Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,879 detections
Filters
Last updated
All Time
Detection languages
2,954
1,378
313
289
239
Contributors
1,807
1,529
1,304
180
173
Categories
20,462
11,849
5,879
5,158
4,866
Platforms
3,747
1,857
1,076
782
160
Products / Services
2,241
1,434
1,273
746
582
MITRE Techniques
2,448
2,151
1,129
937
790
CVEs
19
15
9
7
5
IDS Classtypes
834
334
94
23
20
IDS Protocols
689
276
235
117
23
Detects modifications to the 'SSLKEYLOGFILE' environment variable in the Windows Registry. This variable is often used by applications like web browsers to log SSL/TLS session keys to a file, which can then be used to decrypt encrypted network traffic. Malicious actors might enable this to capture sensitive data.
This rule detects suspicious network connections made by processes (excluding legitimate EDR processes like mssense.exe and senseir.exe) to URLs commonly associated with EDR command and control (C2) infrastructure. This could indicate an attempt by an adversary to communicate with or manipulate the EDR agent.
Detects instances where rundll32.exe executes with missing or minimal DLL arguments and subsequently establishes outbound network connections. This behavior is uncommon in legitimate Windows operations and has been observed during ACR Stealer infections, including executions originating from remote SMB shares and memory-loaded payloads.
Detects outbound internet communications generated by rundll32.exe, which is uncommon and frequently associated with malware execution, including ACR Stealer.
Detects connections to domains associated with observed ACR Stealer command-and-control infrastructure.
This rule monitors network connections initiated by a process named 'setup.exe' to known malicious or suspicious IP addresses. Legitimate installers should not be initiating network connections to these specific external addresses.
This rule monitors and alerts on network connections established from endpoints to a predefined list of known malicious IP addresses, which may indicate command-and-control (C2) communication or unauthorized exfiltration attempts.
Detects network beaconing activity associated with the SPECTRALVIPER C2 framework. This rule identifies outbound HTTP GET requests targeting known C2 infrastructure domains and IP addresses, while correlating the traffic with specific browser user agents and cookie patterns indicative of this actor.
Detects network connection events initiated by the OneDrive sync process (OneDrive.Sync.Services.exe) to known malicious domains or suspicious specific file paths, which may indicate unauthorized use of the OneDrive process for command-and-control communication or malicious file retrieval.
Detects HTTP traffic destined for the 1rpc.io Ethereum node gateway containing 'eth_call' in the request body, which is indicative of EtherRAT malware using blockchain infrastructure for command and control (C2) resolution.
This rule detects network traffic directed at 'goldsky.arweave.net', a domain known to be used by the TukTuk malware as a dead-drop resolver. Adversaries often use legitimate web services like Arweave to host command-and-control (C2) configuration data, such as secondary C2 IP addresses or domains, allowing them to redirect infected hosts to backend infrastructure while masking the traffic as legitimate web communication.
Detects outbound HTTP PUT requests to 'filen.io', which has been associated with command-and-control (C2) communication for the PRISMEX malware used by the threat actor APT28 (also known as Pawn Storm/Fancy Bear).
Detects DNS queries for domains ending in '.trycloudflare.com', which are commonly used to establish unauthorized remote access tunnels (Cloudflare Tunnel) by threat actors for C2 communication.
Detects a specific network handshake pattern (05 01 00) associated with the SystemBC malware acting as a SOCKS5 proxy. This pattern is characteristic of the initial communication phase used by SystemBC to establish C2 connectivity, often utilized by ransomware affiliates.
This rule detects outbound TCP traffic from internal network hosts to known Tor relay ports (9001, 9030), which is a common communication pattern for the NBLock ransomware strain to establish a command and control channel through the Tor network.
Detects HTTP traffic destined for the 1rpc.io Ethereum node gateway containing 'eth_call' in the request body, which is indicative of EtherRAT malware using blockchain infrastructure for command and control (C2) resolution.
This rule detects potentially malicious HTTP POST requests directed at a specific URI path ('/V1/Update/GetUpdate') associated with software update functionality. It identifies suspicious traffic by analyzing parameters in the request body (such as Id, Hostname, Mac, Version, Arch) and potential process names (e.g., setup.exe, IntelAudioService.exe). High-risk scores are assigned based on the destination IP and the presence of these specific identifying parameters, which may indicate command-and-control (C2) beaconing or data exfiltration masquerading as legitimate update check traffic.
Detects outbound network connections to common Large Language Model (LLM) APIs (OpenAI, Anthropic, Google) or local LLM instances (Ollama) from processes that are not standard web browsers, common IDEs, or typical development/scripting tools. This behavior may indicate an attempt to exfiltrate sensitive data or interact with LLM services using unauthorized or hidden processes.
This rule monitors for signs of Atlas RAT activity on Linux systems, including the execution of processes matching known Atlas RAT naming conventions, unauthorized modifications to system persistence mechanisms (systemd or init.d directories) by non-package management utilities, and anomalous outbound network connections originating from sshd or PAM-related processes.
Detects suspicious behavior involving the 'uptime' system utility, including execution from non-standard paths, unexpected outbound network connections, spawning child processes, or replacement of the legitimate /usr/bin/uptime binary. These behaviors are indicative of masquerading or binary hijacking.
Detects the deployment and execution of GS-Netcat (gsocket), a tool often used for creating persistent reverse shells or backdoors. The rule identifies processes associated with gsocket, instances where the 'uptime' command is masqueraded with suspicious command-line arguments, and unauthorized creation or modification of systemd service files designed for persistence.
Page 201 of 280