Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,879 detections
Filters
Last updated
All Time
Detection languages
2,954
1,378
313
289
239
Contributors
1,807
1,529
1,304
180
173
Categories
20,462
11,849
5,879
5,158
4,866
Platforms
3,747
1,857
1,076
782
160
Products / Services
2,241
1,434
1,273
746
582
MITRE Techniques
2,448
2,151
1,129
937
790
CVEs
19
15
9
7
5
IDS Classtypes
834
334
94
23
20
IDS Protocols
689
276
235
117
23
Detects a suspicious execution chain potentially associated with Deed RAT (used by Mustang Panda/Twill Typhoon), consisting of DLL sideloading by a legitimate signed executable followed by persistence mechanism creation (Registry Run keys or Scheduled Tasks) on the same host. Additionally, it identifies devices exhibiting repeated outbound connections to the same remote public IP over multiple days, serving as an indicator of potential re-compromise or persistent C2.
Detects network and DNS activity involving domains known to be used by the threat actor APT28 for command and control, specifically for hosting WebDAV payloads, malicious LNK files, and weaponized documents.
This rule detects the suspicious initialization of the Common Language Runtime (CLR) components (mscoree.dll, clr.dll, or oleaut32.dll) within the explorer.exe process, followed closely by an outbound HTTPS connection to filen.io domains. This pattern is indicative of fileless .NET-based C2 implants, such as those generated by the Covenant framework, executing within the context of a legitimate Windows shell process.
This rule detects the suspicious initialization of the Common Language Runtime (CLR) components (mscoree.dll, clr.dll, or oleaut32.dll) within the explorer.exe process, followed closely by an outbound HTTPS connection to filen.io domains. This pattern is indicative of fileless .NET-based C2 implants, such as those generated by the Covenant framework, executing within the context of a legitimate Windows shell process.
Detects network connections over port 3389 (RDP) initiated by processes other than standard Remote Desktop clients (mstsc.exe). This rule specifically looks for suspicious indicators such as execution from non-standard or temporary file paths, or the use of common living-off-the-land binaries (like powershell.exe, cmd.exe, rundll32.exe) that might be acting as a proxy for remote access or lateral movement.
Detects processes attempting to query the Cloud Instance Metadata Service (IMDS) endpoint (169.254.169.254) that are not recognized as legitimate cloud agent software (such as AWS, Azure, or Google cloud agents). This behavior is often indicative of SSRF or unauthorized discovery attempts by an adversary on a compromised cloud instance.
Detects processes attempting to query the Cloud Instance Metadata Service (IMDS) endpoint (169.254.169.254) that are not recognized as legitimate cloud agent software (such as AWS, Azure, or Google cloud agents). This behavior is often indicative of SSRF or unauthorized discovery attempts by an adversary on a compromised cloud instance.
Detects network connections initiated by a non-Microsoft signed rundll32.exe process. The rule identifies processes named rundll32.exe that are not signed by Microsoft and are communicating over common ports associated with malicious activity, specifically focusing on external IP addresses and multiple connection attempts.
This rule detects network connections on port 443 made to common public DNS resolvers (1.1.1.1, 8.8.8.8, 8.8.4.4, 9.9.9.9, 149.112.112.112) by processes other than known web browsers. This behavior is atypical for standard endpoint processes and may indicate the use of DNS-over-HTTPS (DoH) for command and control or data exfiltration to bypass network filtering.
Identifies outbound C2 connections to domains generated by MLTBackdoor DGA.
This rule detects outgoing network connections from the IIS worker process (w3wp.exe) to public-facing URLs that match common Microsoft Office WOPI (Web Application Open Platform Interface) request patterns, but are directed to domains other than trusted Microsoft-affiliated infrastructure. This behavior can be indicative of a Server-Side Request Forgery (SSRF) attempt, where an attacker tries to coerce the server into making unauthorized requests to external resources.
This rule detects network connections over WinRM ports (5985, 5986) originating from potentially suspicious processes that are not standard Windows remote management binaries. It explicitly identifies activity where SharePoint-related processes initiate WinRM, which may indicate lateral movement patterns such as those seen in activity attributed to Storm-2603.
This rule detects network connections over WinRM ports (5985, 5986) originating from potentially suspicious processes that are not standard Windows remote management binaries. It explicitly identifies activity where SharePoint-related processes initiate WinRM, which may indicate lateral movement patterns such as those seen in activity attributed to Storm-2603.
Detects svchost.exe (hosting Windows Store Install Service) loading InstallServicePlugin.dll from a UNC path or making outbound SMB connections as NT AUTHORITY\SYSTEM. This indicates successful UNCanny coercion where the SYSTEM-level service performs LoadLibraryW against an attacker-controlled UNC path, enabling NTLM machine account capture or SYSTEM code execution.
Detects potential browser fingerprinting and network reconnaissance behavior associated with Bluekit BitM PhaaS campaigns. The rule correlates large suspicious JavaScript file downloads (excluding common CDNs) with STUN server connectivity within a 10-minute window, a pattern often used by adversary-in-the-middle (AiTM) frameworks to fingerprint victims and establish WebRTC channels.
This rule detects the execution of known remote access tools (such as AnyDesk, TeamViewer, or RustDesk) that are spawned as child processes from common web browsers. It correlates process creation events with subsequent network connections by these tools to public IP addresses over specific ports commonly used by remote access software, within a 30-minute timeframe of the process start.
This rule detects network connections to known IP addresses associated with the FortiBleed vulnerability exploitation. These IP addresses have been categorized based on their observed roles in FortiBleed attacks, including C2, pentest lab, credential validation, and sniffer nodes. Monitoring these connections can help identify compromised systems communicating with FortiBleed infrastructure.
Detects anomalous behavior associated with msiexec.exe that aligns with activity patterns of infostealer malwares like Lumma Stealer and Amadey Bot. This includes cross-process injection from unsigned processes, spawning of msiexec.exe by LOLBins or script interpreters, suspicious outbound network connectivity, and unauthorized access to browser credential storage files.
Detects outbound network connections to major Large Language Model (LLM) API endpoints (OpenAI, Google, Anthropic) initiated by processes not explicitly identified as standard web browsers or command-line utilities. This pattern may indicate automated data exfiltration ('prompt stealing' or unauthorized access to corporate data) using custom or malicious tools executing from suspicious directories like temp, appdata, or public folders.
This rule detects network connections to known IP addresses associated with the FortiBleed vulnerability exploitation. These IP addresses have been categorized based on their observed roles in FortiBleed attacks, including C2, pentest lab, credential validation, and sniffer nodes.
Detects DNS lookups and network connections to known AI API endpoints (OpenAI, Anthropic, Google Generative Language) initiated by non-standard processes. This rule excludes common web browsers, productivity applications, and development tools to identify potentially unauthorized or suspicious interaction with AI services from internal processes.
Page 212 of 280