Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,879 detections
Filters
Last updated
All Time
Detection languages
2,954
1,378
313
289
239
Contributors
1,807
1,529
1,304
180
173
Categories
20,462
11,849
5,879
5,158
4,866
Platforms
3,747
1,857
1,076
782
160
Products / Services
2,241
1,434
1,273
746
582
MITRE Techniques
2,448
2,151
1,129
937
790
CVEs
19
15
9
7
5
IDS Classtypes
834
334
94
23
20
IDS Protocols
689
276
235
117
23
Detects HTTP traffic patterns characteristic of Emotet malware command and control (C2) beaconing, specifically looking for POST requests with random alphanumeric URIs (4-16 characters) and a specific Accept-Encoding header (gzip, deflate).
Detects repeated use of the FTP 'STOR' command to transmit data to an external host within a short timeframe. The STOR command is used in the File Transfer Protocol (FTP) to upload a file to the server. An unusual frequency of this command toward external destinations may indicate data exfiltration.
This rule detects HTTP responses that return an Android Package (APK) file (application/vnd.android.package-archive) to a client. This is indicative of potential mobile malware delivery or unauthorized application distribution.
Detects suspicious patterns of LLM API usage by monitoring outbound traffic to major LLM providers (OpenAI, Anthropic, Google, DeepSeek, Mistral, Cohere). The rule identifies potential API key theft ('LLMjacking') by flagging high request volumes from single keys, usage of the same key across multiple distinct source IP addresses, and direct outbound traffic bypassing established proxy/gateway configurations.
This rule detects outgoing HTTP POST requests containing patterns commonly associated with Emotet command-and-control (C2) communication, specifically identifying the use of an application/octet-stream content type combined with a specific, randomized URI path structure consisting of alphanumeric segments.
Detects outbound network traffic from internal hosts exhibiting characteristics of PowerShell-based download cradles, such as specific User-Agent strings or URL patterns associated with IEX DownloadString or Invoke-WebRequest.
Detects HTTP traffic patterns consistent with data exfiltration to major cloud storage providers (AWS S3, Azure Blob Storage, Google Cloud Storage) using common command-line interface tools like rclone, aws-cli, and AzCopy.
Detects the deployment of AdaptixC2 agents by monitoring for suspicious rundll32.exe process executions indicative of reflective DLL injection. This includes rundll32.exe loading DLLs from suspicious directories (Temp, AppData, ProgramData) with potential reflective loader flags or exported functions, often triggered by parent processes like msiexec.exe or consent.exe. The rule also monitors for direct outbound network connections from rundll32.exe to known AdaptixC2 command-and-control infrastructure.
Detects potential SSH reverse tunneling or SOCKS proxying, often used by threat actors like Akira or associated with Bumblebee loaders, to establish persistent C2 channels. The rule monitors process execution of plink.exe and ssh.exe with suspicious arguments (e.g., -R, -D, -N), network connections to known malicious C2 IP addresses, and SSH tunnel processes running as SYSTEM or spawned by non-interactive service-related processes.
Detects high volumes of network connections initiated by common file sharing processes such as AirDrop, sharingd, NearShare, or QuickShare. This behavioral pattern, characterized by a large number of successful connections or numerous unique remote IP addresses, may indicate unauthorized mass data collection, reconnaissance, or potential lateral movement attempts.
This rule detects suspicious outbound DNS queries originating from a device that are not directed to common public DNS servers (Google DNS, Cloudflare DNS). The rule specifically flags queries where the remote DNS name contains keywords like 'malware', 'c2', or 'c&c', and where at least 5 such queries occur within an hour from the same device. This pattern can indicate potential malware communication or command and control (C2) activity.
Detects when 'Cursor.exe' (a legitimate application) spawns common command-line utilities (cmd.exe, powershell.exe, pwsh.exe, curl.exe, wget.exe, certutil.exe, bitsadmin.exe) with command-line arguments indicative of downloading files from the internet (e.g., containing 'http://', 'https://', 'ftp://', '-o', '-OutFile', 'iwr', 'DownloadString', 'DownloadFile'). This could indicate malicious activity where 'Cursor.exe' is being abused to facilitate ingress tool transfer or execute malicious payloads.
This rule detects network connections on non-standard ports (2404, 4782) that are commonly associated with the Remcos Remote Access Trojan (RAT). It monitors outbound connections from suspicious process names or paths, such as those found in ProgramData, AppData, or Temp directories, and filters out internal RFC-1918 traffic.
Detects evidence of AsyncRAT infection involving process hollowing into RegAsm.exe. The rule monitors for suspicious PowerShell activity involving specific artifacts ('cap.ps1', 'ConsoleApp1') used to perform reflective assembly loading, attempts to add Windows Defender exclusions for RegAsm.exe, and subsequent suspicious outbound network connections from RegAsm.exe to known C2 infrastructure.
This rule detects potential credential theft from web browsers (Edge/Chrome) by monitoring access to the 'Login Data' SQLite database file. It correlates file access events with subsequent outbound HTTPS connections to non-Microsoft and non-Google domains initiated by the same browser process within a 10-minute window, which is indicative of exfiltration of stolen browser credentials.
Detects network connections to specific cloud service providers (Google Cloud PubSub/MQTT, Azure Service Bus) or common STUN/WebRTC ports (3478) initiated by processes other than standard web browsers or common communication applications.
Detects indicators associated with the 'smart_window' campaign targeting Firefox, which attempts to exfiltrate browser history and page content via unauthorized registry modifications, malicious file artifacts, and specific network communication patterns to localhost or external URLs.
This rule detects a sequence of events where a host initiates a network connection on port 1313 (a common port associated with certain web-based C2 or exploitation frameworks) followed shortly by an outbound network connection initiated by PowerShell within a 5-minute window. This behavior is indicative of a post-exploitation phase where an initial entry point leverages a malicious script or shell to establish persistent communication.
Detects browser-based network connections to URLs containing Google or Gmail branding where the resolved IP address does not match the expected Google IP address prefixes. This behavior is indicative of an Adversary-in-the-Middle (AiTM) phishing attack, where a user is being redirected to a malicious proxy server that mimics the legitimate Google login service to intercept credentials and MFA tokens.
Detects anomalous, high-volume data transfers to Telegram API endpoints (api.telegram.org, specific IP ranges), which is indicative of data exfiltration by malware such as KuinaExtractor. The rule monitors for cumulative outbound traffic exceeding 500MB within a 1-hour session window per process.
Detects two distinct suspicious patterns indicative of OAuth consent abuse and browser-based credential theft. The first pattern identifies non-Microsoft script interpreters or binaries initiating network connections to Microsoft's OAuth endpoints. The second pattern identifies unauthorized processes attempting to access or modify sensitive browser data files (e.g., 'Login Data', 'Cookies') which are typically reserved for browser-specific processes.
Page 179 of 280