Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,879 detections
Filters
Last updated
All Time
Detection languages
2,954
1,378
313
289
239
Contributors
1,807
1,529
1,304
180
173
Categories
20,460
11,847
5,879
5,158
4,866
Platforms
3,747
1,857
1,076
782
160
Products / Services
2,241
1,434
1,273
746
582
MITRE Techniques
2,448
2,151
1,129
937
790
CVEs
19
15
9
7
5
IDS Classtypes
834
334
94
23
20
IDS Protocols
689
276
235
117
23
Detects outbound network traffic associated with Djinn Stealer malware beaconing to a hardcoded C2 IP address (96.126.130.126) on port 58942. The detection specifically monitors for HTTP POST requests containing the malicious User-Agent 'telemetry-client/1.0' and 'application/octet-stream' content-type, which are characteristic of this stealer's exfiltration activity.
This rule detects the installation and activity of a malicious Google Chrome extension used to hijack the browser's default search provider. The rule triggers on a multi-stage process involving the creation of a specific malicious extension directory, modification of the Chrome Preferences file to change search settings, tampering with the 'PreferenceMACs' registry keys to bypass browser-based integrity warnings, and subsequent network communication with a known malicious C2 domain associated with the search hijack.
Detects the installation of a malicious Chrome extension (identified by its extension ID) that abuses declarativeNetRequest permissions to intercept and redirect user search queries through the 'perplexity-ai.online' domain. The detection correlates the creation of the extension's directory on disk with a high volume of network connections from the browser to the malicious intermediary domain.
This rule detects potential command-and-control (C2) activity or data exfiltration by monitoring for first-time DNS resolution of known typosquatted domains targeting 'Perplexity AI', followed by persistent outbound network connections from common web browsers to the same domain family.
Detects a malicious browser extension (ID: flkebkiofojicogddingbdmcmkpbplcd) that masquerades as Perplexity AI. The rule identifies the extension installation followed by a two-hop network redirect sequence: the browser is first directed to a malicious domain (perplexity-ai.online) which logs user metadata, then immediately redirected to a ZIP file download lure on a different domain. This behavior is correlated within a 30-minute window for a specific browser process.
Detects potential BeepRAT malware activity characterized by a process executing from a non-standard directory, writing suspicious artifacts like images or encrypted files to the AppData folder, and initiating frequent outbound network connections typical of command-and-control beaconing.
Detects persistent outbound network connections to known SystemBC (Coroxy) C2 infrastructure and Tor gateway IP addresses. The rule identifies suspicious beaconing behavior characterized by repeated connections over ports 4001 or 4002, originating from processes in user-writable directories, and correlates these with process lineage from common office applications or browsers.
Detects behavior indicative of the InvisibleFerret information stealer, specifically focusing on Python execution spawned by development tools (VS Code/Node.js), unauthorized access to browser-based credential stores or local crypto wallets, and suspicious outbound network activity originating from Python processes spawned by development/automation tools.
Detects network connections to known blockchain and crypto-related domains (trongrid.io, aptoslabs.com) initiated by common programming and development tools (node, Code, python, python3). This pattern is often associated with the deployment of unauthorized cryptocurrency miners, blockchain interaction scripts, or malicious actors leveraging development environments.
This rule detects WebSocket communication attempts from a device to known command and control (C2) IP addresses associated with the Remcos Remote Access Trojan (RAT). It specifically looks for network events where the remote URL contains 'ws://', 'wss://', or 'websocket' and the remote IP address matches one of the listed indicators of compromise (IOCs).
Detects instances where common script interpreters (node.exe, python.exe, etc.) simultaneously access sensitive local credential files and establish outbound network connections to common web ports (80, 443, 8080, etc.), which is indicative of credential exfiltration behavior.
Detects cmd.exe invoking curl.exe to download payloads from raw.githubusercontent.com, a technique commonly used for retrieving multi-stage scripts. This behavior was observed in a campaign where curl fetched secondary batch payloads from GitHub repositories into the temp directory.
Detects successful network connections from hosts to specific remote IP ranges (associated with CN infrastructure) on known ports commonly used by ValleyRAT and Gh0st RAT.
Detects outbound network connections to remote URLs containing keywords associated with blockchain, cryptocurrency, or Web3 technologies. This behavior may indicate an adversary utilizing blockchain services or decentralised infrastructure for command and control (C2) communication, exfiltration, or proxying.
Detects outbound network traffic from endpoints to known malicious IP addresses associated with Loader-as-a-Service (LaaS) campaigns. The rule monitors DeviceNetworkEvents for connections to specific indicators of compromise (IOCs) and checks for URL patterns commonly associated with file staging and malware loading (e.g., /drop, /stage, /loader).
Detects endpoint connections directly to Kali365 PhaaS panel domains, which are associated with phishing-as-a-service operations. This rule identifies network activity to specific domains used by the Kali365 platform, indicating potential compromise or interaction with phishing infrastructure.
Detects unauthorized or anomalous modifications to local vector database files by non-standard processes.
Identifies the creation of Named Pipes by the suspected agent process, used by Komari for Inter-Process Communication (IPC) and routing shell output. The rule correlates NamedPipeEvent with DeviceNetworkEvents to ensure the initiating process also has network activity to a remote IP, and specifically looks for named pipes matching a regex pattern often used by Komari.
Detects network connections using the GRE (Generic Routing Encapsulation) protocol destined for non-internal (outside of RFC 1918) IP addresses. GRE is frequently used for tunneling traffic and, when used to communicate with external hosts, may indicate unauthorized tunneling or data exfiltration.
This rule monitors for Generic Routing Encapsulation (GRE) network traffic originating from or destined to non-private (non-RFC1918) IP addresses. GRE is often used for tunneling protocols and can be abused to bypass network security controls or establish hidden command and control communication channels.
This rule detects the exfiltration of sensitive developer tokens (specifically .npmrc or .pypirc files) to public paste sites like Pastebin or GitHub Gists. It correlates network events where a process attempts to connect to these sites with file access events on the specified token files by the same process.
Page 227 of 280