Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,879 detections
Filters
Last updated
All Time
Detection languages
2,954
1,378
313
289
239
Contributors
1,807
1,529
1,304
180
173
Categories
20,460
11,847
5,879
5,158
4,866
Platforms
3,747
1,857
1,076
782
160
Products / Services
2,241
1,434
1,273
746
582
MITRE Techniques
2,448
2,151
1,129
937
790
CVEs
19
15
9
7
5
IDS Classtypes
834
334
94
23
20
IDS Protocols
689
276
235
117
23
Identifies network connections made by Python immediately after loading safetensors or pickle files, indicating a potential supply chain payload phoning home. The rule joins file events where specific model file types (.safetensors, .pkl, .pth) are loaded with network connection events from the same initiating process within one minute of the file load. It specifically excludes local loopback connections.
Detects the Silent Rotor malware transmitting collected system profile as a serialized JSON blob to the C2 domain cdn.kleymarket.ru. The detection specifically looks for network connections to this domain initiated by a process named 'Подтверждение заказа продукции ЦАИ.exe'.
Correlates the code.exe service initiating encrypted, SSH-like tunnel relay connections without legitimate user IDE engagement.
Identifies network communication initiated by Microsoft Word (WINWORD.EXE) to Discord webhooks, which could indicate an attempt to exfiltrate stolen information, such as One-Time Passwords (OTPs), often associated with phishing campaigns.
This rule detects outbound UDP network traffic to high ports (greater than 1024, excluding common ports like 5353, 5355, 3389) initiated by interpreted language processes such as Python, Node.js, PowerShell, or WScript. This pattern can be indicative of Command and Control (C2) communication, particularly associated with botnet DHT (Distributed Hash Table) or custom C2 routing mechanisms.
Detects network traffic to known Storm-2949 ScreenConnect infrastructure IPs. This rule identifies outbound network connections from devices to specific IP addresses associated with command and control (C2) infrastructure used by the Storm-2949 threat group, leveraging ScreenConnect for remote access.
Detects network connections where the user-agent string contains 'NSIS_InetLoad' and 'Mozilla', often indicative of a staged downloader. The rule also checks if the principal process is an executable and attempts to capture the user-agent from the URL or process command line.
Detects the execution of QEMU virtualization binaries from non-standard or suspicious file paths (such as Temp or AppData) or with command-line arguments indicative of VM configuration (e.g., -drive, -net, -kernel). The rule further correlates these process executions with subsequent network connections within a 5-minute window, potentially identifying unauthorized VM usage, data exfiltration through tunnelled connections, or adversary-controlled virtualization tools.
Detects anomalous screen capture activity associated with StealC malware. It identifies when a non-UI process creates a JPEG file within the system temporary directory followed immediately by an outbound network connection from the same process, which is indicative of the malware capturing a screenshot and staging it for exfiltration.
This rule detects PowerShell processes attempting to retrieve or execute remote .rtf resources via web requests. It specifically looks for `powershell.exe` or `pwsh.exe` in the process path combined with command-line arguments indicating `Invoke-WebRequest`, `iwr`, `DownloadString`, `Invoke-Expression`, or `iex` targeting a URL ending in `.rtf`.
Detects outbound network connections to 'stitch-design.ai' or 'stitch-google.com', which are identified as malicious domains utilized by a compromised AI agent skill. This skill attempts to bypass security vetting by dynamically fetching its instructions from these attacker-controlled external domains post-installation.
Detects malicious multi-stage download behavior where a web browser spawns PowerShell to initiate an outbound network connection, characteristic of the 'ErrTraffic' Beer cluster often associated with ClickFix infection lures delivering malware such as DanaBot, Stealc, HijackLoader, SmokeLoader, or Vidar.
This rule detects network communication with infrastructure associated with the 'EvilTokens' phishing kit, specifically targeting Microsoft OAuth device code API endpoints (/api/device/*) hosted on workers.dev. This behavior is indicative of an adversary conducting device code phishing (a form of AitM attack) to obtain unauthorized access tokens.
Detects the deployment of MeshCentral remote management agents and associated outbound communication to suspicious C2 infrastructure, identified in environments compromised by ShinyHunters. This rule monitors for specific process execution patterns involving meshctrl.js and meshagent, alongside network connections to known C2 domains and IP addresses.
Detects a multi-stage npm supply chain compromise, often associated with Operation Friday Harvest or PostCSS typosquatting campaigns. The rule monitors for a sequence of 4 out of 5 behavioral stages on a single host within a 30-minute window: malicious postinstall script execution (npm/node spawning shells), staging of malicious payloads in temp directories, network connections to known command-and-control (C2) or payload-hosting infrastructure (e.g., GitHub, Telegram), execution of dropped binaries, and unauthorized access to sensitive credential files.
Correlates the execution of an agent with rapid outbound connections to Port 445 across internal subnets, indicating SMB lateral movement or scanning activity.
Detects a single compromised host initiating a massive burst of outbound SMB (Port 445) connections, indicating the push of the ransomware encryptor to the entire domain.
This rule detects network connections to a specific destination port (37393), a known malicious IP address (62.102.148.212), or a dynamic DNS hostname (acceic.ddns.net). These indicators are often associated with command and control (C2) infrastructure used by adversaries.
This rule detects macOS.Gaslight C2 communication by identifying repeated HTTPS connections to api.telegram.org from non-browser processes. It specifically looks for patterns consistent with the Rust-based implant's getUpdates polling loop, as well as sendMessage and botattach patterns. The detection logic is split into EDR-side (DeviceNetworkEvents) and NDR-side (CommonSecurityLog) components, requiring a minimum of 3 connections/flows within an hour to trigger.
Correlates processes executing commands containing 'megalodon' with outbound network connections to a specific C2 IP address (216.126.225.129). This rule aims to detect data exfiltration or command and control communication associated with the Megalodon malware.
Detects network connections to a specific Google Drive document ID known to be associated with the 'Steam Wallpaper' attack for payload distribution.
Page 237 of 280