Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,879 detections
Filters
Last updated
All Time
Detection languages
2,954
1,378
313
289
239
Contributors
1,807
1,529
1,304
180
173
Categories
20,462
11,849
5,879
5,158
4,866
Platforms
3,747
1,857
1,076
782
160
Products / Services
2,241
1,434
1,273
746
582
MITRE Techniques
2,448
2,151
1,129
937
790
CVEs
19
15
9
7
5
IDS Classtypes
834
334
94
23
20
IDS Protocols
689
276
235
117
23
Detects network connections to known Telegram or Steam community profile pages used by the Vidar information stealer as dead-drop resolvers to retrieve secondary C2 infrastructure. The rule specifically filters for non-browser processes to reduce noise from legitimate user traffic.
Detects artifacts and activity related to the exploitation of CVE-2026-55200 in libssh2. The rule monitors for the creation or execution of identified libpwn exploit harness files and scripts, as well as suspicious network activity involving TCP port 2222, which is the default port for the PoC rogue SSH server. It also correlates the appearance of these exploit files with subsequent outbound SSH connections.
Detects the exploitation or configuration manipulation of the Firefox browser.smartwindow.enabled feature, which can be abused by an attacker to exfiltrate sensitive browser data such as history, tab URLs, and secret query-string parameters to a remote endpoint. The rule monitors for network connections containing known exfiltration path signatures, connections to hardcoded PoC server addresses, or the modification of configuration settings related to the SmartWindow feature.
This rule detects potential command and control (C2) activity associated with a known npm RAT, identified by network connections to specific C2 infrastructure (95.216.92.207:8080) or DNS resolution of 'nvidiadriver.net'. The rule specifically flags these events when performed by common execution tools like 'python.exe' or 'chost.exe', or when the process image is running from a temporary directory, which is a common persistence or execution indicator for malware.
This rule detects the installation of a new Microsoft Edge extension followed by suspicious network activity from the msedge.exe process within 24 hours. The suspicious activity includes the fetching of common steganography-friendly file types (e.g., .png, .webp, .woff2, .conf) from known StegoAd C2 domains. This behavior is indicative of a malicious extension retrieving payloads hidden in legitimate-looking media files or beaconing to attacker infrastructure.
Detects unauthorized or suspicious processes reading sensitive credential files (AWS, .env, etc.) and subsequently initiating a successful network connection to an external destination within a 5-minute window. This behavior is a common indicator of credential exfiltration.
This rule detects outbound HTTP requests to Bing's 'searchbyimage' functionality that contain an image URL pointing to a domain outside of Microsoft or Bing. This behavior is associated with a potential data exfiltration technique (referenced as CVE-2026-42824) where internal information is encoded into an image URL and passed to an external, attacker-controlled, or third-party web service via the Bing search engine to bypass traditional network egress controls.
Detects outbound requests to the Bing 'searchbyimage' endpoint where the 'imgurl' parameter points to an external (non-trusted) domain. This pattern is indicative of potential SSRF exploitation, such as the described SearchLeak (CVE-2026-42824) vulnerability chain, where an attacker uses Bing's search functionality as a proxy to reach internal or restricted infrastructure.
This rule detects processes running from non-standard locations (specifically within application data directories) that perform both file system write operations for media or image formats (indicative of screen, audio, or video capture) and simultaneously initiate outbound network connections to non-private IP addresses. This behavior is often characteristic of spyware, unauthorized remote access tools, or malware attempting to capture and exfiltrate user activity.
This rule identifies network activity or DNS queries associated with the known malicious domain 'perplexity-ai.online'. It monitors both endpoint network event logs and DNS logs to alert on any attempts to establish communication with or resolve this specific domain.
This rule monitors for suspicious activity originating from RMM software (specifically SimpleHelp) and associated TaskWeaver processes, including process execution, service/scheduled task installation, file creation consistent with Djinn Stealer, and non-standard outbound network connections.
Detects a malicious Chrome extension exfiltrating keystrokes entered into the browser's Omnibox. The rule monitors for high-frequency GET requests (indicative of keystroke-by-keystroke transmission) from chrome.exe to a specific C2 domain (perplexity-ai.online), correlated with DNS resolution of that domain within the same session.
Detects potential data exfiltration by monitoring interpreter processes (Python, Node.js) that access sensitive local credential/configuration files and subsequently connect to known cloud storage or code repository APIs (Dropbox, GitHub, Google Cloud). The rule correlates file access events with network connection activity.
Detects instances where scripting engines (Python or Node.js) access known SSH private key files and subsequently initiate a successful network connection to a non-private IP address within a 60-second window. This behavior is indicative of potential credential exfiltration or unauthorized remote access.
Detects network connections from internal endpoints to Filen.io cloud storage domains and subdomains. The rule specifically flags interactions involving common API endpoints for file operations (upload, download, directory listing) as 'Critical' risk, while generic traffic to the domain is classified as 'High' risk.
Detects Microsoft Office applications spawning suspicious child processes (e.g., cmd.exe, rundll32.exe) or initiating network connections to WebDAV paths, which may indicate exploitation of ActiveX OLE auto-execution vulnerabilities.
Campaign converting compromised FortiGate firewalls into credential stealers
Detects suspicious processes commonly associated with malicious activity establishing outbound network connections to Azure Web Apps domains. The rule aggregates connections to identify potential beaconing behavior by monitoring connection frequency and duration, flagging activity initiated by binaries frequently used for living-off-the-land attacks such as powershell.exe, rundll32.exe, and others.
Detects the deployment and activity of the Remcos Remote Access Trojan (RAT) as part of the BQTLock (BaqiyatLock) attack chain. This rule monitors for process injection into critical Windows processes, malicious Run key persistence entries, non-standard outbound TLS communication from non-browser processes, and the creation of potential keylogging artifacts in the AppData directory.
Detects BQTLock (BaqiyatLock) ransomware activities involving the exfiltration of stolen data, credentials, or infection reports. The rule identifies suspicious outbound network connections to known C2-enabling web services (Telegram Bot API and Discord webhooks) initiated by the BQT.exe or start.exe processes, which are typical indicators of this ransomware variant.
This rule detects high-volume or repeated outbound connections to Mega cloud storage domains (mega.nz, mega.co.nz, etc.) by processes that are not identified as standard web browsers. Such activity may indicate data exfiltration, automated file staging, or unauthorized use of cloud storage services.
Page 177 of 280