Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,879 detections
Filters
Last updated
All Time
Detection languages
2,954
1,378
313
289
239
Contributors
1,807
1,529
1,304
180
173
Categories
20,460
11,847
5,879
5,158
4,866
Platforms
3,747
1,857
1,076
782
160
Products / Services
2,241
1,434
1,273
746
582
MITRE Techniques
2,448
2,151
1,129
937
790
CVEs
19
15
9
7
5
IDS Classtypes
834
334
94
23
20
IDS Protocols
689
276
235
117
23
Detects C2 configuration retrieval via Pastebin and similar dead drop services
This rule detects HTTP traffic to specific Visual Studio Code (VS Code) remote tunnel domains, specifically 'tunnels.api.visualstudio.com' or 'vscode.dev'. A high frequency of such connections (10 times within 60 seconds from the same source) is flagged as potential command and control (C2) activity, indicating the use of VS Code Remote Tunnels as a C2 channel.
Detects API access to VPS providers for spinning up attack infrastructure
Detects C2 traffic using non-standard ports to evade detection
This rule detects successful network connections to known paste sites like Pastebin or Gist. Adversaries often use these services to host malicious code, exfiltrate data, or for command and control (C2) communications. Monitoring such connections can help identify potential data exfiltration attempts or the download of malicious content.
This rule detects PowerShell processes attempting to retrieve or execute remote .rtf resources via web requests. It specifically looks for `powershell.exe` or `pwsh.exe` in the process path combined with command-line arguments indicating `Invoke-WebRequest`, `iwr`, `DownloadString`, `Invoke-Expression`, or `iex` targeting a URL ending in `.rtf`.
This rule detects devices making a high volume of successful network connections to GitHub's API endpoints (api.github.com or api.releases). A count of 5 or more successful connections within an hour from a single device is considered suspicious and could indicate data exfiltration, automated tooling, or unusual development activity.
Detects curl.exe spawned by the batch dropper fetching data.json from known C2 endpoints. This rule correlates process creation events for curl.exe with network connection events to specific C2 domains (kak.is, goingg.is) when 'data.json' is present in the command line.
Correlates the execution of the dropped Synaptics.exe with active outbound network connections, indicative of DarkKomet malware beaconing.
Detects network events to the obfuscated api.wigetticks.com domain dynamically resolved by a potentially compromised Okendo script. This rule specifically looks for connections to 'api.wigetticks.com/logout/private-response.php' originating from common browser processes (chrome.exe, msedge.exe) or PowerShell, indicating a potential supply chain attack.
This rule detects PowerShell processes executing 'Invoke-WebRequest' (IWR) or 'IEX' (Invoke-Expression) commands that establish network connections to the domain 'wigetticks.com'. This combination indicates potential adversary activity involving downloading and executing malicious content from a specific attacker-controlled infrastructure, as identified in the SmartApeSG campaign.
Detects secondary payload fetching from the documented malicious domain brightly.to, specifically when initiated by a process named '._cache_GAME1.exe'. This indicates potential malware activity related to malicious Steam Workshop wallpapers.
This rule detects potential bandwidth hijacking activity associated with peer-to-peer botnet traffic. It triggers an alert when a high volume of TCP traffic (more than 200 packets within 60 seconds) with a packet size greater than 1000 bytes is observed originating from the home network to any destination. The 'flow:to_server,established' indicates that the rule is looking for established connections where the traffic is flowing from the internal network to an external server. The 'threshold' keyword ensures that only sustained high-volume traffic triggers the alert, reducing noise from legitimate, short bursts of activity. The 'classtype:policy-violation' suggests that this activity is considered a violation of network usage policies.
This rule detects instances where 'node.exe' is executed from a temporary directory (e.g., 'temp' or 'tmp') and initiates a network connection to an IP address within the '23.254.164.0/24' subnet. This behavior is indicative of the Mastra NPM supply chain compromise, where malicious node packages drop and execute payloads from temporary locations to establish C2 communication.
This rule detects suspicious activity where a Python process initiates network communication to known command and control (C2) domains, immediately followed by accessing SQLite database files (e.g., 'places.sqlite' or 'Cookies'). This pattern is indicative of malware or adversary activity attempting to exfiltrate browser history or session cookies after establishing C2.
Detects if multiple distinct node.exe processes attempt to connect to known easy-day-js C2 IPs within a short span, indicating potential compromise related to the Mastra NPM supply chain attack.
Detects outbound network connections to 'git-tanstack.com', a typosquatted domain identified as part of the Miasma npm supply chain attack, indicating potential command and control communication.
Detects connections to 'lhr.life' tunnel domains. Miasma utilizes temporary tunneling services to bypass ingress firewalls and establish reverse shells.
Detects instances where 'wget' is used to download content and pipe it directly into a shell interpreter (bash, sh, or zsh). This technique is often used for fileless execution, allowing adversaries to download and execute malicious scripts without writing them to disk.
Detects bandwidth hijacking through peer-to-peer botnet participation
This rule detects successful network connections to known paste sites like Pastebin or Gist. Adversaries often use these services to host malicious code, exfiltrate data, or for command and control (C2) communications. Monitoring such connections can help identify potential data exfiltration attempts or the download of malicious content.
Page 244 of 280