Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,879 detections
Filters
Last updated
All Time
Detection languages
2,954
1,378
313
289
239
Contributors
1,807
1,529
1,304
180
173
Categories
20,462
11,849
5,879
5,158
4,866
Platforms
3,747
1,857
1,076
782
160
Products / Services
2,241
1,434
1,273
746
582
MITRE Techniques
2,448
2,151
1,129
937
790
CVEs
19
15
9
7
5
IDS Classtypes
834
334
94
23
20
IDS Protocols
689
276
235
117
23
Clipboard hijacking malware for cryptocurrency address substitution
Commodity .NET keylogger and remote access trojan
macOS malware used by JINX-0164 against cryptocurrency developers
This rule detects network connections to the Telegram API (api.telegram.org) initiated by specific processes that are typically associated with scripting or unauthorized execution (BQT.exe, start.exe, python.exe, pythonw.exe), while explicitly excluding common web browsers. This behavior is often indicative of automated command-and-control (C2) communication or data exfiltration using Telegram as a transport layer.
Open-source derived remote access trojan with plugin architecture
Commodity .NET keylogger and remote access trojan
Clipboard hijacking malware for cryptocurrency address substitution
Commodity .NET keylogger and remote access trojan
Detects unauthorized processes (excluding known web browsers and system processes) attempting to access sensitive browser credential files (e.g., Login Data, key4.db) followed by a network connection to external IP addresses. This behavior is highly indicative of credential theft and subsequent exfiltration.
Detects the execution of known debugger/disassembler tools (Ghidra, dnSpy, x64dbg) that exhibit suspicious network behavior. The rule specifically looks for these tools initiating network connections to destinations outside of their official update or project domains shortly after execution, and filters out known good hash signatures.
This rule detects a process identified as a Go-compiled binary (via command-line arguments like 'goroutine' or 'runtime.main') that exhibits rapid, high-volume file interactions (more than 100 files accessed or created in a 60-second window) alongside outbound network connectivity. This behavior is indicative of malicious automated activity such as file encryption for ransomware or rapid data staging and exfiltration.
Detects potential supply chain attacks where a suspicious Python package is installed via 'pip' followed by execution of suspicious commands or network activity from 'python.exe' within a short timeframe. This rule correlates process creation events involving pip installations with subsequent suspicious command-line activity or external network connections from Python processes.
This rule monitors for outbound network connections to 'graph.microsoft.com' initiated by processes that are either unsigned or not digitally signed by Microsoft. It further correlates these connections with proxy logs to identify processes utilizing non-standard or unexpected User-Agents. This behavior is indicative of potentially malicious activity attempting to masquerade as legitimate Microsoft services or using the Microsoft Graph API for command and control or data exfiltration.
Detects the execution of known debugger/disassembler tools (Ghidra, dnSpy, x64dbg) that exhibit suspicious network behavior. The rule specifically looks for these tools initiating network connections to destinations outside of their official update or project domains shortly after execution, and filters out known good hash signatures.
This rule detects a process identified as a Go-compiled binary (via command-line arguments like 'goroutine' or 'runtime.main') that exhibits rapid, high-volume file interactions (more than 100 files accessed or created in a 60-second window) alongside outbound network connectivity. This behavior is indicative of malicious automated activity such as file encryption for ransomware or rapid data staging and exfiltration.
This rule detects processes other than standard web browsers performing network connections that coincide with OAuth token acquisition activities (POST requests containing 'access_token' in the response body). This behavior is indicative of potential token theft or unauthorized programmatic access to OAuth-protected resources.
This rule identifies potential Command and Control (C2) beaconing activity by detecting recurring, consistent HTTP(S) requests from internal hosts to unknown or newly seen external destinations, characterized by stable time intervals and low variance in response sizes. The detection logic filters out common User-Agents, indicating non-browser or automated traffic often associated with malware communication.
This rule detects the execution of QEMU binaries from non-standard locations on Windows endpoints, or the use of port-forwarding command-line flags. Adversaries, including Payouts King and BlackBasta affiliates, leverage QEMU to establish hidden virtual machines for persistent access, credential theft, and to create covert reverse SSH tunnels to bypass network security controls.
Detects Microsoft Outlook spawning a command-line interpreter (cmd.exe or powershell.exe) followed by a network connection originating from that interpreter within a 5-minute window. This behavior is highly suspicious and often indicative of malicious macro execution or exploit delivery via email attachments leading to command-and-control activity.
This rule identifies instances where python.exe or python3.exe executes from non-standard system paths and establishes an outbound network connection to external (non-private/non-loopback) IP addresses. This behavior is indicative of potential malicious activity, as legitimate applications typically execute from protected program file directories, while adversaries often execute unauthorized binaries from temporary or user-writable locations to initiate command and control (C2) communication.
This rule monitors for indicators of unauthorized Tor usage or anonymization activity, including non-standard Tor executable paths, suspicious library loads, the creation of Tor configuration files (torrc), non-browser processes communicating over known Tor ports, and DNS queries for .onion domains. It also specifically monitors for potential data exfiltration via the temp.sh file-sharing service from non-browser applications. The rule aggregates these suspicious signals over a 24-hour period to calculate a risk severity score based on the frequency and variety of indicators detected.
Page 218 of 280