Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,879 detections
Filters
Last updated
All Time
Detection languages
2,954
1,378
313
289
239
Contributors
1,807
1,529
1,304
180
173
Categories
20,462
11,849
5,879
5,158
4,866
Platforms
3,747
1,857
1,076
782
160
Products / Services
2,241
1,434
1,273
746
582
MITRE Techniques
2,448
2,151
1,129
937
790
CVEs
19
15
9
7
5
IDS Classtypes
834
334
94
23
20
IDS Protocols
689
276
235
117
23
Detects outbound network connections from devices to known FortiBleed command and control (C2) servers and sniffer infrastructure IP addresses. This rule helps identify potential compromises involving the FortiBleed vulnerability exploitation.
Detects a network-connected Linux process exhibiting beaconing behavior (high-frequency external connections) that is subsequently correlated with unauthorized file access to sensitive Linux configuration files (/etc/passwd, /etc/shadow, or authorized_keys). This rule filters out common system processes and standard management binaries, targeting suspicious command-and-control activity combined with credential theft.
Detects a network-connected Linux process exhibiting beaconing behavior (high-frequency external connections) that is subsequently correlated with unauthorized file access to sensitive Linux configuration files (/etc/passwd, /etc/shadow, or authorized_keys). This rule filters out common system processes and standard management binaries, targeting suspicious command-and-control activity combined with credential theft.
Detects Python or Node.js processes executing command-line interpreters (e.g., cmd.exe, bash) while simultaneously performing network connections. This behavior is indicative of a post-exploitation activity where an attacker leverages language-specific package paths to execute shell commands and establish command-and-control communication.
Detects unauthorized processes reading AI assistant configuration files (e.g., Claude, Cursor, Gemini, VS Code) followed by an outbound network connection from a common scripting or runtime environment (node, python, bun) within 60 seconds, potentially indicating credential or configuration exfiltration.
Detects network communication associated with DcRAT, specifically identifying DNS lookups for the known C2 domain kkxqbh.top or network connections to port 2671 originating from suspicious or specific host processes.
Detects cloud service hijacking for cryptocurrency mining workloads
Detects anomalous activity originating from AutoGen Studio AI agents, specifically identifying attempts to abuse loopback trust boundaries via MCP (Model Context Protocol) WebSocket requests to localhost (ports 8080/8081) or the execution of suspicious child processes commonly used for command-line interference, indicative of AI agent compromise or attacker-controlled MCP command injection.
Detects outbound network connections to port 8084 initiated by processes originating from suspicious directories such as AppData, Temp, or ProgramData. This behavior is indicative of VSHELL RAT leveraging WebSocket-based C2 communication, a technique observed in UNC5221 SNOWLIGHT campaigns.
Detects the APT36 Ghazwa spyware (GPSSERV component) performing periodic, continuous exfiltration of GPS coordinates to a specific command-and-control port (18585). The rule identifies suspicious network traffic from non-navigation applications that have requested location permissions, filtering out known legitimate mapping services.
This rule detects activities associated with the VILE ransomware, specifically the creation of file staging artifacts (vile_user_files.zip), execution of associated binaries, and network communication with Gofile.io infrastructure used for exfiltration.
Detects the execution of a malicious file disguised as 'wusvc.exe' originating from the user Downloads folder. The rule also monitors for suspicious network connections from this process to a known C2 IP address and detects potential defensive evasion techniques such as memory protection changes (PAGE_EXECUTE_READWRITE) used for syscall stub patching or AMSI bypass in non-Microsoft signed versions of this process.
This rule detects outbound network connections made by the RustDesk process to non-corporate relay server IP addresses on the default RustDesk relay ports (21115, 21116, 21117). This behavior may indicate an unauthorized remote control session establishment, bypassing expected organizational proxy or relay controls.
Detects network activity associated with Cobalt Strike Beacon behavior by identifying specific file extensions (.bin, .stager, .update, .task, .post) commonly used in Beacon staging and communication profiles within network inspection events.
Detects non-browser processes that load 'clr.dll' (indicating in-process .NET/CLR usage) and are sending large volumes of outbound data to Google API domains (sheets.googleapis.com, oauth2.googleapis.com, googleapis.com). This behavior is consistent with the SHEETCREEP threat actor's use of Google Sheets API for command and control (C2) and data exfiltration.
This rule detects the use of 'sshpass' in conjunction with specific command-line arguments that indicate automated SSH logins. It specifically looks for the presence of '/sshpass/' and '/StrictHostKeyChecking=no/' in the command line, combined with common administrative account names like 'psoft', 'oracle', or 'linuxadm'. This activity is often associated with lateral movement techniques, as observed in attacks like those by ShinyHunters targeting Oracle/PeopleSoft environments.
Detects potential unauthorized cryptocurrency mining activity by correlating process execution, network connections to known mining pools or C2 IPs, and the presence of known miner binaries in temporary directories. The rule calculates a confidence score based on the overlap of these behavioral indicators.
Detects instances where the Squid proxy application is used to establish network connections over ports 21 (FTP) or 22 (SSH) to specific external IP ranges. This behavior may indicate an attacker using the internal proxy server to anonymize command-and-control (C2) traffic or perform unauthorized external reconnaissance.
This rule detects potential command and control (C2) beaconing activity by identifying devices communicating with known suspicious remote IP addresses at regular, repeating intervals. It calculates the time difference between consecutive connections to specific suspicious IPs and identifies devices that establish at least three connections within one-hour bins, adhering to a 1 to 15-minute heartbeat interval.
This rule detects outbound POST requests to the Telegram Bot API (api.telegram.org) originating from internal network hosts. The detection specifically looks for requests containing the 'sendMessage' path, which is characteristic of bots transmitting stolen data (such as credentials) or command-and-control communication. It focuses on traffic initiated by common command-line tools like 'python-requests' or 'curl', which are frequently abused by automated malware scripts.
This rule detects potential Business Email Compromise (BEC) attempts by identifying emails containing financial keywords sent to sensitive finance/accounting roles from domains that have not been observed in the last 180 days. It then correlates this email event with subsequent device-level network activity involving banking or financial URLs initiated by the recipient user, which may indicate follow-up reconnaissance or unauthorized access.
Page 194 of 280