Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,879 detections
Filters
Last updated
All Time
Detection languages
2,954
1,378
313
289
239
Contributors
1,807
1,529
1,304
180
173
Categories
20,462
11,849
5,879
5,158
4,866
Platforms
3,747
1,857
1,076
782
160
Products / Services
2,241
1,434
1,273
746
582
MITRE Techniques
2,448
2,151
1,129
937
790
CVEs
19
15
9
7
5
IDS Classtypes
834
334
94
23
20
IDS Protocols
689
276
235
117
23
This rule detects outbound network connections to the typosquatted domain 'perplexity-ai.online'. This domain is associated with a malicious Chromium extension masquerading as a 'Search for Perplexity AI' tool, which uses this domain for search-traffic interception and command-and-control (C2) exfiltration.
Detects outbound SSH connections from common applications using libssh2 to external, non-standard or untrusted servers, followed by an anomalously large inbound TCP data transfer before authentication completes. This behavior is indicative of exploitation attempts targeting CVE-2026-55200, where a malicious SSH server triggers a heap overflow in the client via a malformed packet.
Detects indicators of potential exploitation of CVE-2026-46331 in RustDesk, which involves a session permission bypass. The rule identifies suspicious post-exploitation behavior, specifically when rustdesk.exe spawns common command-line or reconnaissance utilities, and when it initiates outbound network connections on non-standard relay ports.
This rule detects potential exploitation of the PHP StreamBucket SOAP RCE vulnerability (CVE-2026-55199). It monitors for characteristic post-exploitation behaviors, including the spawning of unexpected shell or system utility processes, access to sensitive memory mapping files (/proc/self/maps or /proc/self/mem) for ASLR defeat, creation of specific RCE marker files (e.g., /tmp/php857_rce_*.txt), and anomalous outbound network connections following SOAP request activity.
This rule detects successful outbound SSH (port 22) connections originating from a private IP address on a device to a public IP address. This could indicate unauthorized remote access, data exfiltration, or command and control activity.
This rule detects an unusually high number of outbound network connections originating from the Local Security Authority Subsystem Service (LSASS) process on a Windows machine. LSASS is a critical system process responsible for enforcing security policy on the system, including user authentication, and typically does not initiate a large number of outbound connections. A high count of outbound connections from LSASS could indicate credential dumping activity, where an attacker is exfiltrating harvested credentials, or other malicious activity compromising the LSASS process.
Detects network connections to known command and control (C2) infrastructure associated with malicious NPM packages acting as Remote Access Trojans (RATs). The rule identifies specific outbound connections to a hardcoded malicious IP and port, as well as traffic involving a suspicious domain string.
Detects network connections to known command and control (C2) infrastructure associated with malicious NPM packages acting as Remote Access Trojans (RATs). The rule identifies specific outbound connections to a hardcoded malicious IP and port, as well as traffic involving a suspicious domain string.
Detects macOS Terminal (bash/zsh) retrieving loader.sh or payload.applescript directly from the ClickFix attacker infrastructure.
Detects activity associated with the StegoAd browser extension campaign. This rule monitors for the registration of new browser extensions in Chrome or Edge, followed by suspicious browser-based network activity including DNS queries to known C2 infrastructure or the loading of specific WebP files used for steganographic payload delivery.
This rule detects outbound network traffic from internal hosts to a known malicious IP address (193.242.184.150) over port 22 (SSH). This behavior is indicative of a reverse SSH tunnel established for C2 communication and the potential exposure of internal RDP services to the attacker.
Detects network connections initiated by 'Browser_Updater.exe' to a known malicious IP address (45.251.243.210) or a specific domain containing 'iis.jpg'. This activity is indicative of initial access or command and control related to a specific campaign.
Detects potential Command and Control (C2) communication associated with Emotet malware by monitoring for successful network connections to suspicious remote ports frequently used by the malware. The rule flags endpoints that establish connections to at least three of these high-risk ports within a one-hour window, which is indicative of automated C2 beaconing behavior.
This rule detects potential command and control (C2) beaconing activity by identifying devices communicating with known suspicious remote IP addresses at regular, repeating intervals. It calculates the time difference between consecutive connections to specific suspicious IPs and identifies devices that establish at least three connections within one-hour bins, adhering to a 1 to 15-minute heartbeat interval.
This rule monitors Cisco Unified Communications Manager (UCM) environments for multiple stages of an attack chain, including potential Server-Side Request Forgery (SSRF) attempts against administrative interfaces, suspicious file modifications by service accounts, indicators of privilege escalation, and anomalous outbound network connections from core Cisco processes.
This rule detects network connections made to specific non-standard ports (7777, 8080, 8443) where the remote URL contains substrings associated with proxy or tunneling activities ('proxy', 'tunnel', 'hide'). This behavior is commonly associated with malware attempting to evade security controls by routing traffic through unauthorized intermediaries or obfuscated tunnels.
This rule detects potential command and control (C2) activity associated with the BTMOB Remote Access Trojan (RAT). It monitors for suspicious network behavior by correlating DNS requests to ip-api.com (a common geolocation service used by malware to identify the victim's location/public IP) with subsequent C2 communication to cloud services (Google Pub/Sub, Azure MQTT) or non-standard network traffic on port 3478 (often used for STUN/NAT traversal, but excluded for known browsers and communication tools) within a 30-minute window.
This rule monitors for network connections that occur over non-standard ports (STUN, MQTT) or to specific suspicious IP addresses and domains, while excluding known legitimate user-facing applications. The detection aims to identify potentially malicious command and control (C2) communication or unauthorized network activity performed by non-standard processes.
Detects suspicious network activity using the STUN/TURN protocol on port 3478 initiated by non-browser and non-conferencing processes. The rule specifically targets unsigned processes or those located in user-writable directories (such as Temp or AppData), which are common indicators of Grandoreiro malware sideloading and establishing C2 communication tunnels.
Detects processes containing sensitive credential-related keywords (cookies, creds, password, token) in their command lines followed by a network connection to known suspicious remote IP addresses within a 60-minute window, suggesting potential credential exfiltration.
This rule detects potentially unauthorized processes establishing network connections over port 8883 (MQTT/MQTTS) to major cloud IoT platforms (AWS IoT, Azure IoT Hub, GCP PubSub). It flags processes that are not common web browsers and calculates a suspicious score based on data volume, execution path (e.g., Temp or AppData), and the process name not matching known legitimate IoT software.
Page 210 of 280