Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,879 detections
Filters
Last updated
All Time
Detection languages
2,954
1,378
313
289
239
Contributors
1,807
1,529
1,304
180
173
Categories
20,462
11,849
5,879
5,158
4,866
Platforms
3,747
1,857
1,076
782
160
Products / Services
2,241
1,434
1,273
746
582
MITRE Techniques
2,448
2,151
1,129
937
790
CVEs
19
15
9
7
5
IDS Classtypes
834
334
94
23
20
IDS Protocols
689
276
235
117
23
This rule detects scenarios where Microsoft Teams initiates a potential screen-sharing session (via outbound network connections on specific ports) followed shortly by the access of VPN configuration files on the same host. This sequence may indicate an attacker using screen-sharing to view credentials or configuration details and subsequently attempting to utilize a VPN client.
Detects processes running from suspicious, writable directories (Temp, AppData, Downloads) that simultaneously load the .NET Common Language Runtime (clr.dll) and initiate network connections. This behavior is indicative of a downloaded binary or payload executing managed code to perform C2 communication.
Detects unauthorized usage of the RustDesk remote access tool, including process execution from suspicious parents, service installation, outbound connections to known relay infrastructure, and DNS queries for RustDesk relay domains originating from non-browser processes. This rule is designed to identify secondary or redundant remote access channels potentially established by adversaries.
This rule detects suspicious outbound DNS queries originating from a device that are not directed to common public DNS servers (Google DNS, Cloudflare DNS). The rule specifically flags queries where the remote DNS name contains keywords like 'malware', 'c2', or 'c&c', and where at least 5 such queries occur within an hour from the same device. This pattern can indicate potential malware communication or command and control (C2) activity.
This rule detects a high volume of successful network connections to common web ports (80, 443, 8080, 8443) where the remote URL contains keywords like 'version' or 'software'. This pattern could indicate an adversary performing reconnaissance to identify installed software and their versions, potentially looking for vulnerabilities or specific applications to target. The threshold of 10 such activities within an hour for a single device is set to flag anomalous behavior.
This rule detects devices making a high volume of successful network connections to GitHub's API endpoints (api.github.com or api.releases). A count of 5 or more successful connections within an hour from a single device is considered suspicious and could indicate data exfiltration, automated tooling, or unusual development activity.
This rule detects activities associated with the OceanLotus (APT32) supply-chain compromise, specifically targeting the SPECTRALVIPER loader chain. It identifies the masqueraded execution of 'IntelAudioService.exe' and specific sideloading carriers (AutoCad242.exe, Genuine.exe, Updater.exe) utilizing the '-uiDll' flag, the loading of the 'DtlCrashCatch.dll' malicious module, and network beaconing to known APT32 C2 infrastructure.
This rule detects network communication with known malicious command-and-control (C2) infrastructure identified by specific domains and IP addresses. The detection logic calculates a confidence score based on the presence of identified malicious C2 domains or IPs, specific suspicious cookies (zd_cs_pm, euconsent-v2), and known C2 URI paths.
Detects Server-Side Request Forgery (SSRF) attempts exploiting URL parser differentials. Attackers append a double-slash sequence to a legitimate github.com blob URL to trick the backend into resolving an absolute local filesystem path. The rule specifically targets sensitive paths such as /proc/self/environ, /var/task/, and application source files to perform Local File Read (LFR) or access internal cloud metadata services.
This rule detects outbound network traffic from an instance or container to the Google Cloud metadata service (metadata.google.internal or 169.254.169.254). Such activity is highly indicative of Server-Side Request Forgery (SSRF) exploitation, where an attacker attempts to retrieve service account credentials or instance metadata from an internal service.
This rule detects network connections to known cloud storage, file hosting, and webhook services (Discord, Pastebin, Dropbox, Telegram, AnonFiles) initiated by processes other than standard web browsers. Such behavior is often indicative of data exfiltration or C2 activity using legitimate web services to blend in with normal traffic.
Detects outbound network connections to Fastly CDN IP ranges originating from suspicious file paths (Temp or ProgramData) or common LOLBins (wscript.exe, powershell.exe) often utilized by the Kimsuky threat group for NUKESPED backdoor C2 communication.
Detects high-volume outbound network scanning activity from a single internal source device. The rule identifies anomalous behavior characterized by rapid connection attempts to a large number of distinct destination IPs and ports, consistent with scanning patterns observed in botnets like JDY, which often target edge network infrastructure (Cisco, Ubiquiti, Draytek).
Detects unexpected network connections initiated by the Local Security Authority Subsystem Service (lsass.exe) to the localhost (127.0.0.1) on ports other than standard SMB ports (445 or 139). LSASS should typically only communicate locally via RPC or LPC for authentication services, and anomalous network activity from this process may indicate credential theft attempts, process injection, or unauthorized memory access activities.
Detects network connections initiated by Windows Nearby Sharing processes (quick_share.exe, nearby_sharing.exe, or NearbyShare.exe) to non-standard ports, potentially indicating unauthorized file transfers or exfiltration over unusual network channels.
Detects outbound web traffic directed towards common password management services (e.g., 1Password, LastPass, Bitwarden) originating from user agents associated with AI and LLM tools (e.g., OpenAI, Claude, Copilot). This combination of destinations and user agents is highly anomalous and may indicate potential credential exfiltration or interaction with automated agents acting on behalf of a user to access sensitive vault data.
Detects network connections originating from a process and directed towards the local loopback interface (127.0.0.1 or ::1) on non-privileged, non-SMB ports (>= 1024 and != 445). This pattern can identify inter-process communication (IPC) over local network sockets which may be used by malware or malicious scripts to bypass security controls or communicate with local services.
Detects network traffic associated with the Turla group's STOCKSTAY malware, specifically identifying outbound WebSocket upgrade requests directed to the known command-and-control domain weatherdataai.theworkpc.com.
Detects CI/CD package manager traffic (e.g., pip, npm) attempting to connect to domains that mimic legitimate PyPI or npm registry domains. This behavior is indicative of a dependency confusion or supply chain attack where an adversary uses typosquatted or phantom-squatted domains to intercept or redirect package requests.
This rule detects outbound HTTP traffic generated by the WinHTTP library, specifically when the User-Agent identifies as WinHttp.WinHttpRequest. This pattern is indicative of potential post-exploitation activity, such as command-and-control communication or data exfiltration, originating from a process associated with an exploited Excel document (CVE-2025-60727).
Detects outbound HTTP POST requests to suspicious URIs and subsequent inbound responses containing executable binary (PE) signatures, characteristic of Emotet malware command-and-control (C2) activity.
Page 178 of 280