Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,879 detections
Filters
Last updated
All Time
Detection languages
2,954
1,378
313
289
239
Contributors
1,807
1,529
1,304
180
173
Categories
20,460
11,847
5,879
5,158
4,866
Platforms
3,747
1,857
1,076
782
160
Products / Services
2,241
1,434
1,273
746
582
MITRE Techniques
2,448
2,151
1,129
937
790
CVEs
19
15
9
7
5
IDS Classtypes
834
334
94
23
20
IDS Protocols
689
276
235
117
23
Detects a specific behavioral pattern associated with Bluekit Phishing-as-a-Service (PhaaS) involving WebRTC IP address leak fingerprinting. The rule identifies UDP STUN traffic (port 3478) originating from common web browsers followed within 30 seconds by an HTTPS connection to non-reputable domains, indicating a potential client-side phishing reconnaissance or identification attempt.
Detects instances where msiexec.exe loads a DLL from non-standard system directories (outside of Program Files or Windows folders) with suspicious naming conventions (e.g., containing 'scheduler', 'update', or 'onedrive'), followed by network activity to public IP ranges or registry persistence modifications. This behavior is indicative of potential DLL side-loading or proxy execution by the Windows Installer binary to achieve persistence or command and control.
Detects DNS resolutions for major AI/LLM provider domains (e.g., OpenAI, Anthropic, Google AI) originating from processes that are not common, known browsers or development tools. This behavior is indicative of potentially malicious applications or malware using AI APIs for automated tasks, such as content exfiltration or sophisticated C2 communication.
Detects network connection attempts to the cloud Instance Metadata Service (IMDS) endpoint (169.254.169.254) initiated by processes that are not known cloud management agents or system utilities, which may indicate unauthorized credential or IAM role token theft.
Detects outbound network connections from workstations or servers to common message broker ports (MQTT 1883/8883, AMQP 5672). These protocols are sometimes abused for command-and-control (C2) communication, as they allow for pub/sub messaging patterns that can blend into legitimate network traffic.
This rule detects potential malvertising or drive-by download activity by identifying when common web browsers spawn script-interpreting processes (such as powershell.exe, cmd.exe, or mshta.exe) that execute suspicious commands indicative of obfuscation or payload delivery (e.g., IEX, EncodedCommand). It further correlates this activity with outbound network connections initiated by the child process within a 30-second window, which is characteristic of the second stage of a malware delivery chain.
This rule detects potential data exfiltration activity where PowerShell is used to compress files followed by an outbound network connection to a known C2 IP address and port. It also monitors for direct outbound connections from PowerShell involving suspicious keywords indicative of data staging and exfiltration such as 'Compress-Archive', 'client.zip', and 'UPLOAD'.
Detects the macOS.Gaslight Rust-based implant receiving and executing backdoor commands (e.g., shell, kill, upload, persistence) via the Telegram Bot API. The rule correlates outbound network connections to api.telegram.org with subsequent process execution patterns typical of command dispatch (such as execvp or posix_spawnp).
Detects outbound network connections to a known malicious IP (83.142.209.214) associated with Lambsys cryptominer activity. The rule specifically monitors for HTTP POST requests to '/status.php' or '/setup_status.php' using the default 'Go-http-client/1.1' User-Agent, indicating a C2 beaconing pattern.
This rule detects potential data exfiltration attempts by monitoring for network connections to URLs containing suspicious substrings (bit, onion, .cc, .su) over common web and DNS ports (53, 80, 443, 8080). It flags high-frequency unique connection attempts from a single device, which may indicate command-and-control (C2) traffic or data exfiltration over covert channels.
Correlates an AI/LLM process executing high-volume network scanning against the internal subnet. This rule detects when processes named 'python.exe' or 'node.exe' initiate a high volume of network connections (more than 20 unique IPs within a minute) to internal IP ranges (10.0.0.0/8 or 192.168.0.0/16).
Correlates the reading of sensitive local files (id_rsa, .env, config.json) followed by an immediate POST request to an LLM API (specifically api.openai.com), indicating data theft via prompt injection or automated analysis.
This rule detects activities associated with a specific malicious browser extension, including the presence of its files on disk, execution of browsers with the extension ID in the command line, and network connections to known malicious or typosquatted domains (perplexity-ai.online, extension.tilda.ws) used for C2 or exfiltration.
Detects DNS queries to known StegoAd command-and-control domains 'liveupdt.com' and 'dealctr.com'. These domains are used by the StegoAd campaign to deliver steganographic payloads and push malicious JavaScript to compromised browser extensions.
Detects anomalous automated enumeration of Microsoft Graph API user objects followed by keyword-based searches for sensitive HR, finance, and payroll-related information. This pattern is characteristic of post-compromise reconnaissance activities where an attacker leverages an existing session token to identify targets for further data exfiltration.
Detects network connections originating from standard web browsers (Chrome, Edge, Brave, Chromium, Opera) to the domain 'perplexity-ai.online', which is indicative of potential command and control or unauthorized data exfiltration activity.
This rule detects DNS requests initiated by common web browsers (chrome, msedge, brave, chromium) to a known malicious domain 'perplexity-ai.online', which is often indicative of C2 callback activity.
Detects the silent activation of the 'Smart Window' feature in Mozilla Firefox. The rule monitors for a two-stage sequence where Firefox modifies its 'prefs.js' configuration file to enable the feature, followed shortly by a network connection to the local Smart Window AI API on localhost port 8765.
This rule detects outbound network connections to the typosquatted domain 'perplexity-ai.online'. This domain is associated with a malicious Chromium extension masquerading as a 'Search for Perplexity AI' tool, which uses this domain for search-traffic interception and command-and-control (C2) exfiltration.
Detects outbound SSH connections from common applications using libssh2 to external, non-standard or untrusted servers, followed by an anomalously large inbound TCP data transfer before authentication completes. This behavior is indicative of exploitation attempts targeting CVE-2026-55200, where a malicious SSH server triggers a heap overflow in the client via a malformed packet.
Detects indicators of potential exploitation of CVE-2026-46331 in RustDesk, which involves a session permission bypass. The rule identifies suspicious post-exploitation behavior, specifically when rustdesk.exe spawns common command-line or reconnaissance utilities, and when it initiates outbound network connections on non-standard relay ports.
Page 209 of 280