Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,879 detections
Filters
Last updated
All Time
Detection languages
2,954
1,378
313
289
239
Contributors
1,807
1,529
1,304
180
173
Categories
20,462
11,849
5,879
5,158
4,866
Platforms
3,747
1,857
1,076
782
160
Products / Services
2,241
1,434
1,273
746
582
MITRE Techniques
2,448
2,151
1,129
937
790
CVEs
19
15
9
7
5
IDS Classtypes
834
334
94
23
20
IDS Protocols
689
276
235
117
23
This rule detects multiple outbound network connections to a specific set of known malicious C2 IP addresses on specific ports within a one-hour window. This behavior is indicative of a multi-payload delivery pattern associated with malware families such as Remcos, Agent Tesla, and RedLine.
Detects remote enumeration of Windows services via SMB
Detects activity associated with the Lightlife RAT, which involves PowerShell scripts accessing cryptocurrency wallet browser extension directories, staging data using archive utilities, and exfiltrating collected data to external destinations like the Telegram Bot API.
Detects network connections to Microsoft OneDrive or SharePoint domains from processes that are not standard, known-good applications (e.g., browsers or standard sync clients). This behavior may indicate an adversary leveraging cloud storage for command-and-control (C2) operations or data exfiltration.
This rule detects a sequence of suspicious activities: the creation or modification of an executable file (.exe or .dll) within a directory path containing update-related keywords, followed by the execution of a file in that same location, and culminating in an outbound network connection from that process. This pattern is characteristic of a software supply chain compromise or an adversary deploying a malicious payload via a fake or compromised update mechanism.
This rule detects potential data exfiltration by identifying devices that make a high number of network connections (3 or more within an hour) to various remote IPs using common file transfer and email protocols (FTP, SFTP, SMB, SMTP) on their standard ports (21, 22, 445, 25, 587). This pattern can indicate an adversary attempting to exfiltrate collected data from a compromised system.
Tracks network connections from non-browser processes that transmit an abnormally large volume of outbound bytes, indicating active data exfiltration. This rule specifically excludes common browser processes (chrome.exe, msedge.exe, firefox.exe) and OneDrive (onedrive.exe) to reduce false positives. It aggregates outbound network activity over 10-minute intervals and flags any instance where the total outbound bytes exceed 100MB.
Detects explorer.exe making DNS requests to Discord or Telegram, which is anomalous and indicates potential process injection for data exfiltration. This behavior is associated with information stealer malware like Phantom Stealer.
Identifies file, registry, network, and process indicators associated with the @mastra/* npm supply chain compromise. This rule detects the presence of specific malicious files, registry modifications for persistence, outbound network connections to known command and control (C2) infrastructure, and the execution of malicious scripts related to the attack.
Detects signs of Grixba malware activity, including process execution of Gt_net.exe from the Public/Music directory, associated WMI/WinRM remote network connections, and the creation of staging artifacts such as data.zip or ExportData.db.
This rule detects the creation of image files (bmp, png, jpg, jpeg) within temporary or application data directories, while simultaneously monitoring for network connections to known command-and-control (C2) infrastructure (IP 223.26.63.40 or port 2671). The rule calculates a risk score based on the correlation of these events within a 30-second window, excluding common benign screenshot utility processes.
Detects periodic beaconing behavior associated with a Lambsys Go-based implant communicating with a specific C2 IP address (83.142.209.214) over HTTP. The rule identifies POST requests to specific paths ('/status.php' or '/setup_status.php') using the 'Go-http-client/1.1' User-Agent, with evidence of repeated connection attempts.
Detects outbound network connections to 'stitch-production.org' or connections by node/bun runtime processes to GitHub API or 'stitch-production.org', which may indicate command and control communication or data exfiltration.
This rule detects PowerShell activity where commands are used to perform reconnaissance (e.g., whoami, ipconfig, or network group enumeration) and the output is exfiltrated or sent via a POST request to a specific external IP address (202.182.102.5).
Detects malicious behavior attributed to the Miasma/TonRAT malware, specifically targeting node.js or bun.exe runtime environments. The rule identifies suspicious network connections to command and control (C2) domains, access to sensitive developer credential files (e.g., .npmrc, .aws/credentials), execution of identified credential-harvesting functions in process command lines, and the execution of specific suspicious preinstall scripts.
Detects the download, staging, and execution of SoftEther VPN components associated with CL-STA-1062. The rule monitors for the creation of specific SoftEther files, network downloads from known actor staging infrastructure, and the execution of SoftEther binaries masquerading as VMware tools (vmtools.exe).
Detects network activity associated with Gamaredon threat group backdoors (PteroVDoor and PteroPSDoor) exfiltrating data to S3-compatible cloud storage providers. The rule identifies suspicious outbound network requests to specific domains ('wasabisys.com', 'i3storage.com') originating from processes that are not common browsers or trusted software, or by command-line execution of PowerShell, curl, or wget.
Detects execution patterns associated with the Gamaredon group's spearphishing chains, specifically where PowerShell is invoked by common document or scripting applications (Winword, Excel, mshta, etc.) containing typical downloader flags (IEX, EncodedCommand). Additionally, it monitors for network connections from PowerShell to known dead-drop resolvers (e.g., telegra.ph, cloudflare workers) used by PteroOdd/Kazuar loaders.
PlugX C2Beacon
YARA
Modular remote access trojan associated with long-term espionage intrusions
Photo-themed ZIP phishing campaign dropping a Node.js implant
Stealthy backdoor MLTBackdoor linked to KongTuke ClickFix and ModeloRAT campaigns
Page 198 of 280