Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,879 detections
Filters
Last updated
All Time
Detection languages
2,954
1,378
313
289
239
Contributors
1,807
1,529
1,304
180
173
Categories
20,462
11,849
5,879
5,158
4,866
Platforms
3,747
1,857
1,076
782
160
Products / Services
2,241
1,434
1,273
746
582
MITRE Techniques
2,448
2,151
1,129
937
790
CVEs
19
15
9
7
5
IDS Classtypes
834
334
94
23
20
IDS Protocols
689
276
235
117
23
Detects suspicious OpenProcess calls initiated by common user applications (explorer.exe, winword.exe, outlook.exe) targeting svchost.exe, followed by an outbound network connection from the target svchost.exe to the file sharing service filen.io within a 30-minute window. This behavior is indicative of process injection used to facilitate network communication or data exfiltration under the guise of a system process.
Detects instances where the Windows script hosts wscript.exe or cscript.exe establish outbound network connections to common web ports (HTTP/HTTPS) on external IP addresses. This behavior is frequently associated with script-based malware, droppers, or C2 beacons.
Detects outbound HTTP requests to a known phishing infrastructure panel associated with the Montana Empire malware campaign, specifically targeting the /mentalite.php endpoint on pttvm.com.
This rule detects network connections or process command lines referencing 'easyupload.io' and 'limewire.com', as well as searches for 'eayupload'. These indicators are often associated with unauthorized file transfers or potentially malicious activity involving known file sharing platforms.
Detects DNS queries for domains that are visually or phonetically similar to popular software package registry domains (such as PyPI or npm). These are often used in typosquatting campaigns to trick users or automated systems into downloading malicious packages.
This rule detects network connections to phishing pages hosted on the workers.dev domain that are attempting to interact with EvilTokens device code API endpoints. These pages are known to implement developer hotkey prevention (F12 blocked, context menu disabled) to hinder in-browser analysis, indicating malicious intent.
This rule detects the execution of known remote access tools (such as AnyDesk, TeamViewer, or RustDesk) that are spawned as child processes from common web browsers. It correlates process creation events with subsequent network connections by these tools to public IP addresses over specific ports commonly used by remote access software, within a 30-minute timeframe of the process start.
This rule monitors for node.exe processes running from the AppData directory initiating multiple network connections to non-private (external) IP addresses over common web ports (80, 443, 8080, 8443). Running Node.js from user-writable temporary directories can be an indicator of malicious activity or the execution of unauthorized web applications attempting command and control communication.
This rule detects malicious activity associated with the TinyRCT backdoor, specifically focusing on the AppDomainManager injection technique. It monitors for the presence of known malicious file names, specific process command-line arguments involving VMware paths, and known file hashes connected to the chrome_setup.zip attack chain, as well as network communication with known malicious IP addresses.
Detects HTTP requests to Microsoft 365 search endpoints containing unusually long query strings. Such patterns may indicate automated data extraction, exfiltration over alternative protocols, or unauthorized information harvesting via search parameters.
This rule detects potential data exfiltration through the Bing Image Search 'search-by-image' feature. It identifies web traffic to Bing that contains an 'imgurl' parameter, decodes the URL, and filters out legitimate Microsoft-related domains. It then flags suspicious, potentially encoded file paths or data structures that might indicate the use of this public service to exfiltrate or host staging data.
This rule detects potential Server-Side Request Forgery (SSRF) exploitation where Bing's 'search by image' functionality is abused to fetch external, non-Microsoft controlled URLs. The query monitors web proxy logs for specific Bing search parameters ('cbir=sbi' and 'imgurl') and filters out requests to trusted domains, effectively identifying attempts to use the search engine as an intermediary for unauthorized external web requests. The rule further correlates these hits with Microsoft Copilot interaction logs to identify if the activity is associated with authenticated Copilot user sessions.
Microsoft Secure Score added a recommendation to block outbound traffic from mshta.exe in Microsoft Defender for Endpoint. This reduces risk from attacks using mshta.exe, requires admin action to enable, and impacts compliance monitoring and data access.
This rule monitors for malicious Chrome extension activity involving the redirection of address bar inputs to an unauthorized domain (perplexity-ai.online). It identifies indicators of compromise across device network logs (connectivity to the malicious C2), file system events (presence of the identified malicious extension identifier), and generic device events (log entries containing the malicious extension ID or C2 URL). This pattern is indicative of a browser-based keystroke exfiltration attack.
Detects a Node.js process, spawned as a child of an IDE (e.g., VS Code, Cursor), that accesses local AWS configuration or credential files followed by an outbound network connection to a non-AWS destination. This behavior is indicative of potential cloud credential exfiltration via malicious Model Context Protocol (MCP) server execution.
This rule detects the execution of common command-line interface tools (such as PowerShell, cmd, wscript, and certutil) spawned by the SimpleHelp remote support binary ('simplehelp.exe'). It also monitors for specific network connections associated with the SimpleHelp infrastructure (IP 96.126.130.126 on port 58942) that may indicate remote support activity or misuse of the platform.
Detects execution of the SharpADWS reconnaissance tool or suspicious outbound network connections to Active Directory Web Services (ADWS) port 9389. This activity is used by threat actors, such as Mustang Panda, to perform Active Directory reconnaissance by bypassing standard LDAP logging.
Detects network connections to Zoho WorkDrive or Zoho Accounts from non-standard or suspicious processes. The rule identifies potential unauthorized data exfiltration or cloud access by flagging processes running from temporary or user-writable directories (e.g., AppData, ProgramData), processes known to be associated with specific threats, or processes exhibiting signs of binary sideloading based on their parent process ancestry.
Detects browser network events matching Tycoon2FA WebSocket interactions used to silently stream stolen session cookies back to the AiTM proxy backend. The rule specifically looks for WebSocket connections (wss:// or ws://) with a path containing '/socket.io/?EIO=' initiated by 'chrome.exe' or 'msedge.exe'.
This rule detects network connections from devices to a specific IP address (62.102.148.212) and a set of associated ports (37393, 45839, 38471, 12345, 4444, 5555). This IP address and these ports are known indicators of compromise for the Remcos Remote Access Trojan (RAT) Command and Control (C2) infrastructure. Detection of such connections indicates potential Remcos RAT activity within the environment.
Detects potential execution chains related to QR code phishing (Quishing) by monitoring for suspicious process creation or outbound network connections originating from document readers, office applications, and QR scanner utilities. It covers three primary vectors: suspicious process spawning (e.g., Office apps launching cmd or powershell), non-standard network connections from document readers, and malicious URL-based LNK files spawned via explorer.exe.
Page 185 of 280