Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,879 detections
Filters
Last updated
All Time
Detection languages
2,954
1,378
313
289
239
Contributors
1,807
1,529
1,304
180
173
Categories
20,460
11,847
5,879
5,158
4,866
Platforms
3,747
1,857
1,076
782
160
Products / Services
2,241
1,434
1,273
746
582
MITRE Techniques
2,448
2,151
1,129
937
790
CVEs
19
15
9
7
5
IDS Classtypes
834
334
94
23
20
IDS Protocols
689
276
235
117
23
This rule detects scenarios where common administrative or attack tools (e.g., whoami, net, ipconfig, psexec) are used within the same 5-minute window as network communication to known Large Language Model (LLM) service providers. This pattern may indicate an attacker using LLMs to assist with post-exploitation discovery, script generation, or data analysis based on local system reconnaissance.
Detects browser-initiated DNS queries to bing.com during an active Microsoft 365 Copilot session within the same process storyline. This pattern is indicative of a potential SearchLeak HTML rendering race condition (CVE-2026-42824), where a malicious streamed <img> tag triggers an outbound request to Bing before Content Security Policy (CSP) sanitization is applied, potentially exfiltrating sensitive Copilot-retrieved mailbox data.
This rule detects the presence of a known malicious Chromium extension (ID: flkebkiofojicogddingbdmcmkpbplcd) that hijacks browser search functionality. The detection monitors for three distinct indicators: the creation of specific extension files within the Chromium directory, network communication with attacker-controlled domains (perplexity-ai.online, extension.tilda.ws), and registry modifications that override default search settings.
Detects browser processes (Edge or Chrome) connecting to known IP geolocation or fingerprinting services within 3-5 days after a new extension has been registered. This behavior is consistent with malicious browser extension 'dormancy gating' and environment fingerprinting techniques, often used by malware (such as StegoAd) to confirm they are running on a real user host before activating payloads.
Detects the installation, service creation, and network activity associated with Tailscale VPN on endpoints. The rule monitors for process creation of Tailscale binaries, creation of associated registry keys, and outbound network traffic to Tailscale infrastructure or the internal 100.64.0.0/10 CGNAT mesh range, which may indicate unauthorized persistence or remote access.
Detects instances where Python-related package management tools (python.exe, pip.exe) initiate external network connections shortly after executing install-related commands. This behavior may indicate an attempt to install malicious packages from untrusted repositories or a software supply chain compromise.
Detects instances where Python-related package management tools (python.exe, pip.exe) initiate external network connections shortly after executing install-related commands. This behavior may indicate an attempt to install malicious packages from untrusted repositories or a software supply chain compromise.
This rule detects a multi-stage process indicative of Server-Side Request Forgery (SSRF) leveraging Bing's Search-by-Image service. Stage 1 captures browsers submitting arbitrary URLs (via the imgurl= parameter) to Bing. Stage 2 detects subsequent inbound requests to an external, attacker-controlled server originating from Bing's infrastructure, suggesting that Bing performed an unauthorized fetch of a resource and delivered it to the attacker, potentially exfiltrating sensitive data.
Detects the SearchLeak (CVE-2026-42824) attack chain targeting M365 Copilot. The rule monitors for a three-stage sequence within 1 minute: (1) A user accessing a crafted Enterprise Search URL with an injected prompt in the query string; (2) Evidence of bulk data access (MailItemsAccessed or FileAccessed, 5+ events); and (3) An outbound HTTP request to a Bing image search endpoint containing exfiltrated data encoded within a long (>500 chars) 'imgurl' parameter, indicating a potential SSRF/CSP bypass exfiltration path.
This rule detects high-volume data exfiltration attempts over common HTTPS ports (443 or 8443). It identifies network connections where more than 1MB of data is sent in a single connection, then aggregates these connections over one-hour intervals per device and remote IP. Finally, it flags any device that has sent a total of 50MB or more within that hour to a specific remote IP, indicating potential data exfiltration to a command and control server.
Detects outbound TCP traffic originating from the internal network to external hosts on TCP port 45588, which is associated with Interlock ransomware beaconing behavior. This rule monitors for initial TCP SYN packets, characteristic of an outbound connection attempt potentially related to command-and-control activity following the exploitation of CVE-2026-20131.
This rule detects potential exfiltration attempts from a GCP Cloud Run container by monitoring for outbound network connections triggered by processes reading sensitive local files. The files being monitored include environment variable configurations (/proc/self/environ) and application source code, which may contain credentials or service account tokens.
Detects outbound network connections to common Tor relay and exit ports (9001, 9050) initiated by processes other than authorized Tor clients. This activity is often associated with threat actors, including Volt Typhoon, using Tor to obfuscate command-and-control (C2) traffic.
Detects network connection attempts or successes from critical Windows processes (System, svchost.exe, lsass.exe) targeting the localhost interface (127.0.0.1 or ::1) on non-standard ports (above 1024, excluding SMB ports 445/139). This behavior is often indicative of local process injection, credential dumping activity, or unauthorized inter-process communication used by malware to bypass network security controls.
Detects anomalous Python activity indicative of the InvisibleFerret backdoor, specifically focusing on instances where Python processes are spawned by developer tools (node.exe, code.exe, cursor.exe), access sensitive credential/wallet files, or initiate outbound network connections on common C2 ports.
Detects HTTP traffic patterns associated with default Cobalt Strike malleable C2 profiles, specifically identifying requests to /submit.php or /dpixel and the use of the default 'Mozilla/4.0 (compatible; MSIE 8.0;' User-Agent string.
This rule detects processes making three or more successful outbound network connections within an hour to known code or text sharing sites like Pastebin, GitHub, or Gist. This activity can be indicative of data exfiltration, command and control (C2) communication, or staging of malicious code.
Detects instances where the Outlook process (OUTLOOK.EXE) initiates a network connection via port 445 (SMB) to an IP address that is not part of the internal private network ranges. This activity is highly anomalous for an email client and may indicate exploitation, data exfiltration, or attempts to relay NTLM credentials to a remote malicious SMB server.
This rule monitors network connection events for outbound traffic to known tunneling, development, and hosting platforms often abused by adversaries for command and control or unauthorized data egress. The rule specifically excludes common browsers, development tools, and package managers to focus on unexpected processes initiating these connections.
Detects network and process execution activity involving Google or Microsoft OAuth2 token endpoints from non-browser and non-trusted processes. This behavior is indicative of potential token theft or session hijacking attempts, where malicious tools (e.g., curl, python) are used to access authentication endpoints to bypass standard user interaction.
Detects network activity initiated by the WinSCP utility, or DNS queries and HTTP requests directed toward easyupload.io, a common file-sharing site. This behavior may indicate an adversary staging or exfiltrating data to an external, potentially unauthorized location.
Page 174 of 280