Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,879 detections
Filters
Last updated
All Time
Detection languages
2,954
1,378
313
289
239
Contributors
1,807
1,529
1,304
180
173
Categories
20,460
11,847
5,879
5,158
4,866
Platforms
3,747
1,857
1,076
782
160
Products / Services
2,241
1,434
1,273
746
582
MITRE Techniques
2,448
2,151
1,129
937
790
CVEs
19
15
9
7
5
IDS Classtypes
834
334
94
23
20
IDS Protocols
689
276
235
117
23
Detects unauthorized or anomalous modifications to local vector database files by non-standard processes.
Detects outbound HTTP requests exhibiting a User-Agent string hardcoded to mimic Firefox 20.0 (Mozilla/5.0 (Windows NT 6.2; rv:20.0) Gecko/20121202 Firefox/20.0), which is characteristic of the Adaptix C2 framework. This pattern is commonly used by adversaries for command-and-control communication.
Detects anomalous outbound connections to Microsoft Teams TURN relays from non-Teams processes. This behavior can be indicative of malware, such as Backdoor.Turn, abusing legitimate Microsoft Teams infrastructure for command and control or data exfiltration, by masquerading malicious traffic as legitimate conferencing application traffic.
Identifies anomalous requests to Microsoft TURN relays, potentially requesting anonymous visitor tokens. This rule looks for a high volume of network connections to 'turn.teams.microsoft.com' or 'relay.teams.microsoft.com' from processes other than the legitimate Microsoft Teams application, indicating potential abuse of the Teams infrastructure for malicious traffic tunneling.
Detects network traffic associated with known Cobalt Strike Beacon request URI patterns. This rule utilizes network signature inspection to flag outbound connections containing URI fragments commonly used by Cobalt Strike default profiles.
Detects anomalous network communication patterns and file system changes indicative of SoftEther VPN usage, particularly when linked to processes masquerading as VMware or communicating with known malicious C2 infrastructure. The rule monitors for network connections on common SoftEther ports, connections to specific command-and-control IP addresses, and the creation of SoftEther configuration files like 'hamcore.se2' or 'vpn_bridge.config'.
Detects outbound network communication and DNS queries to cloud service endpoints (Google Cloud Pub/Sub, Azure MQTT, AWS IoT) originated by non-browser and non-cloud processes, which is a technique used by Grandoreiro banking trojan variants that side-load modules to tunnel command-and-control traffic.
Detects outbound network connections over port 8883 (MQTT/IoT) indicative of the Grandoreiro banking trojan. The rule identifies suspicious, unsigned, or non-whitelisted processes attempting to initiate multiple connections to external endpoints, masquerading as legitimate IoT telemetry traffic using MQTT client configurations.
Detects behavior patterns associated with the Grandoreiro banking trojan, specifically the use of wscript.exe or cscript.exe to execute VBScript files that perform geolocation checks against ip-api.com, followed by the dropping of an executable file in the user's AppData\Local directory.
This rule detects network connections from internal hosts to identified C2 or phishing infrastructure associated with the threat actor group UNC1151 (also known as Ghostwriter). It monitors both host-based network events (via DeviceNetworkEvents) and centralized network security logs (via CommonSecurityLog) for traffic targeting a curated list of known malicious IP addresses.
Detects network connections to Bunny CDN infrastructure that contain common URL path indicators associated with phishing, a technique observed in activity attributed to UNC1151 (Ghostwriter).
This rule detects network connections from internal hosts to identified C2 or phishing infrastructure associated with the threat actor group UNC1151 (also known as Ghostwriter). It monitors both host-based network events (via DeviceNetworkEvents) and centralized network security logs (via CommonSecurityLog) for traffic targeting a curated list of known malicious IP addresses.
Identifies cross-platform binaries (e.g., compiled Node.js or PyInstaller payloads) extracting dependencies into Temp and launching secondary network listeners.
Detects the execution of Nishang's Invoke-PowerShellTcp reverse shell payload. This rule monitors for PowerShell processes (powershell.exe or pwsh.exe) that execute suspicious command-line strings associated with the payload, or common obfuscation/execution patterns like iex/Invoke-Expression, accompanied by an outbound network connection to a non-standard port and non-internal IP address.
This rule detects outbound TLS connections to identified C2 infrastructure associated with the UAC-0226 threat actor and the GIFTEDCROOK malware, specifically by monitoring the certificate subject name 'NextGen Fusion'.
Detects suspicious DNS TXT record queries originating from common script interpreters (e.g., PowerShell, Python, Node.js) that are not recognized legitimate resolvers. The rule further correlates these DNS queries with subsequent process execution or network connection activity within a 60-second window, which is indicative of potential command and control (C2) communication or stager activity.
This rule detects potentially suspicious network connections originating from processes residing in common Git development directories (e.g., node_modules, temp, workspace) shortly after a Git clone, pull, or fetch operation. The detection logic filters for successful connections to non-private, non-whitelisted remote endpoints, which may indicate an adversary leveraging legitimate developer tools and environments for command-and-control (C2) or payload exfiltration.
This rule detects potentially malicious PowerShell activity involving memory injection techniques (e.g., NtAllocateVirtualMemory, NtWriteVirtualMemory, NtCreateThreadEx) occurring in conjunction with outbound network connections within a 5-minute window, which is indicative of command-and-control behavior.
Detects instances where PowerShell scripts execute code patterns indicative of AMSI (Antimalware Scan Interface) bypass techniques, followed closely (within 5 minutes) by a non-standard network connection (excluding ports 80/443) from the same process. This behavior is strongly associated with the execution of obfuscated payloads, such as reverse shells, attempting to evade security detection.
This rule detects network connections initiated by common Windows command-line utilities (powershell.exe, pwsh.exe, cmd.exe) to suspicious remote IP addresses or non-standard ports. It specifically flags known Command and Control (C2) IPs and atypical network ports to identify potential adversary activity like staging or communication.
Detects Python processes that combine potentially dangerous pickle deserialization (pickle.loads) with network-fetching libraries (urllib, requests, socket) and decoding methods (b64decode, fromhex). This pattern is consistent with backdoors or remote access tools (RATs) that fetch encoded payloads over the network and execute them directly in memory via deserialization.
Page 229 of 280