Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,879 detections
Filters
Last updated
All Time
Detection languages
2,954
1,378
313
289
239
Contributors
1,807
1,529
1,304
180
173
Categories
20,460
11,847
5,879
5,158
4,866
Platforms
3,747
1,857
1,076
782
160
Products / Services
2,241
1,434
1,273
746
582
MITRE Techniques
2,448
2,151
1,129
937
790
CVEs
19
15
9
7
5
IDS Classtypes
834
334
94
23
20
IDS Protocols
689
276
235
117
23
Detects unauthorized network connection enumeration using netstat or direct socket connections originating from fltMC.exe, which is indicative of JFMBackdoor activity. The rule monitors for netstat execution by fltMC.exe, netstat spawned from executables within temporary directories, and suspicious outbound network connections originating directly from fltMC.exe.
Detects browser processes connecting to internal IP addresses followed by a connection to an external (non-whitelisted) destination within a 2-minute window. This behavior is indicative of potential data staging or exfiltration, where a web browser is used to access internal resources before transferring data to an external site.
Detects high-frequency access to sensitive web paths (e.g., /admin, /vault, /credentials) from common web browsers on a device. This activity may indicate malicious credential harvesting, administrative panel enumeration, or sensitive data exfiltration performed by an adversary or malicious browser extension.
Detects browser processes connecting to internal IP addresses followed by a connection to an external (non-whitelisted) destination within a 2-minute window. This behavior is indicative of potential data staging or exfiltration, where a web browser is used to access internal resources before transferring data to an external site.
This rule detects potential JDY botnet activity characterized by host fingerprinting and data exfiltration patterns. It looks for repeated POST requests to specific URI patterns ('/gate', '/report', '/scan') accompanied by a significant volume of outbound data, indicative of automated C2 communication or data staging. The rule aggregates metrics per host to identify high-volume exfiltration patterns and calculates a risk score based on the frequency of requests and the diversity of destination IPs.
Detects instances where a process, other than standard browsers or common system applications, loads 'WINHTTP.dll' and subsequently initiates outbound HTTPS connections. This behavior is often indicative of custom malware or specialized tooling, such as the NUKESPED/Kimsuky framework, using direct API calls for command and control (C2) communication to bypass standard application-based network filtering.
This rule identifies potential use of the Tor network by detecting network connections to common Tor relay ports (9001, 9030, 9050, 9051, 9150) that are external to internal subnets, or by identifying DNS requests for .onion domains.
Detects network connection attempts directed toward RFC 1918 private IP address spaces (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) and localhost (127.0.0.0/8) that do not involve common Windows file sharing ports (TCP/445 and TCP/139). This behavior may indicate lateral movement, internal reconnaissance, or the use of non-standard protocols for internal communication.
Detects high-volume outbound network connections (exceeding 10MB) originating from processes associated with AI-driven chatbot or productivity applications (e.g., ChatGPT, Perplexity). This rule identifies potential data exfiltration occurring over legitimate, expected software channels.
Detects unusual processes making multiple connections to Google Sheets or OAuth2 APIs within a short timeframe, excluding known browsers and Google applications. This could indicate unauthorized data access, exfiltration, or command and control activity.
Detects the DRAYN malware which masquerades as a VSCode or Microsoft installer. The rule looks for a silent 7ZipSfx installation that drops a temporary file (agent.tmp), performs C2 communication over WebSockets to a specific IP address (34.244.31.76), and establishes persistence via a RunOnce registry key using a modified vcredist_x86.exe execution.
Detects instances where the Local Security Authority Subsystem Service (lsass.exe) initiates a network connection to the loopback address (127.0.0.1 or ::1), excluding standard SMB traffic (Port 445). Such behavior by LSASS is highly anomalous and may indicate exploitation attempts, such as memory dumping or credential harvesting techniques involving inter-process communication.
Detects abnormally long DNS queries characterized by repetitive alphanumeric patterns, which may indicate potential DNS tunneling activity used for C2 communication or data exfiltration. The rule flags DNS requests exceeding 60 characters with repeating label structures.
This rule identifies network connections (DNS queries, HTTPS/WebSocket traffic) directed toward known suspicious domains associated with potentially malicious C2 infrastructure.
Detects anomalous network communication patterns and file system changes indicative of SoftEther VPN usage, particularly when linked to processes masquerading as VMware or communicating with known malicious C2 infrastructure. The rule monitors for network connections on common SoftEther ports, connections to specific command-and-control IP addresses, and the creation of SoftEther configuration files like 'hamcore.se2' or 'vpn_bridge.config'.
This rule detects outbound FTP traffic containing the 'STOR' command, which is used in the FTP protocol to upload files to a remote server. This behavior is a common indicator of unauthorized data exfiltration.
Detects the initial handshake communication pattern associated with AsyncRAT, characterized by a specific base64-encoded configuration blob sent to external non-standard ports (6606, 7707, 8808) as identified by the Snort rule logic.
This rule monitors for FTP 'STOR' commands followed by large data transfers (exceeding 64KB) initiated from internal hosts to external destinations. This pattern is often indicative of data exfiltration using the File Transfer Protocol (FTP).
Detects outbound HTTPS traffic on high ports where the TLS SNI header consists of a 8-20 character random alphanumeric string. This pattern is indicative of default configurations for Metasploit Meterpreter Reverse HTTPS payloads attempting to establish a Command and Control connection.
This rule detects the outbound transmission of email attachments via SMTP (ports 25 and 587) that contain archived file formats (zip, 7z, tar.gz, tgz). Attackers often compress collected data into archives to facilitate exfiltration and minimize the time required for data transfer.
Detects outbound HTTP POST requests to external networks that match a known Emotet C2 traffic pattern. The rule specifically looks for HTTP POST requests using an 'application/x-www-form-urlencoded' Content-Type and a URI structure consisting of randomized alphanumeric segments (4-20 characters long). This structure is characteristic of Emotet's communication with its command-and-control infrastructure.
Page 190 of 280