Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,879 detections
Filters
Last updated
All Time
Detection languages
2,954
1,378
313
289
239
Contributors
1,807
1,529
1,304
180
173
Categories
20,460
11,847
5,879
5,158
4,866
Platforms
3,747
1,857
1,076
782
160
Products / Services
2,241
1,434
1,273
746
582
MITRE Techniques
2,448
2,151
1,129
937
790
CVEs
19
15
9
7
5
IDS Classtypes
834
334
94
23
20
IDS Protocols
689
276
235
117
23
Detects network callbacks from hardware implants like O.MG Cable or USB Rubber Ducky
Detects serverless function deployments used as C2 infrastructure
Detects a loader requesting a PHP payload with a generated host identifier and then writing a marker that prevents repeat delivery. This rule specifically looks for network connections initiated by executables like 'powershell', 'cmd', 'loader', or 'update' that include command-line arguments indicative of a PHP payload request with a unique identifier and a marker for single delivery.
Detects HTTP C2 communication patterns associated with Remcos RAT loader by monitoring network events for specific URLs and known malicious IP addresses. This rule identifies outbound network connections to hardcoded malicious IPs and specific URL paths often used for command and control by Remcos.
Detects network connections to known IP addresses associated with Remcos RAT loader infrastructure, identified by specific URL patterns indicative of loader-as-a-service operations. The rule triggers if a device makes 3 or more requests to these URLs within an hour.
This rule detects secondary Command and Control (C2) communication associated with the Remcos RAT loader. It identifies suspicious network connections to specific IP addresses, domains (including those often used by malicious actors like .bit, .onion, .su, .cc), and remote ports commonly utilized by Remcos.
Detects anomalous connections to Sigstore infrastructure (Fulcio/Rekor) by non-standard processes. This activity could indicate an attempt to forge or manipulate supply chain signatures, potentially by malware like Miasma.
This rule detects network connections made by Python or Node.js processes to known webhook API endpoints for Telegram or Discord. This behavior is often associated with command and control (C2) communication, where attackers use legitimate messaging platforms to control compromised systems or exfiltrate data.
Identifies outbound HTTP GET requests fetching masqueraded Donut shellcode disguised as .woff web font files from non-browser processes. This rule specifically looks for network events where the remote URL ends with '.woff' and the initiating process is not a common web browser (chrome.exe, msedge.exe, firefox.exe).
Identifies the Python-based tunneler establishing a secure Heroku websocket tunnel for reverse proxying, as observed in the SNOWGLAZE threat activity.
Detects outbound HTTP communication using specific Tencent-themed API impersonation URI structures, which may indicate TencShell activity.
Detects network traffic associated with the Meow backdoor's beaconing activity. Specifically, it looks for outbound network connections on port 666 initiated by 'rundll32.exe'. This pattern is indicative of malware using a common system utility to establish command and control communications.
Detects network connections to the '/avast_update' endpoint, which is associated with the RMMProject malware for fetching secondary DLL payloads.
Detects PowerShell scripts dynamically building URLs using the local drive serial number. This behavior is indicative of PS1Bot malware attempting to establish Command and Control (C2) communication by incorporating unique system identifiers into its polling requests.
Identifies network connections to specific Azure-hosted authentication brokers used by the jupyter-powerdev malware to retrieve Graph API tokens for its SharePoint C2 channel. This rule specifically looks for connections to known malicious broker domains or a known associated IP address.
Detects unusual network communication from runtime processes mapped to Interlock/Rhysida backdoors on specific documented proxy C2 ports (1080, 4043, 8080). The rule specifically targets 'node.exe', 'java.exe', and 'javaw.exe' processes initiating these connections.
This rule detects suspicious network connections originating from specific processes (DbgView64.exe or VirtualBox.exe) to Microsoft Teams TURN relay servers, where the RemoteUrl does not start with "teams.microsoft.com". This indicates potential protocol tunneling or an attempt to exfiltrate data or establish command and control through an unexpected channel, possibly leveraging Microsoft Teams infrastructure in an unauthorized manner. The use of DbgView64.exe or VirtualBox.exe as initiating processes for such connections is highly unusual and indicative of malicious activity.
This rule detects unusual outbound Server Message Block (SMB) traffic originating from common Windows processes (explorer.exe, svchost.exe, system.exe) to external IP addresses (not RFC1918 private ranges). It triggers if a device makes 5 or more SMB connections to unique remote IPs within an hour. This could indicate lateral movement, data exfiltration, or other malicious activity.
This rule detects potential Trickbot malware command and control (C2) communication by identifying network connections to specific remote URLs and ports commonly associated with Trickbot activity. It looks for multiple connections within an hour from the same device to these indicators.
Detects the specific ShinyHunters lateral movement pattern involving automated SSH credential spraying using 'sshpass' or rapid SSH connections to multiple hosts with PeopleSoft admin accounts, often after reading '/etc/hosts' for target identification. The rule looks for multiple SSH connections within a 10-minute window from a single host and user, specifically targeting common PeopleSoft-related usernames.
Detects network connections to known or suspected Command and Control (C2) IP addresses and ports associated with ransomware activity. This rule specifically looks for outbound connections from devices to a predefined list of suspicious remote IP addresses on common C2 ports (443, 8443, 6379, 27017).
Page 243 of 280