Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,879 detections
Filters
Last updated
All Time
Detection languages
2,954
1,378
313
289
239
Contributors
1,807
1,529
1,304
180
173
Categories
20,460
11,847
5,879
5,158
4,866
Platforms
3,747
1,857
1,076
782
160
Products / Services
2,241
1,434
1,273
746
582
MITRE Techniques
2,448
2,151
1,129
937
790
CVEs
19
15
9
7
5
IDS Classtypes
834
334
94
23
20
IDS Protocols
689
276
235
117
23
This rule detects network connections on port 443 made to common public DNS resolvers (1.1.1.1, 8.8.8.8, 8.8.4.4, 9.9.9.9, 149.112.112.112) by processes other than known web browsers. This behavior is atypical for standard endpoint processes and may indicate the use of DNS-over-HTTPS (DoH) for command and control or data exfiltration to bypass network filtering.
Detects DNS resolution of known Bluekit PhaaS (Phishing-as-a-Service) operator domains. These domains are associated with phishing lures that leverage LLMs for localized content and voice cloning, and this detection identifies when a host attempts to resolve these specific malicious domains, indicating a likely interaction with a phishing lure.
This rule monitors and alerts on network connections originating from hosts to known command-and-control (C2) or infrastructure domains associated with malicious browser extensions, specifically those identified in the BadBlocker campaign. These extensions often masquerade as legitimate ad-blocking tools to perform lifecycle beaconing or redirect users to promotional/malicious content.
Detects instances of Bluekit Phishing-as-a-Service (PaaS) where the browser utilizes WebRTC RTCPeerConnection to initiate a UDP STUN request on port 3478 while concurrently accessing a suspicious web page. This behavior is used by attackers to discover the visitor's real IP address, effectively bypassing proxies or VPNs to identify security researchers or analysts.
Detects outbound HTTP/HTTPS requests to api.adblock-for-youtube.com to fetch scriptlet rules. This activity is consistent with the Adblock for YouTube extension (cmedhionkhpnakcndndgjjdbohmhepckk) periodically polling for updates.
Detects anomalous, high-frequency bidirectional WebSocket connections (wss/ws) originating from an endpoint that match patterns associated with Bluekit BitM. These connections typically carry DOM serialization events (rrweb-style) and session handshake data, indicative of a victim's keystrokes and mouse movements being relayed to an attacker-controlled browser session.
This rule detects network communication targeting specific external IP addresses associated with known SD-WAN infrastructure and common management endpoints (e.g., /dataservice/). This behavior may indicate an attempt to interact with, enumerate, or compromise SD-WAN controllers or managed edge devices.
This rule detects activity associated with malicious or intrusive browser extensions, specifically identifying network connections to a known malicious command-and-control (C2) endpoint, execution of specific scriptlet keywords related to MAIN-world injection in browser processes, and the presence of known 'BadBlocker' extension IDs on endpoints.
This rule detects potentially malicious activity associated with the exploitation of Ray framework dashboards. It identifies three distinct indicators: inbound network connections to the Ray dashboard port (8265), the execution of common file download tools (e.g., curl, wget) by Ray worker processes, and outbound connections from Ray processes to known C2 infrastructure.
This rule detects the installation or update of known malicious browser extensions followed by network communication to identified command-and-control or malicious infrastructure domains. It also monitors for direct network beaconing to these malicious domains, providing defense-in-depth even if installation telemetry is absent.
Detects HTTP 3xx redirect chains where a browser is redirected to a cloud-native staging domain (such as azurewebsites.net, pages.dev, or web.app) that has not been previously observed in the organization's network traffic history over the last 37 days. This pattern is commonly used by adversaries to redirect traffic to staging infrastructure hosting malicious payloads or C2 content while leveraging reputable cloud services to bypass filters.
Detects vLLM establishing outbound network connections to fetch external media files (e.g., .mov, .mp4, .jp2) from non-private IP addresses. This activity may indicate exploitation of CVE-2026-22778, allowing for remote code execution by fetching malicious content.
Detects FTP data connections initiated by 'squid.exe' on high port ranges (1024-65535). This could indicate an attempt to exfiltrate data using an alternative protocol, potentially related to the 'Squidbleed' vulnerability or other malicious activity.
A master aggregation capturing processes generating connections to multiple known malicious ports tied to specific campaigns, indicating potential C2 beaconing activity.
Identifies processes executing Base64 decoded commands where the parent script recently communicated with an AI endpoint, representing prompt-injected or AI-generated payloads.
Hunts for the stealer exfiltrating compressed host profiling information (sw_vers, system_profiler) via HTTP POST using curl.
This rule detects an unsigned process executing from the AppData or Temp directories that loads user32.dll, a required step for installing keyboard hooks (SetWindowsHookEx). This activity is correlated with network connections from the same process to the Telegram Bot API, a common technique for exfiltrating captured keystrokes or other sensitive data.
This rule detects network connections made over FTP (port 21) where the remote URL contains keywords often associated with legacy or specific network services like 'NetWare', 'NFS', or 'Novell', combined with the presence of multiple spaces or specific 'whitespace' keywords. This combination could indicate unusual or potentially malicious activity, such as attempts to interact with outdated systems or obfuscate URLs.
This rule detects HTTP POST connections initiated by 'AutoIt3.exe' which is indicative of Vidar Stealer attempting to exfiltrate data to its C2 server. The rule specifically looks for network events where the HTTP method is POST and joins them with process events where the initiating process is 'AutoIt3.exe'.
Detects indicators of the DragonReturn malware campaign, specifically the download and deployment of malicious payloads hidden within image files. The rule monitors for network connections to known malicious infrastructure, the creation of specific steganographic staging files in sensitive directories, and the use of the URLDownloadToFile API to retrieve these payloads.
This rule monitors network logs (DNS, Proxy, or general network traffic) for communication with TON (The Open Network) blockchain-related infrastructure, including known C2 domains associated with TONResolver and specific blockchain API queries. It flags connections made by suspicious processes such as node.exe, powershell, wscript, cscript, or mshta, which are often used by malware to execute scripts or facilitate C2 communication.
Page 225 of 280