Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,879 detections
Filters
Last updated
All Time
Detection languages
2,954
1,378
313
289
239
Contributors
1,807
1,529
1,304
180
173
Categories
20,462
11,849
5,879
5,158
4,866
Platforms
3,747
1,857
1,076
782
160
Products / Services
2,241
1,434
1,273
746
582
MITRE Techniques
2,448
2,151
1,129
937
790
CVEs
19
15
9
7
5
IDS Classtypes
834
334
94
23
20
IDS Protocols
689
276
235
117
23
Detects queries to internet scan databases used for target reconnaissance
Detects network traffic associated with the EvilTokens phishing kit's 'killed' gate check mechanism. The kit GETs /api/device/gate/<PAGE_ID> with the ngrok-skip-browser-warning header. When the backend returns a killed flag, the phishing page wipes the DOM and renders a fake 'Page Not Found - Microsoft' error to evade analysis or block specific victims.
Detects indicators of the Meow RAT malware staging collected data in the /tmp/shub_ directory, compressing it into shub_log.zip using 'ditto', and subsequently exfiltrating it to a hardcoded command and control (C2) domain 'qwqerrqwr2145qw[.]com/gate'. The rule correlates process events, network events, and file events to identify the full attack chain.
Identifies PowerShell using Invoke-RestMethod or Invoke-WebRequest to exfiltrate archives via HTTP POST, specifically looking for multipart/form-data boundaries in the command line.
This rule detects network connections initiated by scripting engines (wscript.exe, cscript.exe) or PowerShell (powershell.exe) to common Remote Desktop Protocol (RDP) ports (3389, 3390, 3391). This activity can be indicative of an adversary attempting to establish or pivot RDP sessions using unexpected processes, potentially for lateral movement or persistence.
This rule detects network connections to known IP addresses associated with the FortiBleed vulnerability exploitation. These IP addresses have been categorized based on their observed roles in FortiBleed attacks, including aggregator/C2, pentest lab, credential validation, and sniffer nodes. Monitoring these connections can help identify compromised systems or active exploitation attempts related to FortiBleed.
This rule detects unauthorized configuration of GRE tunnels on Cisco IOS-XE network devices, potentially indicating persistent command and control (C2) channel establishment via TCL injection or illicit configuration changes involving known attacker infrastructure (62.171.185.97). It correlates network traffic to the attacker IP with process-level activity involving suspicious configuration files, scripts, or device-specific command-line arguments.
Detects host-level evidence of DRAYN malware activity by correlating outbound network connections using a specific websocket-sharp User-Agent to a known command-and-control (C2) IP address with the execution of PowerShell commands performing system UUID fingerprinting (Win32_ComputerSystem).
Detects non-browser processes accessing sensitive browser data files (such as Login Data, Cookies, or key stores) followed by network activity to known suspicious, cryptocurrency, or potential malware-hosting domains. This behavior is indicative of credential theft and exfiltration by information-stealing malware.
Detects malicious network connections initiated by wscript.exe or cscript.exe, or file creation events involving known LCRYX malware payloads in the C:\Windows\ directory. It also includes network-level detection using DNS and firewall/proxy logs for known LCRYX malicious domains and IP addresses.
This rule detects network connections to known IP addresses associated with the FortiBleed vulnerability exploitation. These IP addresses have been categorized based on their observed roles in FortiBleed attacks, including C2, pentest lab, credential validation, and sniffer nodes. Monitoring these connections can help identify compromised systems communicating with FortiBleed infrastructure.
This rule detects outbound network connections from devices to a specific remote IP address (62.102.148.212) on a set of suspicious remote ports (37393, 45839, 38471, 12345, 4444, 5555). This pattern is indicative of potential command and control (C2) communication or data exfiltration to a known malicious infrastructure.
This rule detects network connections to known IP addresses associated with the FortiBleed vulnerability exploitation. These IP addresses have been categorized based on their observed roles in FortiBleed attacks, including C2, pentest lab, credential validation, and sniffer nodes.
Detects network traffic associated with DcRAT malware, specifically monitoring outbound connections on port 2671 to external non-private IP addresses, or directly to known malicious infrastructure (223.26.63.40). The rule also identifies potential beaconing behavior by analyzing connection intervals and standard deviation, and flags activity originating from specific autonomous system ranges (AS152194) linked to the threat actor's infrastructure.
Detects outbound network connections to specific cloud storage providers (Wasabi, Tebi, I3Storage) which are commonly leveraged by adversaries for data exfiltration.
Detects network traffic to Cloudflare-hosted services (trycloudflare.com, workers.dev) potentially indicative of C2 communication, especially when initiated by common scripting or proxy processes like powershell.exe, wscript.exe, cscript.exe, mshta.exe, or cloudflared.exe.
This rule detects outbound network connections to common tunneling and proxy services (Cloudflare Tunnel, Cloudflare Workers, and Microsoft Dev Tunnels). These services are frequently abused by threat actors, such as the Gamaredon Group (ACTINIUM), to establish command-and-control (C2) channels and tunnel traffic to evade network-based detection systems.
This rule monitors network traffic for DNS queries directed at domains associated with known malicious browser extensions, specifically targeting Adblock for YouTube and Adblock for Chrome malicious variants. It correlates these connections with process command line evidence that matches the extension IDs of these malicious components.
Detects browser-based WebRTC STUN traffic initiated from phishing landing pages used by the Bluekit PhaaS platform. The rule identifies suspicious STUN requests originating from browsers that exhibit a WebRTC IP mismatch when compared to the active HTTPS session IP, a technique used by attackers to de-anonymize security researchers and bypass automated analysis sandboxes.
This rule detects network connections and DNS requests to specific domains associated with Unistream SDK and other known BadBlocker malware infrastructure, often linked to malicious browser extensions such as Adblock for YouTube and related variants.
Detects network activity associated with the Turla group's STOCKSTAY malware infrastructure. This includes downloading MSI installers or server scripts from GitHub, as well as WebSocket C2 communications with the onrender.com platform.
Page 208 of 280