Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,879 detections
Filters
Last updated
All Time
Detection languages
2,954
1,378
313
289
239
Contributors
1,807
1,529
1,304
180
173
Categories
20,462
11,849
5,879
5,158
4,866
Platforms
3,747
1,857
1,076
782
160
Products / Services
2,241
1,434
1,273
746
582
MITRE Techniques
2,448
2,151
1,129
937
790
CVEs
19
15
9
7
5
IDS Classtypes
834
334
94
23
20
IDS Protocols
689
276
235
117
23
Rust-based macOS infostealer implant embedding prompt injection payloads
Fraud framework powering scam domains for crypto and gambling schemes
Fraud framework powering scam domains for crypto and gambling schemes
Form-grabbing and credential stealing malware-as-a-service
Credential and browser data stealer distributed via OXLOADER campaigns
Ransomware group exploiting edge devices and managed file transfer software
Credential and browser data stealer distributed via OXLOADER campaigns
Flags traffic targeting known rogue DNS infrastructure IPs associated with recent SOHO router hijacking campaigns. This rule specifically looks for outbound network connections to IP addresses starting with '5.' or '185.' on destination port 53 (DNS).
Identifies LLM API interaction followed shortly by the execution of Impacket tools (wmiexec.py, smbexec.py), simulating attackers using AI to formulate lateral movement commands.
This rule monitors build agent processes (e.g., Jenkins, Bamboo, Gradle, MSBuild) for suspicious DNS activity. It alerts when these processes resolve a high volume (3 or more) of unique external domains that are not associated with typical development, build, or dependency management platforms (e.g., Microsoft, Azure, GitHub, NPM, PyPI, Maven, Sonatype). This behavior may indicate an attempt by an adversary to reach command-and-control servers or exfiltrate data from a compromised build environment.
Detects a compiled Mach-O binary residing in a hidden directory (e.g., ~/.config/) making periodic TCP connections to known C2 subnets on common web ports (80, 443, 8080).
This rule detects validly signed executables making HTTP POST connections, which could indicate data exfiltration or command and control (C2) communication by a signed dropper. It correlates network events with image load events to identify processes with valid signatures performing HTTP POST requests.
Detects scripts launched from developer directories (e.g., GitHub, GitLab, Bitbucket, or directories containing 'interview' in their path) that attempt to exfiltrate data by making network connections to Discord or Telegram API webhooks. This rule specifically looks for network events where the remote URL matches Discord or Telegram webhook patterns, and correlates them with process events where the initiating process's folder path suggests a developer-related or interview-related context.
Detects anomalous activity associated with 'winupdate.exe', including suspicious registry run key persistence, execution from abnormal directories (e.g., AppData, .cache), and unauthorized outbound network connections to Pastebin. The rule triggers when multiple signals are observed from the same host and user, indicating potential malware behavior.
Detects network connections from suspicious process paths (e.g., AppData, Temp, Downloads) or processes/command-lines associated with Roblox-related game executors (e.g., Solara, Yuta) to DeepSeek domains. This rule helps identify potentially malicious tools or scripts attempting to communicate with external infrastructure often used by such utilities.
This rule monitors for large outbound network data transfers (greater than 10MB) over standard web ports (80/443) initiated by processes typically associated with office productivity applications (e.g., WinWord, Excel, Outlook) or credential dumping tools (lsass.exe). It further correlates this activity with preceding network connections to common directory service ports (LDAP/Global Catalog) on the same host, indicating potential credential collection followed by data exfiltration.
Detects HTTP POST beaconing behavior to known infrastructure associated with Atlas RAT and ValleyRAT malware, linked to TA4922 campaigns. The rule monitors for repeated connections to specific C2 IP addresses on TCP port 886.
Detects indicators of the IronWorm malware performing self-propagation by abusing npm Trusted Publishing (OIDC) token exchange, executing suspicious npm publish commands, and unauthorized access to ~/.npmrc configuration files. The rule monitors for network requests to npm OIDC endpoints from non-standard processes, npm publish operations originating from non-interactive shell or script environments, and file access to credential files by suspicious parent processes.
macOS malware used by JINX-0164 against cryptocurrency developers
Commodity .NET keylogger and remote access trojan
Detects potential supply-chain attacks where a malicious 'preinstall' hook in an npm package drops and executes a native binary (ELF or PE) from within the 'node_modules' directory. It monitors both the initial execution of the binary by npm/node and subsequent network activity from such binaries, specifically targeting suspicious subdirectories like 'tools/' or '.bin/'.
Page 217 of 280