Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,879 detections
Filters
Last updated
All Time
Detection languages
2,954
1,378
313
289
239
Contributors
1,807
1,529
1,304
180
173
Categories
20,462
11,849
5,879
5,158
4,866
Platforms
3,747
1,857
1,076
782
160
Products / Services
2,241
1,434
1,273
746
582
MITRE Techniques
2,448
2,151
1,129
937
790
CVEs
19
15
9
7
5
IDS Classtypes
834
334
94
23
20
IDS Protocols
689
276
235
117
23
Detects devices making a high volume (5 or more per hour) of successful network connections to remote URLs containing 'update' or 'patch' on port 443 (HTTPS). This could indicate legitimate system updates, but also potentially malicious update checks or beaconing activity.
This rule detects network traffic directed at 'goldsky.arweave.net', a domain known to be used by the TukTuk malware as a dead-drop resolver. Adversaries often use legitimate web services like Arweave to host command-and-control (C2) configuration data, such as secondary C2 IP addresses or domains, allowing them to redirect infected hosts to backend infrastructure while masking the traffic as legitimate web communication.
Detects a Python loader process spawned by VS Code or Node.js environments that exhibits suspicious network activity indicative of fetching the InvisibleFerret infostealer, correlated with the installation of Python dependencies via 'pip' within a 10-minute window. This behavior is associated with the Lazarus Group 'Contagious Interview' campaign.
Detects outbound network connections to common Large Language Model (LLM) APIs (OpenAI, Anthropic, Google) or local LLM instances (Ollama) from processes that are not standard web browsers, common IDEs, or typical development/scripting tools. This behavior may indicate an attempt to exfiltrate sensitive data or interact with LLM services using unauthorized or hidden processes.
Detects anomalous lateral movement or network pivoting activity originating from an internet-facing Nginx server. The detection identifies an incoming HTTP POST request from an external IP address followed immediately by an outbound network connection from that same Nginx server to an internal RFC1918 host on the FastCGI port (9000). This behavior is consistent with the 'Velvet Ant' operation's technique of abusing proxy_pass configurations to relay traffic into isolated internal network segments via FastCGI request-chaining.
This rule detects potential beaconing or re-registration activity associated with the JDY/KV-botnet by monitoring network connections to known Tor control/relay ports (9001 and 9050). The detection identifies endpoints making high-volume, multi-destination connections to external IPs over these specific ports, a pattern indicative of botnet nodes attempting to re-establish C2 communication after infrastructure disruption or actively recruiting new nodes.
Detects network connection attempts directed toward RFC 1918 private IP address spaces (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) and localhost (127.0.0.0/8) that do not involve common Windows file sharing ports (TCP/445 and TCP/139). This behavior may indicate lateral movement, internal reconnaissance, or the use of non-standard protocols for internal communication.
Detects execution of Python interpreters used as an SMB server, specifically where the implementation is not using the standard SMB port (445). This behavior is often associated with the use of tools like Impacket's smbserver.py for lateral movement, staging, or data exfiltration, attempting to blend in by using non-standard ports.
Detects HTTP GET requests to a specific file path (docs.zip) on the Ukrainian government website (drs.gov.ua), identified as an activity associated with the Turla threat group's STOCKSTAY malware component.
Detects outbound proxy traffic originating from identified AI and automation agent user-agents (e.g., ChatGPT, Perplexity, Claude, etc.) attempting to access sensitive URI paths, such as credential files, SSH keys, configuration files, or cloud-hosted secrets. This may indicate an attempt to exfiltrate sensitive data to or through AI platforms.
This rule identifies outbound network connections from devices to public IP addresses using ports commonly associated with the Tor network (9001, 9030, 9050, 9051). These ports are frequently used for Tor relay, bridge, and control functionality, and connections to them from managed endpoints may indicate unauthorized use of the Tor network for anonymity or malicious command-and-control communication.
This rule detects HTTP POST requests containing a Content-Length header value indicating a body size exceeding 10MB. Large POST requests may indicate data exfiltration, large file uploads, or misuse of HTTP channels for data transfer to external destinations.
Detects HTTP traffic patterns associated with default Cobalt Strike malleable C2 profiles, specifically identifying requests to /submit.php or /dpixel and the use of the default 'Mozilla/4.0 (compatible; MSIE 8.0;' User-Agent string.
Detects outbound ICMP Type 8 (Echo Request) packets that contain an abnormally large payload (greater than 64 bytes). This behavior is characteristic of ICMP tunneling, where attackers encapsulate data within the payload of ICMP packets to bypass network security controls or establish covert command and control communication.
Detects outbound HTTP POST requests with specific URI patterns (/rob/ or /ins/) that are indicative of TrickBot malware command and control (C2) check-in activity.
Detects HTTP traffic patterns characteristic of Emotet malware command and control (C2) beaconing, specifically looking for POST requests with random alphanumeric URIs (4-16 characters) and a specific Accept-Encoding header (gzip, deflate).
Detects continuous command and control (C2) beaconing activity from Remote Monitoring and Management (RMM) tools over non-standard high ports. This rule identifies RMM processes (rmm, agent, client*.exe) establishing frequent network connections to remote IPs on ports greater than 1024, excluding common ports like 3389 (RDP), 8080, and 8443, indicating potential malicious use of RMM software for C2.
Detects network activity (DNS queries, TLS SNI, and HTTP requests) directed towards known attacker-controlled command-and-control domains associated with AsyncRAT and ScreenConnect abuse.
Detects high-frequency ICMP Echo Requests (Type 8) directed from internal networks to external destinations with oversized payloads (greater than 200 bytes). This pattern is indicative of ICMP tunneling, which is often used by adversaries for covert command-and-control (C2) communications or data exfiltration, bypassing standard filtering or monitoring.
Detects network connection activity on common C2 ports from processes executing outside of standard system directories. The rule filters out known system paths on macOS and identifies processes that establish multiple connections to non-private IP addresses, assigning a risk score based on the volume of connections and the duration of the activity to identify potential command and control (C2) beaconing behavior.
This rule detects unusually large network uploads from devices. It identifies successful network connections where individual transfers exceed 100MB and aggregates these transfers by account name and hour. The rule then flags any account that has uploaded a total of 1TB or more within a single hour. This pattern could indicate data exfiltration, unauthorized data synchronization, or other malicious activities involving significant data transfer volumes.
Page 176 of 280