Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,879 detections
Filters
Last updated
All Time
Detection languages
2,954
1,378
313
289
239
Contributors
1,807
1,529
1,304
180
173
Categories
20,462
11,849
5,879
5,158
4,866
Platforms
3,747
1,857
1,076
782
160
Products / Services
2,241
1,434
1,273
746
582
MITRE Techniques
2,448
2,151
1,129
937
790
CVEs
19
15
9
7
5
IDS Classtypes
834
334
94
23
20
IDS Protocols
689
276
235
117
23
This rule detects network connections or DNS queries related to the TON blockchain ecosystem, specifically targeting domains and API endpoints associated with TON network infrastructure. These communication patterns may indicate interaction with cryptocurrency-related services or potential malware utilizing TON-based infrastructure for command and control or data exfiltration.
Detects outbound WebSocket connections on common web ports initiated by node.exe that do not originate from standard Node.js installation directories. This behavior is characteristic of the TONResolver RAT, which utilizes AES-256-CBC encrypted communication over WebSockets with a 20-second keepalive interval.
Detects network activity associated with the DcRAT trojan as identified in Operation DragonReturn. This includes outbound network connections to hardcoded C2 port 2671, connections to known malicious IP addresses, and DNS resolutions of identified attacker-controlled C2 domains.
Detects potential exfiltration of sensitive M365 data via an SSRF vulnerability (CVE-2026-42824). The rule identifies suspicious outbound network requests to Bing's image search service where the 'imgurl' parameter contains external, non-Microsoft URLs, suggesting the service is being used as a proxy to exfiltrate data.
This rule detects endpoint DNS queries or network connections to the suspected phishing domain 'gasparinutrition.com' initiated by common web browsers or email clients. This provides visibility into potential user interaction with malicious sites that would otherwise be missed by email security gateways.
This rule detects potential Business Email Compromise (BEC) attempts by identifying emails containing financial keywords sent to sensitive finance/accounting roles from domains that have not been observed in the last 180 days. It then correlates this email event with subsequent device-level network activity involving banking or financial URLs initiated by the recipient user, which may indicate follow-up reconnaissance or unauthorized access.
This rule detects potential Log4Shell (CVE-2021-44228) exploitation attempts by identifying JNDI injection patterns in web request headers, process command lines, and syslog messages. It further identifies suspicious outbound network callbacks to known malicious infrastructure associated with these exploitation attempts.
This rule detects activity associated with the malicious 'Search for perplexity ai' browser extension (ID: flkebkiofojicogddingbdmcmkpbplcd). It specifically identifies DNS queries and network connections to the malicious domain 'perplexity-ai.online' initiated by common web browser processes, as well as file system evidence of the extension's presence.
Detects potentially malicious child process creation or unauthorized outbound network connections initiated by AI-assisted coding tools (e.g., Claude, Cursor, Windsurf) through their integrated Node.js or Python environments. This rule identifies common post-exploitation behaviors such as shell execution, command-line reconnaissance, and connections to external non-internal IP addresses.
Detects suspicious network traffic potentially associated with BeePRAT malware, identified by specific process image paths in temporary or TCC-related directories, connections to known malicious C2 IP addresses/ports, or non-standard TCP communication patterns involving suspicious domain queries.
Detects exploitation attempts against Flowise by leveraging a case-sensitivity bypass in environment variable parsing. Attackers inject variants like 'node_options' into the environment, which bypasses security denylists, allowing the 'NODE_OPTIONS' variable to be set. This enables remote code execution (RCE) via the '--require' flag in child Node.js processes, alongside subsequent activities like marker file creation, registry-based persistence, or unauthorized outbound network connections from the Flowise service.
This rule detects outbound network connections to a specific typosquatted domain 'perplexity-ai.online'. This domain is associated with a malicious browser extension designed to intercept and exfiltrate search queries before forwarding them to legitimate search providers.
This rule detects network activity and email signals associated with a malicious campaign promoting a fraudulent 'Perplexity AI' Chrome extension. It monitors for connections to known malicious Tilda landing pages, correlates these visits with subsequent Google Chrome extension (CRX) downloads within a 10-minute window, and identifies phishing emails containing links to these malicious pages.
Detects network activity associated with the Djinn Stealer malware, including connections to a known C2 IP address/port, the use of a specific 'telemetry-client/1.0' user agent, or HTTP POST requests to 'application/octet-stream' endpoints originating from suspicious parent processes such as SimpleHelp or TaskWeaver.
Detects processes that exhibit signs of C2 communication (specifically on ports 4000-5000, associated with SystemBC) followed by the writing of executable or script files to SMB/UNC paths and subsequent remote lateral movement execution via WMI, Windows services, or scheduled tasks on the same host.
This rule detects a process injection event where a process running from a suspicious directory (e.g., Temp, AppData, ProgramData) injects code into a common system or browser process, followed by that same process initiating a network connection to non-internal IP ranges on specific ports within a 10-minute window. This behavior is indicative of malware establishing persistence or C2 communications.
Detects potentially malicious activity associated with the Ghidra reverse engineering framework, including the spawning of unexpected non-Java child processes, loading of suspicious project files (.gzf/.gar), loading of unsigned extensions from non-standard directories, and unexpected outbound network connections from decompiler or Java processes.
Detects anomalous activity associated with information stealing malware, including unauthorized access to browser credential files (Login Data, Cookies), remote thread injection into browser processes, outbound connections to the Telegram API by non-browser processes, and rapid bulk access to multiple sensitive credential or crypto wallet files.
Detects rapid post-exploitation activity where a developer's workstation, upon executing VS Code (Code.exe), initiates outbound network connections to major cloud service or CI/CD provider APIs (GitHub, AWS, Azure, GCP) within 60 minutes. This behavior is indicative of the Lazarus Group 'Contagious Interview' campaign, where stolen credentials from developer environments are used to pivot into cloud infrastructure or CI/CD pipelines.
Detects the use of 'netsh trace' to capture network traffic with specific suspicious flags, such as circular file mode, reporting disabled, or interaction with administrative shares. This behavior is often associated with network reconnaissance or the collection of sensitive data by adversaries.
Detects instances where scripting or development processes (e.g., node.exe, python.exe, code.exe) access sensitive SSH private key files or PEM files, followed by an immediate outbound network connection to a non-private IP address within 60 seconds. This activity is indicative of credential exfiltration or unauthorized use of stolen keys.
Page 193 of 280