Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,879 detections
Filters
Last updated
All Time
Detection languages
2,954
1,378
313
289
239
Contributors
1,807
1,529
1,304
180
173
Categories
20,460
11,847
5,879
5,158
4,866
Platforms
3,747
1,857
1,076
782
160
Products / Services
2,241
1,434
1,273
746
582
MITRE Techniques
2,448
2,151
1,129
937
790
CVEs
19
15
9
7
5
IDS Classtypes
834
334
94
23
20
IDS Protocols
689
276
235
117
23
This rule detects the execution of known lateral movement tools, including Impacket suite components and NetExec (formerly CrackMapExec), by monitoring process command lines. It specifically flags tools such as psexec.py, wmiexec.py, and secretsdump.py, which are frequently used for remote execution and credential dumping. The rule also joins these process events with network events targeting SMB port 445 to correlate tool usage with potential lateral movement activity.
Detects a sequential pattern where a browser process (Chrome, Edge, or Safari) accesses an AI chat platform's conversation API, followed within 5 minutes by a network connection to a known unauthorized exfiltration destination (api.pbapi.xyz). This pattern suggests the potential use of a browser-based tool or extension (e.g., Poper Blocker or similar) to intercept and exfiltrate AI chat history.
This rule detects incoming phishing emails that use specific financial or payment-related lures (e.g., 'eft wire transfer', 'invoice receipt') in the subject line or body to entice users into clicking a link that points directly to an executable file, often disguised as a document.
This rule monitors for indicators of compromise (IOCs) associated with the Lunex Malware-as-a-Service (MaaS) campaign. It aggregates telemetry from file creation, process execution, and network connections to identify the presence of known malicious hashes, C2 IP addresses, phishing-related domains, and specific payload URLs.
Detects high-volume POST requests or traffic flagged by DLP mechanisms destined for known public generative AI platforms (e.g., OpenAI, Claude, Google Gemini). This rule identifies potential unauthorized transmission of sensitive or regulated data, such as PII or confidential information, to third-party AI services.
Detects periodic, beacon-like network activity targeting public platforms such as Steam community profiles or Telegram (api.telegram.org / t.me) originating from suspicious processes (script interpreters, unsigned binaries). This behavior is characteristic of LummaC2 and similar malware families using public web services as dead-drop resolvers for C2 fallback communication.
Detects a multi-stage activity chain indicative of infostealer malware, including reading the browser 'Local State' file (containing the master key), accessing a browser process (likely for memory dumping or token extraction), and initiating an immediate outbound network connection to an external destination.
This rule detects network connections initiated by unsigned executables that were recently created (within one hour) in common staging directories such as AppData, Temp, or ProgramData. It specifically targets beacons to the Telegram Bot API or Discord webhooks, which are common patterns for command-and-control (C2) communication used by malware such as the Amadey bot.
This rule detects HTTP GET requests to known malicious domains or URI patterns associated with fake video-conferencing lures. These lures redirect users to download RMM (Remote Monitoring and Management) MSI installers, often masquerading as legitimate software like Adobe Reader or video conferencing tools, as part of a social engineering campaign for initial access.
Detects HTTP POST requests to Telegram Bot API and Discord webhooks containing large, Base64-encoded strings within request bodies, which may indicate exfiltration of reconnaissance data or sensitive information.
Detects HTTP POST requests directed at common Large Language Model (LLM) chat completion and completion endpoints that are not associated with authorized OpenAI or Azure OpenAI services. This behavior may indicate an attempt to exfiltrate potentially sensitive corporate or proprietary data to third-party or unauthorized Shadow-AI platforms.
Detects network requests to the domain 'cloud-ack.workers.dev', which is known to be used as a redirector for hosting Microsoft authentication lookalike pages to conduct phishing attacks.
Detects network traffic to the Telegram Bot API where the request URI contains indicators of sensitive data exfiltration such as 'cookie', 'session', 'password', or 'credential'. This pattern is often associated with adversary-in-the-middle (AiTM) phishing kits (e.g., Evilginx2) exfiltrating stolen session tokens or credentials to an attacker-controlled Telegram bot.
This rule detects potential command and control (C2) beaconing activity by monitoring for high-frequency POST requests to OpenAI and Google Generative Language chat completion API endpoints. The rule triggers when a source host makes 5 or more requests within a 60-second window, which may indicate automated polling for commands or exfiltrated data transfer using legitimate LLM infrastructure.
This rule detects potential command and control (C2) beaconing activity where specific suspicious API endpoints (/api/v1/ping.php and /api/v1/connect.php) are accessed by common system processes (msedge_proxy.exe or WindowsUpdate.exe). The logic clusters these network requests by device and process, triggering an alert when both endpoints are observed from the same process on a single device, a common indicator of a C2 communication pattern.
The following analytic detects any outbound network connection from an endpoint process to a known suspicious or non-standard port.
It leverages Cisco Network Visibility Module flow data logs to identify potentially suspicious behavior by looking at processes
communicating over ports like 4444, 2222, or 51820 are commonly used by tools like Metasploit, SliverC2 or other pentest, red team or malware.
These connections are worth investigating further, especially when initiated by unexpected or non-network-native binaries.
It leverages Cisco Network Visibility Module flow data logs to identify potentially suspicious behavior by looking at processes
communicating over ports like 4444, 2222, or 51820 are commonly used by tools like Metasploit, SliverC2 or other pentest, red team or malware.
These connections are worth investigating further, especially when initiated by unexpected or non-network-native binaries.
Detects suspicious network activity or credential exfiltration attempts occurring during package manager installation processes (npm, pip, yarn). The rule monitors for lifecycle scripts (e.g., preinstall, postinstall) spawning network utilities to external destinations or accessing common CI/CD secrets like AWS_SECRET_ACCESS_KEY or GITHUB_TOKEN.
Detects outbound network traffic from internal hosts to the domain 'skyleen.fr' over TLS/HTTPS, which is characteristic of credential exfiltration associated with the Sckit supply chain worm.
Detects indicators of Cobalt Strike activity, including the creation of default named pipes, process injection into common LOLBins without legitimate parent processes, and network communication patterns consistent with Cobalt Strike malleable C2 profiles.
This rule detects HTTP GET requests initiated by the Windows PowerShell User-Agent where the destination host is a decimal-encoded IP address. This pattern is commonly associated with ClickFix-style social engineering attacks, where users are tricked into executing obfuscated PowerShell commands to download malicious payloads.
Detects network traffic associated with the ClickFix Traffic Distribution System (TDS), specifically targeting requests to known malicious domains like fsputnik.com and uasputnik.com, as well as associated fake Cloudflare verification lure pages.
Page 22 of 280