Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,879 detections
Filters
Last updated
All Time
Detection languages
2,954
1,378
313
289
239
Contributors
1,807
1,529
1,304
180
173
Categories
20,462
11,849
5,879
5,158
4,866
Platforms
3,747
1,857
1,076
782
160
Products / Services
2,241
1,434
1,273
746
582
MITRE Techniques
2,448
2,151
1,129
937
790
CVEs
19
15
9
7
5
IDS Classtypes
834
334
94
23
20
IDS Protocols
689
276
235
117
23
Lightweight remote access trojan deployed in recruiter-themed social engineering
Cloud extortion group exploiting exposed credentials and storage
Latin American banking trojan using DLL side-loading and overlay attacks
Banking trojan and loader using malicious Office macro delivery
Form-grabbing and credential stealing malware-as-a-service
Banking trojan and loader using malicious Office macro delivery
Credential and browser data stealer distributed via OXLOADER campaigns
Credential and browser data stealer distributed via OXLOADER campaigns
This rule detects potential internal network reconnaissance activities by monitoring for either mass execution of network discovery commands (such as 'net view' or 'net share') targeting multiple unique hosts within a 5-minute window, or by monitoring for mass outbound network connections to port 445 (SMB) across multiple unique destination hosts within the same timeframe. This behavior is indicative of an attacker attempting to map available network shares or identify reachable systems for lateral movement.
Detects activity associated with the BRICKSTORM threat actor, including known malicious ELF binary execution, unauthorized file path utilization, and suspicious DNS-over-HTTPS (DoH) network traffic directed to public DNS resolvers.
Detects DNS resolutions for major AI/LLM provider domains (e.g., OpenAI, Anthropic, Google AI) originating from processes that are not common, known browsers or development tools. This behavior is indicative of potentially malicious applications or malware using AI APIs for automated tasks, such as content exfiltration or sophisticated C2 communication.
This rule detects the execution of known Vidar or SnappyClient loader processes (NeuroManag.exe or VirtualAr.exe) followed by repeated network connections to specific C2 infrastructure IP addresses or common dead-drop resolver services such as Telegram, Steam, or specific attacker-controlled domains. The rule identifies suspicious beaconing behavior following the process launch, indicating active command and control communication.
This rule monitors for processes that establish a network connection to specific Cloudflare IP address ranges (104.21.0.0/16 and 172.67.0.0/16) within a 5-minute window. This can be indicative of communication with command and control infrastructure, proxies, or content delivery networks used by adversaries.
Detects a DLL being loaded into a system process (e.g., Windows/System32, Program Files) from a suspicious or user-writable directory (e.g., AppData, Temp, Downloads), followed by a network connection originating from the same process within a 10-minute window. This behavior is indicative of DLL side-loading used to execute a payload that subsequently initiates C2 communication.
This rule detects processes executing from commonly abused, high-write temporary or user-specific directories (AppData, Temp, ProgramData) that simultaneously initiate network connections to external IP addresses over HTTP/HTTPS ports (80/443). This pattern is frequently indicative of initial stage malware, downloader behavior, or command and control communication originating from non-standard execution paths.
This rule detects processes running from common user-writable directories (AppData, Temp, ProgramData, etc.) that concurrently establish outbound network connections to non-private (non-RFC1918) IP addresses. It explicitly excludes common browsers, accessibility tools, and known Windows system or product-related paths to reduce noise.
Detects network activity and DNS queries associated with known TA4922 command-and-control infrastructure, including specific domains and IP addresses. It also employs behavioral analysis to identify beaconing patterns from processes that are not identified as standard web browsers or authorized system/application utilities.
Detects behavior associated with the IronWorm threat, including Tor-based command and control communication by unsigned binaries or Node.js processes, unauthorized DNS resolution of .onion domains, automated npm package management operations by Node.js, and git configuration modifications attempting to impersonate common developer automation identities.
This rule detects potential command and control (C2) beaconing activity by identifying non-browser processes that initiate regular, sustained outbound network connections over port 443. It aggregates connection data by hour and calculates metrics such as average frequency and standard deviation to identify consistent, periodic communication patterns characteristic of C2 agents while excluding common legitimate web browsers.
This rule detects processes other than standard web browsers performing network connections that coincide with OAuth token acquisition activities (POST requests containing 'access_token' in the response body). This behavior is indicative of potential token theft or unauthorized programmatic access to OAuth-protected resources.
This rule detects potential data staging and exfiltration behavior characterized by large volumes of outbound network data combined with high frequency file write operations across multiple file types. It monitors Sysmon Event IDs 3 (Network connection) and 11 (FileCreate) to identify indicators often associated with pre-encryption staging by ransomware or data theft campaigns.
Page 199 of 280