Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,879 detections
Filters
Last updated
All Time
Detection languages
2,954
1,378
313
289
239
Contributors
1,807
1,529
1,304
180
173
Categories
20,462
11,849
5,879
5,158
4,866
Platforms
3,747
1,857
1,076
782
160
Products / Services
2,241
1,434
1,273
746
582
MITRE Techniques
2,448
2,151
1,129
937
790
CVEs
19
15
9
7
5
IDS Classtypes
834
334
94
23
20
IDS Protocols
689
276
235
117
23
This rule detects low-frequency, external network connections originating from Linux processes that are either explicitly known to be associated with malicious tools (e.g., gs-netcat, gsocket, atlasd) or are masquerading as legitimate system utilities (e.g., uptime, smbd) in a manner consistent with the Velvet Ant Operation Highland activity. The detection aggregates connections by process metadata and flags low-frequency outbound traffic, which is indicative of C2 beaconing.
Detects Linux processes running from non-standard directories that exhibit network beaconing behavior, correlated with the concurrent creation or modification of systemd unit files on the same host. This pattern is indicative of a remote access trojan (RAT) or backdoor establishing persistent command-and-control.
Detects execution activity associated with the Kimsuky NUKESPED loader, specifically identified by the script interpreter spawning processes or making network requests related to specific decoy URLs (NHIS health portal) or opening decoy PDF files from the user's Downloads directory.
Detects the execution of fltMC.exe originating from a temporary folder, which is indicative of potential malicious activity. The rule monitors for suspicious child processes spawned by this binary, outbound network connections, and file system operations (creation, modification, renaming) associated with this execution context.
Detects indicators associated with the JDY botnet targeting SOHO and IoT infrastructure. The rule monitors for suspicious firmware update attempts to non-vendor hosts, identifies high-rate outbound scanning from edge devices, and flags devices that show re-emergence of suspicious behavior after a quiet period.
This rule detects the execution of the NUKESPED backdoor component 'zlrenu8.exe' and its subsequent outbound HTTP/HTTPS network connections to specific IP addresses associated with Fastly CDN. This behavior is highly characteristic of sensitive data exfiltration activities performed by the Kimsuky threat group.
Detects network connection attempts or successes from critical Windows processes (System, svchost.exe, lsass.exe) targeting the localhost interface (127.0.0.1 or ::1) on non-standard ports (above 1024, excluding SMB ports 445/139). This behavior is often indicative of local process injection, credential dumping activity, or unauthorized inter-process communication used by malware to bypass network security controls.
Detects high-volume outbound network connection attempts from internal endpoints targeting a specific set of common SOHO/IoT management and service ports. This behavior is consistent with automated service enumeration, banner grabbing, and reconnaissance activity often associated with botnets like the JDY cluster, which target edge devices for potential exploitation.
This rule detects web browser processes (Chrome, Edge, Brave, Electron) making network requests to 'raw.githubusercontent.com' that contain keywords indicative of sensitive data, such as 'credential', 'secret', 'password', 'token', 'api_key', or '.env'. This behavior may indicate an adversary attempting to download configuration files or sensitive credentials hosted on GitHub.
Detects outbound network connections from devices to known FortiBleed command and control (C2) servers and sniffer infrastructure IP addresses. This rule helps identify potential compromises involving the FortiBleed vulnerability exploitation.
Detects high-cardinality, multi-protocol network scanning behavior characteristic of the JDY botnet. The rule identifies internal hosts attempting to connect to a high volume of unique external destinations across multiple protocols with low average bytes per connection, indicative of automated discovery or probing activity.
This rule detects outbound network traffic from internal IP addresses to known Tor network entry or exit relay ports (9001, 9030, 9050, 9051). It specifically prioritizes alerts where the source host is identified as network infrastructure (routers, gateways, firewalls) or IoT devices, flagging potential unauthorized use of Tor for obfuscated communication or data exfiltration from within the network perimeter.
This rule detects a multi-stage malicious activity pattern where a process performs system reconnaissance (process enumeration followed by network configuration enumeration) followed by an outbound network connection to a non-internal IP address. The rule uses transaction correlation on the ProcessGuid/ParentProcessGuid to link these distinct events into a single chain within a 2-minute time window.
This rule detects processes frequently creating image files (bmp, png, jpg, jpeg) in temporary directories and subsequently initiating external network connections. The logic identifies suspicious patterns where a non-whitelisted process generates files at consistent, short intervals and performs network activity, which is a common indicator of automated screen capture and exfiltration.
Detects network connections from suspicious or unexpected processes to common public webhook and automation services, which may indicate data exfiltration or automated C2 communication.
Detects anomalous network scanning behavior originating from internal hosts. The rule triggers when a host contacts a high number of distinct ports (greater than 50) or establishes a large number of connections (greater than 100) to a high number of distinct IP addresses (greater than 20), excluding common internal network segments. This behavior is indicative of network reconnaissance or service discovery activities typical of an adversary mapping the network.
This rule detects when the Python interpreter (python.exe or py.exe) initiates a network connection to an internal or loopback IP address. This behavior can be indicative of a local process scanning the internal network, pivoting, or interacting with locally running services as part of a post-exploitation or reconnaissance activity.
Detects unusual network connections or process creation events originating from the 'sharingd' daemon on macOS. 'sharingd' handles various Apple sharing features (AirDrop, Handoff, Shared Clipboard). Unusual child processes or network activity involving this daemon may indicate abuse for unauthorized data transfer, lateral movement, or remote service interaction.
This rule detects when the Python interpreter (python.exe or py.exe) initiates a network connection to an internal or loopback IP address. This behavior can be indicative of a local process scanning the internal network, pivoting, or interacting with locally running services as part of a post-exploitation or reconnaissance activity.
Detects outbound proxy traffic originating from identified AI and automation agent user-agents (e.g., ChatGPT, Perplexity, Claude, etc.) attempting to access sensitive URI paths, such as credential files, SSH keys, configuration files, or cloud-hosted secrets. This may indicate an attempt to exfiltrate sensitive data to or through AI platforms.
This rule detects network activity involving known suspicious domains and the download of specific, potentially malicious files (archives and installers). The monitoring focuses on HTTP/proxy/DNS traffic where hostnames, URLs, or query parameters match indicators of malicious activity.
Page 202 of 280