Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,879 detections
Filters
Last updated
All Time
Detection languages
2,954
1,378
313
289
239
Contributors
1,807
1,529
1,304
180
173
Categories
20,460
11,847
5,879
5,158
4,866
Platforms
3,747
1,857
1,076
782
160
Products / Services
2,241
1,434
1,273
746
582
MITRE Techniques
2,448
2,151
1,129
937
790
CVEs
19
15
9
7
5
IDS Classtypes
834
334
94
23
20
IDS Protocols
689
276
235
117
23
Detects browser connections to the Bing Search by Image endpoint, which can be exploited as an SSRF proxy to bypass Content Security Policies (CSP) and exfiltrate data, as seen in the SearchLeak attack.
This rule detects network connections to specific Steam and Telegram profiles known to be used by Broomstick operators as dead-drop resolvers for Vidar infostealer C2 infrastructure. The rule identifies attempts by devices to communicate with these hardcoded URLs.
Detects IP geolocation lookups used to gather target network information
Detects outbound network communication originating from potential VILE ransomware processes. The rule monitors for suspicious Go-based HTTP clients using specific User-Agents (Go-http-client/2.0 or 1.1) initiating network connections to remote ports 80 or 443 with JSON payloads, while explicitly excluding common web browsers and internal RFC-1918 network ranges.
Detects the execution of VILE ransomware by identifying specific dropped file artifacts (vile_icon.ico, vile_deadlines.json, vile_user_files.zip) and correlating these file events with outbound network connections made by the same process to remote non-private IP addresses, indicating the likely exfiltration of harvested system metadata.
Detects the initial phishing delivery vector: Microsoft Teams spawning a process which downloads from AWS S3 buckets.
Detects network activity initiated by the 'PerfWatson2.exe' process, which is associated with the TinyRCT .NET backdoor, communicating with a known malicious C2 IP address (45.32.113.172). The rule monitors for network connections from this specific binary to the identified infrastructure, indicative of beaconing or command and control activity.
Tracks python executing loop structures scanning internal class C subnets on standard lateral movement ports (135, 445, 3389). The rule identifies devices where python.exe initiates network connections to more than 15 unique remote IPs on these ports within a one-minute interval.
Detects instances where a node.exe process attempts to open sensitive browser files such as 'Login Data' or 'Cookies', which are common targets for credential theft. Additionally, it monitors for network communication (DNS requests or HTTP connections) to the domain 'stitch-production.org', which may be a command and control (C2) endpoint.
This rule detects the execution of processes masquerading as legitimate VMware-related utilities or XDR agents when they exhibit behaviors associated with command-and-control (C2) activity. Specifically, it flags processes matching these names or non-standard file paths that include command-line arguments indicative of tunneling (e.g., 'reverse', 'admin-auth-flag') or connect to a specific, hardcoded malicious IP address on port 41256.
Detects the execution of the XDRAgent process with command-line arguments indicative of a reverse shell connection to a specific remote IP address and port.
Detects anomalous execution of the Bun runtime on CI/CD infrastructure, often associated with the 'Miasma/Mini Shai-Hulud' campaign. The rule monitors for unauthorized Bun process creation spawned by Node.js package management tools (likely via binding.gyp lifecycle hooks), execution using specific campaign-related command-line arguments, or network activity initiated by Bun on non-standard paths, which may indicate build-time compromise and subsequent C2 communication.
Detects anomalous network communication with a known C2 domain associated with the Miasma worm, or attempts by JavaScript runtime processes (node, bun) to access sensitive developer-related files (SSH keys, cloud credentials, browser data) without an authorized IDE parent process.
Detects network activity initiated by PerfWatson2.exe communicating with known command-and-control (C2) IP addresses. PerfWatson2.exe is used as a masquerading process to blend in with legitimate Visual Studio telemetry traffic, a technique observed in TinyRCT C2 beaconing.
Detects potentially malicious activity involving the node.exe process. The rule identifies suspicious parent processes (PowerShell, cmd.exe, explorer.exe, wscript.exe), execution from non-standard user-writable directories (e.g., AppData, Temp), and network connections over non-standard C2 ports typically associated with TonRAT behavior.
This rule detects potential command and control (C2) communication by monitoring for connections to known malicious domains or IP addresses and identifies the creation of suspicious staging files (specifically 'debug.txt') commonly used to collect or exfiltrate data.
This rule detects network connections to known malicious IP addresses or attempts to resolve specific domains associated with malicious activity. It monitors for outbound network traffic patterns identified as potential indicators of compromise (IOCs) linked to command and control (C2) servers.
This rule detects network activity involving connections to known malicious IP addresses or DNS domains ('govtop.one') and subsequent attempts to download specific suspicious file payloads, such as archives or image files often associated with malicious activity. This activity is indicative of potential command and control communication or initial malware ingress.
Detects endpoint activity associated with the Operation DragonReturn phishing campaign, including DNS resolution of known malicious domains, download of specific malicious ZIP archives, execution of extracted dropper files, and network communication with identified command-and-control infrastructure.
This rule detects fileless reflective loading behavior where a process performs an in-memory DLL load (specifically 'mscoree.dll' via 'LdrLoadDllApiCall') and is immediately followed by an outbound network connection within a 5-minute window. This sequence is indicative of techniques used for in-memory execution and command and control (C2) communication.
Detects macOS Terminal (bash/zsh) retrieving 'loader.sh' or 'payload.applescript' directly from the ClickFix attacker infrastructure, indicating potential compromise related to the ClickFix campaign.
Page 236 of 280