Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,879 detections
Filters
Last updated
All Time
Detection languages
2,954
1,378
313
289
239
Contributors
1,807
1,529
1,304
180
173
Categories
20,462
11,849
5,879
5,158
4,866
Platforms
3,747
1,857
1,076
782
160
Products / Services
2,241
1,434
1,273
746
582
MITRE Techniques
2,448
2,151
1,129
937
790
CVEs
19
15
9
7
5
IDS Classtypes
834
334
94
23
20
IDS Protocols
689
276
235
117
23
Detects potential execution chains related to QR code phishing (Quishing) by monitoring for suspicious process creation or outbound network connections originating from document readers, office applications, and QR scanner utilities. It covers three primary vectors: suspicious process spawning (e.g., Office apps launching cmd or powershell), non-standard network connections from document readers, and malicious URL-based LNK files spawned via explorer.exe.
This rule detects potentially malicious behavior associated with web browser processes, including the execution of Python scripts, the loading of browser extensions from non-standard directories like AppData or Temp, the creation of Python scripts by browsers in temp folders, and outbound network connections by Python processes following browser activity. These patterns are often associated with browser-based exploitation, extension-based malware, or initial access stages where a browser is used as a conduit for malicious code execution.
Detects anomalous outbound network connections initiated by media server processes (Jellyfin, FFmpeg, or Nextcloud) immediately following an inbound video file upload (AVI) to the media server's API, indicative of post-exploitation activity related to the PixelSmash (CVE-2026-8461) heap out-of-bounds write vulnerability.
Detects the use of rclone.exe to exfiltrate files to Dropbox, specifically looking for process execution patterns and network connections to Dropbox API endpoints consistent with the Gamaredon PteroBox exfiltration module.
Detects a suspicious multi-stage infection sequence associated with DcRAT, characterized by a process spawning a child with references to image files (.jpg/.jpeg), followed by the loading of an unsigned DLL from the same directory, and culminating in a TLS network connection within a narrow time window.
This rule monitors for suspicious activity originating from Langflow-related web service processes (langflow, uvicorn, gunicorn, python). It detects the spawning of unexpected OS-level child processes (like shell interpreters), creation of suspicious files in temporary directories (e.g., /tmp, /dev/shm), and outbound network connections to known command-and-control (C2) infrastructure associated with recent Langflow exploitation attempts (CVE-2026-33017).
Detects endpoint browser and email client processes initiating network connections to domains and IP addresses associated with HolaBrief and LoopedIn open-redirect infrastructure, commonly leveraged in invoice-themed phishing campaigns.
Detects network connection attempts or DNS queries to a set of specific domains ('holabrief.com', 'loopedin.io') that are known to be associated with suspicious activity or potential command and control infrastructure.
Detects potential phishing activity involving a two-hop open-redirect chain. The rule monitors for an initial navigation to known SaaS platforms (HolaBrief or LoopedIn), followed within one minute by an outbound request to an external destination where the SaaS domain is present in the HTTP referrer header, indicating a redirect-based phishing mechanism.
This rule detects outbound network connections to the specific IP address 38.60.253.35 on port 8084. Such traffic is highly suspicious and indicative of potential communication with a Command and Control (C2) server.
Detects the SNOWLIGHT dropper (disguised as the Windows Update Service 'wusvc.exe') attempting to establish an outbound network connection to a known malicious C2 infrastructure (38.60.253.35) on port 8084. The rule also accounts for the use of non-standard port communication and monitors for suspicious process masquerading outside of protected system directories.
Detects the execution of unauthorized network scanning tools (e.g., netscan.exe, n.exe), usage of reconnaissance PowerShell scripts like Invoke-ShareFinder, or the creation of common reconnaissance artifacts such as 'delete.me' or 'shares.txt'. The rule monitors Sysmon process creation, network connection events, and file creation events to identify activities consistent with internal network discovery and lateral movement preparation.
Detects DNS resolution and network connections to known infrastructure associated with the StegoAd campaign, including exfiltration (mitarchive.info) and C2 (liveupdt.com, dealctr.com, ipaglov.com) domains. The rule monitors activity from common browser and scripting engine processes.
This rule detects abnormal, high-frequency network connection patterns originating from common web browser processes (msedge.exe, chrome.exe, brave.exe). It identifies scenarios where a browser process makes repetitive connections to a very small set of non-standard external domains, excluding common legitimate browser-related traffic. This behavior is indicative of background polling or C2 activity, such as that observed in malicious browser extensions (e.g., StegoAd) following an activation period.
Detects post-exploitation activities related to the PHP 8.5.7 CVE-2025-15661 StreamBucket SOAP vulnerability. This rule monitors for PHP worker processes spawning shells, writing executable files to suspicious directories, executing system binaries on Windows, or initiating outbound network connections on non-standard ports, including specific proof-of-concept markers.
This rule detects outbound network connections to URLs associated with common file sharing services (e.g., Dropbox, Mega, Gofile) or temporary email providers (e.g., Temp-Mail). Such connections can indicate data exfiltration attempts, use of unsanctioned services, or communication with command and control infrastructure.
This rule detects network connections from devices to a predefined list of known malicious domains. It identifies attempts by internal systems to communicate with command and control servers, phishing sites, or other infrastructure associated with threat actors.
This rule detects potentially malicious data exfiltration activity. It identifies sequences of events where a process performs file enumeration (directory listing), followed by the creation of a ZIP or RAR archive in temporary or local application data directories with randomized filenames. Finally, it correlates this behavior with subsequent outbound network connections from the same process to known cloud storage and file-sharing providers, flagging anomalous archive creation rates.
This rule detects network connections and email URLs that match known typosquatted patterns of Microsoft domains. It aims to identify potential phishing attempts or traffic directed to infrastructure used by the 'Bulletproof Redirect Engine' masquerading as legitimate Microsoft services. The logic filters out legitimate Microsoft-related URLs to minimize false positives.
Detects network connections from suspicious or unexpected processes to common public webhook and automation services, which may indicate data exfiltration or automated C2 communication.
This rule detects network activity associated with the easy-day-js Mastra npm supply chain attack. Specifically, it identifies data exfiltration over TLS to a secondary C2 server (23.254.164.123:443) and the download of a stage-2 payload from a primary C2 server (23.254.164.92:8000) via HTTP, looking for the URI '/update/49890878'.
Page 186 of 280