsyncRAT's communication protocol.
Detects anomalous outbound network traffic from Firefox processes indicative of CVE-2025-15661 exploitation. The rule monitors for communication with a specific non-standard port (8765) associated with a SmartWindow PoC server, or requests containing suspicious URI query parameters ('u0', 'u1', 'u2', 'source=history') frequently used for exfiltrating private browsing tabs and history via the '/leak' endpoint.
Detects artifacts, execution patterns, and post-exploitation behaviors associated with the exploitation of the libssh2 heap out-of-bounds write vulnerability (CVE-2026-55200). The rule monitors for the presence of known proof-of-concept files, malicious SSH server orchestration via Python, outbound network traffic to the PoC's default non-standard port (2222) from SSH-capable applications, and post-exploitation shell or calculator spawns.
Detects outbound network connections from common package managers (pip, npm) or utility tools (node, wget, curl) to destinations that are not related to official package repositories or local network ranges. This behavior may indicate an adversary using legitimate tools to download malicious payloads or establish command and control channels.
Detects suspected Grandoreiro banking trojan command-and-control (C2) activity. The rule monitors for STUN/TURN traffic over non-browser/non-conferencing processes on port 3478, outbound MQTT connections to common cloud broker domains, and DNS lookups for specific C2-related infrastructure including geolocation checks via icanhazip.com.
This rule detects two suspicious behaviors associated with PowerShell: 1) attempts to disable SSL/TLS certificate validation (often used by malicious scripts to bypass security checks when downloading payloads) and 2) outbound network connections by non-Microsoft signed processes on non-standard ports (8000-9000), which is common in C2 beaconing activities.
Phishing-as-a-Service kit abusing OAuth device code flow against Microsoft 365
This rule detects a multi-stage phishing campaign involving Gmail-hosted emails containing 'short.gy' URLs. It monitors for three distinct signals: (1) Outbound network connections to 'chongdaotang.net', (2) User clicks on 'short.gy' links arriving from Gmail addresses, and (3) Inbound or BCC-delivered emails from Gmail senders containing 'short.gy' links. This combination is highly indicative of a phishing operation attempting to redirect users to a malicious infrastructure.
Detects signs of persistence via suspicious scheduled task creation or local user creation/group escalation, and C2 activity involving a specific IP address or unauthorized connections to the Telegram bot API.
Detects coordinated malicious behaviors associated with BQTLock ransomware, specifically identifying external IP reconnaissance, direct communication with known C2 infrastructure, abuse of the Telegram API for command-and-control or exfiltration, and host enumeration via system utilities by non-standard processes. The rule aggregates these suspicious signals and triggers an alert when multiple events occur within the same process storyline.
Detects high volume HTTPS outbound traffic (greater than 50MB within a 5-minute window) from a host that does not show evidence of preceding file encryption or volume shadow copy deletion activity. This rule is designed to identify potential unauthorized data exfiltration that deviates from typical ransomware-associated behavior patterns.
This rule detects outbound network connections to URLs associated with common file sharing services (e.g., Dropbox, Mega, Gofile) or temporary email providers (e.g., Temp-Mail). Such connections can indicate data exfiltration attempts, use of unsanctioned services, or communication with command and control infrastructure.
This rule detects network communication (DNS, connection, or traffic) with known infrastructure and specific URI paths associated with the SpectralViper threat actor. It enriches these findings by identifying if the communication originated from processes commonly associated with SpectralViper, such as OneDrive Sync services or specific Intel audio service files.
Page 172 of 280