Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,879 detections
Filters
Last updated
All Time
Detection languages
2,954
1,378
313
289
239
Contributors
1,807
1,529
1,304
180
173
Categories
20,460
11,847
5,879
5,158
4,866
Platforms
3,747
1,857
1,076
782
160
Products / Services
2,241
1,434
1,273
746
582
MITRE Techniques
2,448
2,151
1,129
937
790
CVEs
19
15
9
7
5
IDS Classtypes
834
334
94
23
20
IDS Protocols
689
276
235
117
23
This rule detects potential DcRAT initial beaconing by correlating WMI 'AntiVirusProduct' enumeration with subsequent outbound network connections to known DcRAT C2 infrastructure within a short time window. This behavior is indicative of a post-exploitation reconnaissance phase followed by initial callback.
This rule detects malicious activity associated with the TONResolver RAT, which leverages node.exe to execute JavaScript payloads stored in AppData\Local\Nodejs. The rule monitors for multiple suspicious behaviors, including outbound C2 beaconing to known malicious domains, spawning of suspicious child processes (powershell.exe, cmd.exe, wscript.exe, cscript.exe), unauthorized access to browser-based credential stores (Login Data and Cookies), and establishment of persistence via Windows Registry Run keys.
Detects network requests to the BadBlocker (AdBlock for YouTube) infrastructure that fetch malicious scriptlet rules. These rules are designed to leverage Chrome's scripting API to execute arbitrary JavaScript in the 'MAIN' world of web pages, effectively bypassing Content Security Policy (CSP) protections to inject unauthorized content.
Detects network communication to known Command and Control (C2) IP addresses used by the Medusa ransomware group.
This rule detects outbound network connections from a device to a specific remote IP address (62.102.148.212) on a set of suspicious ports (37393, 45839, 38471, 12345, 4444, 5555). This pattern is indicative of potential command and control (C2) communication or data exfiltration to a known malicious endpoint.
Detects Python-based command and control activity associated with LegionLoader by monitoring for network connections, DNS queries to specific malicious domains, and file modifications involving '_socket.pyd' within the 'Traiolx Custom Utils' directory path.
Detects Python interpreter activity associated with the LegionLoader malware, specifically monitoring for Python execution from within the 'AppData\Roaming\Traiolx' directory, or outbound network connections from Python processes to known malicious infrastructure such as 'birdeemusic.com' or other suspicious outbound HTTP/HTTPS communication.
Detects potential Command and Control (C2) communication associated with Emotet malware by monitoring for successful network connections to suspicious remote ports frequently used by the malware. The rule flags endpoints that establish connections to at least three of these high-risk ports within a one-hour window, which is indicative of automated C2 beaconing behavior.
This rule detects network connections using the Generic Routing Encapsulation (GRE) protocol to external IP addresses. GRE is often used for tunneling and can be leveraged by adversaries for command and control or data exfiltration to bypass network filtering.
This rule detects outbound network connections to WhatsApp (whatsapp.com or wa.me) initiated by common scripting engines (powershell.exe, wscript.exe, cscript.exe). Such activity from these processes is anomalous in typical enterprise environments and may indicate the use of scripts for account compromise, C2 communication, or exfiltration via messaging platforms.
Detects the execution of Python interpreters from user-writable AppData\Roaming directories initiating external network connections. This behavior is consistent with the execution of LegionLoader malware and its associated _socket.pyd Python C2 module.
Detects potential C2 beaconing activity associated with LegionLoader by monitoring for outbound network connections to 'birdeemusic.com' domains initiated by Python or AppData/Roaming-based processes, following a precursor process launch (msiexec.exe or from AppData/Roaming) on the same host within 10 minutes.
This rule detects outbound network connections from devices to a specific remote IP address (62.102.148.212) on a set of suspicious remote ports (37393, 45839, 38471, 12345, 4444, 5555). This pattern is indicative of potential command and control (C2) communication or data exfiltration to a known malicious endpoint.
This rule monitors network, proxy, and DNS traffic for connections to the domain 'perplexity-ai.online'. It identifies potentially suspicious activity by aggregating requests and distinguishing between general outbound traffic and traffic to specific endpoints, such as search queries that may indicate data exfiltration or reconnaissance.
Detects the execution of specific suspicious binaries (tcc.exe or LuaJit.exe) with command-line arguments indicative of shellcode loading, followed by a network connection to known C2 infrastructure (IP 207.56.8.166 or Port 18848) from the same host within 15 minutes.
Detects evidence of a malicious browser extension, identified by extension ID flkebkiofojicogddingbdmcmkpbplcd, designed to redirect search traffic through a typosquatted domain 'perplexity-ai.online'. The rule monitors for file-system creation of the malicious extension, modifications to browser preferences files, manipulation of system registry keys to enforce the search provider, and outbound network connections to the malicious domain from major web browsers.
Detects indicators of the BeepRAT malware (associated with Operation DragonClone), including specific process execution patterns of HFY.exe, LuaJit.exe, or tcc.exe, network connections to known C2 infrastructure on port 18848, keylogger file creation, and malicious task scheduling or TCC loader execution techniques.
Detects network communication associated with BeepRAT, specifically identifying direct TCP connections to a known command-and-control IP address on a non-standard port or DNS requests directed at a specific malicious domain.
Detects network and DNS indicators associated with BeepRAT, including connections to known C2 IP addresses on port 18848, resolution of known C2 domains, and suspicious DNS queries to 'doh.pub' from known loader processes (tcc.exe, HFY.exe).
This rule monitors for the presence of a specific malicious browser extension (by identifier) on the file system and simultaneously tracks outbound network connections to a known typosquatted domain ('perplexity-ai.online'). It alerts on the potential presence of an adversary-controlled browser plugin or user navigation to a malicious domain often used in phishing or credential harvesting campaigns.
Detects anomalous network activity originating from Firefox (firefox.exe). The rule flags connections to port 8765 (associated with specific browser-based exfiltration PoCs) and any outbound connection on non-standard ports (excluding common browser ports: 80, 443, 8080, 8443, 8888, 53) directed to public IP addresses.
Page 226 of 280