Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,879 detections
Filters
Last updated
All Time
Detection languages
2,954
1,378
313
289
239
Contributors
1,807
1,529
1,304
180
173
Categories
20,462
11,849
5,879
5,158
4,866
Platforms
3,747
1,857
1,076
782
160
Products / Services
2,241
1,434
1,273
746
582
MITRE Techniques
2,448
2,151
1,129
937
790
CVEs
19
15
9
7
5
IDS Classtypes
834
334
94
23
20
IDS Protocols
689
276
235
117
23
This rule detects a high volume of successful network connections to common web ports (80, 443, 8080, 8443) where the remote URL contains keywords like 'version' or 'software'. This pattern could indicate an adversary performing reconnaissance to identify installed software and their versions, potentially looking for vulnerabilities or specific applications to target. The threshold of 10 such activities within an hour for a single device is set to flag anomalous behavior.
Detects devices making a high volume (5 or more per hour) of successful network connections to remote URLs containing 'update' or 'patch' on port 443 (HTTPS). This could indicate legitimate system updates, but also potentially malicious update checks or beaconing activity.
This rule detects an unusually high number of network connections made by common package managers (npm, nuget, pip) to their respective repositories. A high volume of connections within a short period (1 hour) could indicate automated activity, potential supply chain compromise, or an adversary attempting to download numerous packages for reconnaissance, staging, or malicious purposes.
This rule detects processes making a high volume of successful network connections (3 or more within an hour) to domains containing 'codeartifact' or 'artifactory'. This behavior could indicate an attempt to download tools, libraries, or other artifacts, potentially as part of an ingress tool transfer or supply chain attack.
This rule detects processes making a high volume of successful network connections to GitHub's raw content (raw.github.com). This behavior can be indicative of an adversary downloading tools, scripts, or other malicious content from GitHub, potentially as part of a command and control (C2) channel or for staging purposes. The rule counts connections per hour per initiating process filename and flags if the count exceeds 5.
Detects network traffic on port 443 originating from non-browser processes destined for known DNS-over-HTTPS (DoH) providers (Cloudflare, Google, Quad9). This behavior can indicate an attempt to bypass standard network DNS filtering or to establish Command and Control (C2) communication channels using the DoH protocol.
Detects unauthorized or anomalous modifications to local vector database files by non-standard processes.
Detects unauthorized or anomalous modifications to local vector database files (e.g., ChromaDB, FAISS SQLite) by non-standard processes, indicating an attacker attempting to poison the AI's retrieval context directly. The rule specifically looks for file modifications or renames of common vector database files (chroma.sqlite3, faiss_index.index, index.faiss) where the initiating process is not a standard AI/ML runtime (python.exe, node.exe, docker.exe) and there is an outbound network connection from that process to a non-localhost IP.
Detects network traffic on port 443 originating from non-browser processes destined for known DNS-over-HTTPS (DoH) providers (Cloudflare, Google, Quad9). This behavior can indicate an attempt to bypass standard network DNS filtering or to establish Command and Control (C2) communication channels using the DoH protocol.
Detects outbound network connections from the aspnet_compiler.exe process. This process is often abused by malware like LokiBot as a host for malicious payloads through process injection to establish C2 communication, as it has no legitimate need for external network connectivity.
This rule detects secondary Command and Control (C2) communication associated with the Remcos RAT loader. It identifies suspicious network connections to specific IP addresses, domains (including those often used by malicious actors like .bit, .onion, .su, .cc), and remote ports commonly utilized by Remcos.
Detects network connections over SMB (port 445) targeting internal IP ranges initiated by common penetration testing or scripting tools (e.g., Python, msfconsole), or attempts containing known exploit strings such as 'eternalblue', 'ms17-010', or 'WinboxExploit'. This behavior is indicative of lateral movement, reconnaissance, or exploitation attempts within the network.
This rule detects network connections to common IP geolocation services such as ip-api.com, ipinfo.io, ipgeolocation.io, and bgpview.io. Adversaries may use these services to gather information about the victim's network, including IP addresses, geographical location, and network topology, which can aid in further targeting or reconnaissance efforts.
Detects outbound network connection from a host to a known malicious IP and port associated with the exploitation of the GeoServer WFS vulnerability CVE-2024-36401. This rule identifies the potential post-exploitation callback, such as a curl command, following successful remote code execution.
Detects evidence of LCRYX ransomware activity, specifically identifying beaconing behavior via a 'ping.exe' loop targeting the 'ragebot.fun' domain, and the execution of suspicious Visual Basic scripts (systemconfig.exe.vbs) via wscript or cscript, which are often used for stage-loading malicious payloads.
Detects WinRAR executing with archiving flags (create, add, move) on sensitive paths, followed by an outbound network connection to a non-private IP address within a 10-minute window, which is characteristic of data staging and exfiltration.
This rule detects the staging of data using WinRAR, followed by potential exfiltration to known public file-sharing services (easyupload.io, anonfiles.com, gofile.io, transfer.sh) within a 2-hour window. It monitors for either DNS requests to these domains or the execution of web browsers or common command-line tools (curl, wget, PowerShell) with these domains in the command line arguments following WinRAR usage.
Identifies the ScreenConnect Client Service initiating network traffic to the domain 'directdownload.icu', which has been associated with cryptojacking campaigns. This activity indicates potential compromise and resource hijacking.
Detects Microsoft Teams processes (teams.exe or ms-teams.exe) making multiple network connections to domains or IP addresses that are not part of the expected Microsoft Teams infrastructure. This rule specifically looks for connections to non-Microsoft domains (excluding .microsoft.com, .office.com, .office365.com, .skype.com, .azure.com, .cdn.office.net) and non-private IP addresses, indicating potential C2 activity by the Backdoor.Turn malware.
Identifies execution of the Windows PowerShell cradle used by GLASSWORM's WASM loader. It looks for 'irm' (Invoke-RestMethod) fetching a URL containing the specific '/win32/i/_' path structure, piped to 'iex' (Invoke-Expression). This pattern is indicative of the GLASSWORM malware's initial payload delivery mechanism.
Detects a non-cloud client process issuing API-style requests associated with object listing, content upload, or content download to a cloud storage service. The rule specifically targets processes with names matching patterns like 'bird', 'rok', 'game', or 'update' followed by '.exe', and command lines containing API-related keywords ('files/list', 'files/upload', 'files/download', 'oauth', 'bearer', 'api') in conjunction with cloud storage service names ('dropbox', 'pcloud', 'cloud'). This behavior is indicative of malware using legitimate cloud services for command and control or data exfiltration.
Page 224 of 280