Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,879 detections
Filters
Last updated
All Time
Detection languages
2,954
1,378
313
289
239
Contributors
1,807
1,529
1,304
180
173
Categories
20,460
11,847
5,879
5,158
4,866
Platforms
3,747
1,857
1,076
782
160
Products / Services
2,241
1,434
1,273
746
582
MITRE Techniques
2,448
2,151
1,129
937
790
CVEs
19
15
9
7
5
IDS Classtypes
834
334
94
23
20
IDS Protocols
689
276
235
117
23
This rule detects potentially malicious use of libcurl or curl.exe involving mTLS-related flags (e.g., --cert, --key, --cacert) in non-browser processes. It specifically flags instances where such processes perform repeated HTTPS connections to remote hosts, which may indicate exploitation of CVE-2026-8932 related to mTLS connection reuse and authentication bypass.
Detects the use of PowerShell to perform automated reconnaissance against Microsoft Graph API endpoints, specifically targeting HR, payroll, and personal user data. This activity is associated with post-compromise behaviors seen in campaigns like Payroll Pirate, where attackers utilize compromised credentials to harvest sensitive organizational information.
Detects anomalous outbound proxy requests to TON blockchain API endpoints (tonapi.io or toncenter.com) attempting to call the 'get_domain' method. This behavior is associated with the TONResolver RAT, which uses a specific, hardcoded smart contract address to dynamically resolve its C2 server hostname, effectively bypassing static domain-based security filters.
Detects network connections to the Telegram Bot API (api.telegram.org) originating from processes executing from potentially suspicious or non-standard locations (Temp, AppData, ProgramData), excluding the legitimate Telegram Desktop client. This pattern is commonly observed in Remote Access Trojans (RATs) such as the Millenium RAT and other malware families utilizing Telegram as a C2 channel.
Detects outbound HTTP POST requests to dynv6 dynamic DNS providers containing specific multipart form data patterns, including filenames like 'Info.txt', indicative of data exfiltration by the Kimsuky threat group using custom C2 staging scripts.
Detects network requests originating from common package manager User-Agents (e.g., pip, npm, cargo) targeted at external domains that do not match known legitimate repositories. This behavior is indicative of potential command and control (C2) activity or malicious package staging using lookalike or arbitrary domains to bypass standard package registry traffic patterns.
Detects SSH client processes linked to libssh2 (such as ssh, curl, sftp, scp) exhibiting sustained high CPU usage (>=95%) for more than 60 seconds while maintaining an active outbound SSH connection. This behavior is consistent with the denial-of-service vulnerability CVE-2026-55199, where an attacker-controlled SSH server provides an excessively large extension count during the key exchange process, triggering an infinite loop within the libssh2 library.
Detects browser processes performing DNS resolution for Bing search endpoints immediately following access to M365 Copilot services within the same process storyline. This pattern is indicative of a SearchLeak exploitation chain where an adversary leverages M365 Copilot search to perform SSRF, using Bing as a proxy for data exfiltration.
This rule detects potential command and control (C2) beaconing activity by identifying devices communicating with known suspicious remote IP addresses at regular, repeating intervals. It calculates the time difference between consecutive connections to specific suspicious IPs and identifies devices that establish at least three connections within one-hour bins, adhering to a 1 to 15-minute heartbeat interval.
This rule detects indicators of activity associated with a Firefox smart_window PoC, specifically designed to exfiltrate private browsing URLs. It monitors for suspicious network connections from the Firefox process to port 8765, the creation of PoC-related scripts, and the execution of associated Node.js processes or command lines.
Detects outbound network connections to common Mythic C2 ports initiated by processes identified as compiler-related binaries (Go, Zig, Rust) or binaries running from suspicious, user-writable directories (Temp, AppData, etc.). This behavior is consistent with the execution of staging or initial implants associated with the Mythic post-exploitation framework.
Detects artifacts, execution of harness tooling, and post-exploitation behavior associated with CVE-2026-55200 in libssh2. The rule monitors for the presence of known exploit filenames (libpwn), suspicious Python script execution, unexpected shell spawning from SSH-enabled clients, and outbound network connections to non-standard ports typical of exploit scaffolding.
This rule detects two potentially malicious activities related to SSH: first, specific utilities (e.g., luserput, blacklist, ssh) initiating outbound connections to internal network CIDR ranges over port 22, which may indicate lateral movement; second, the creation or modification of the .ssh/authorized_keys file, which is a common technique for establishing persistence or unauthorized access.
Detects DNS queries for domains that mimic software package naming conventions (e.g., [name]-utils, [name]-api, [name]-client) that do not resolve to known legitimate registry domains. This behavior is indicative of potential dependency confusion attacks or malicious package installation attempts, where an attacker registers a domain designed to lure developers into downloading malicious code.
Detects Python processes spawned by development tools (VSCode, Cursor) or Node.js that are engaged in suspicious activities, specifically communicating with the Telegram Bot API or uploading large amounts of data, often accompanied by file staging (ZIP archive creation). This behavior is characteristic of the InvisibleFerret information stealer.
This rule identifies potential BRICKSTORM command and control (C2) activity by detecting sustained beaconing patterns to known public DNS-over-HTTPS (DoH) providers (8.8.8.8, 1.1.1.1) over port 443. It buckets network connections into 10-minute windows and flags source devices exhibiting frequent, repetitive traffic patterns, enriched with asset context to prioritize alerts from edge appliances such as firewalls, NAS devices, or storage sync services.
Detects the Yuta/Glove stealer malware (winupdate.exe) communicating with Discord webhooks or API endpoints. This behavior is indicative of data exfiltration or receipt of interactive RAT commands, such as shell, webcam, keylogger, and system tracing.
Detects network communication behavior indicative of Yuta or Glove Stealer malware, where suspicious processes (specifically 'winupdate.exe' in common staging directories or Python-based requests) exfiltrate data via HTTP POST requests to known attacker-controlled infrastructure platforms like Discord or Telegram.
This rule detects multi-stage behavior associated with the BQTLock ransomware, including C2 network communication, execution of loaders (PyInstaller-based) from common writable directories, suspicious child process spawning, unauthorized OpenSSH service usage potentially indicating privilege escalation, and mass file encryption indicated by both specific file extensions and bulk rename heuristics.
This rule identifies potential Command and Control (C2) beaconing activity by detecting recurring, consistent HTTP(S) requests from internal hosts to unknown or newly seen external destinations, characterized by stable time intervals and low variance in response sizes. The detection logic filters out common User-Agents, indicating non-browser or automated traffic often associated with malware communication.
This rule detects network connections from devices to a predefined list of known malicious domains. It identifies attempts by internal systems to communicate with command and control servers, phishing sites, or other infrastructure associated with threat actors.
Page 175 of 280