Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,879 detections
Filters
Last updated
All Time
Detection languages
2,954
1,378
313
289
239
Contributors
1,807
1,529
1,304
180
173
Categories
20,462
11,849
5,879
5,158
4,866
Platforms
3,747
1,857
1,076
782
160
Products / Services
2,241
1,434
1,273
746
582
MITRE Techniques
2,448
2,151
1,129
937
790
CVEs
19
15
9
7
5
IDS Classtypes
834
334
94
23
20
IDS Protocols
689
276
235
117
23
This rule detects outbound TCP traffic from internal network hosts to known Tor relay ports (9001, 9030), which is a common communication pattern for the NBLock ransomware strain to establish a command and control channel through the Tor network.
Detects outbound network traffic to the ScreenConnect service specifically targeting the /Relay/ path, which is commonly abused by ransomware operators (e.g., Interlock, RansomHub) for establishing unauthorized remote access and command-and-control channels.
Detects outbound SOCKS5 negotiation patterns commonly used by the Salt Typhoon threat group's STOWAWAY tool. The rule triggers on TCP traffic initiating a SOCKS5 handshake (represented by the sequence |05 01 00|) to non-standard ports, excluding common proxy ports (1080, 3128, 8080, 8443, 9050). This behavior is indicative of a multi-hop SOCKS5 relay or command-and-control connection.
Detects outbound HTTP POST requests to file.io originating from a Go-based HTTP client, consistent with the GopherWhisper APT C2 or exfiltration activity.
Detects DNS queries for the domain 'screenai.online', which is associated with the Phoenix Backdoor used by the MuddyWater (also known as Seedworm or MERCURY) threat group for command-and-control (C2) communication.
Detects outbound HTTP POST requests containing keywords indicative of credential and data theft associated with VBV Stealer malware, specifically looking for fields related to passwords, cookies, or wallets in the request body.
Detects outbound network traffic to the ScreenConnect service specifically targeting the /Relay/ path, which is commonly abused by ransomware operators (e.g., Interlock, RansomHub) for establishing unauthorized remote access and command-and-control channels.
Detects outbound SOCKS5 negotiation patterns commonly used by the Salt Typhoon threat group's STOWAWAY tool. The rule triggers on TCP traffic initiating a SOCKS5 handshake (represented by the sequence |05 01 00|) to non-standard ports, excluding common proxy ports (1080, 3128, 8080, 8443, 9050). This behavior is indicative of a multi-hop SOCKS5 relay or command-and-control connection.
Detects network beaconing activity attributed to the OceanLotus (APT32) threat group, specifically the SPECTRALVIPER C2 mechanism. The rule identifies the 'OneDrive.Sync.Services.exe' process performing HTTP GET requests to known attacker-controlled infrastructure or using specific malicious cookie headers (zd_cs_pm, euconsent-v2) for command-and-control communication.
Detects outbound network connections initiated by ConfigurationRemotingServer.exe on port 443, which may indicate a reverse shell connection established via DSC (Desired State Configuration) resources.
Detects two distinct suspicious activities on Linux systems: masquerading by processes named 'uptime' making outbound network connections to non-local IP ranges, and the execution of binaries associated with AtlasRAT.
This rule detects potentially malicious activity involving the Linux 'uptime' utility, including abnormal network connections to non-private IP addresses, execution with command-line flags often associated with non-standard utility behavior, and the creation of systemd service files, which may indicate a persistence mechanism.
Identifies python-requests User-Agent authenticating into Office/Graph applications, indicative of Kali365 backend egress.
Detects outbound network connections to common Large Language Model (LLM) APIs (OpenAI, Anthropic, Google) or local LLM instances (Ollama) from processes that are not standard web browsers, common IDEs, or typical development/scripting tools. This behavior may indicate an attempt to exfiltrate sensitive data or interact with LLM services using unauthorized or hidden processes.
Detects instances where a Perl interpreter attempts to mask itself as a Samba (smbd) service process, or where smbd/perl processes initiate network connections on port 5000, and identifies smbd processes spawned by non-standard parent processes like sh, bash, or perl, which is indicative of potential unauthorized service manipulation or backdoor activity.
Detects instances where common web application processes (such as Flask, Django, Gunicorn) execute system utilities (curl, wget, etc.) to query the cloud metadata service URL (169.254.169.254) or domain names associated with instance metadata. This behavior is indicative of potential SSRF exploitation to retrieve cloud environment secrets or instance identity credentials.
Detects the use of Gsocket or gs-netcat utilities for outbound network connections on non-standard ports, as well as the execution of masqueraded 'uptime' binaries making network connections. It also monitors for DNS resolutions associated with Gsocket relay infrastructure to identify potential command and control or unauthorized tunneling attempts.
Detects fltMC.exe initiating outbound network connections, which is anomalous behavior indicative of potential JFMBackdoor activity (associated with Red Lamassu/Calypso) utilizing DLL sideloading or reverse shell execution.
This rule detects web browser processes (Chrome, Edge, Brave, Electron) making network requests to 'raw.githubusercontent.com' that contain keywords indicative of sensitive data, such as 'credential', 'secret', 'password', 'token', 'api_key', or '.env'. This behavior may indicate an adversary attempting to download configuration files or sensitive credentials hosted on GitHub.
Detects outbound network connections to major Large Language Model (LLM) API endpoints (OpenAI, Google, Anthropic) initiated by processes not explicitly identified as standard web browsers or command-line utilities. This pattern may indicate automated data exfiltration ('prompt stealing' or unauthorized access to corporate data) using custom or malicious tools executing from suspicious directories like temp, appdata, or public folders.
This rule detects suspicious outbound network connections to specific Fastly CDN IP addresses associated with the Kimsuky threat group's NUKESPED backdoor. The rule identifies processes attempting to communicate with these infrastructure IPs that are not part of a predefined list of trusted or common legitimate applications, indicating potential command and control (C2) activity.
Page 220 of 280