Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,879 detections
Filters
Last updated
All Time
Detection languages
2,954
1,378
313
289
239
Contributors
1,807
1,529
1,304
180
173
Categories
20,460
11,847
5,879
5,158
4,866
Platforms
3,747
1,857
1,076
782
160
Products / Services
2,241
1,434
1,273
746
582
MITRE Techniques
2,448
2,151
1,129
937
790
CVEs
19
15
9
7
5
IDS Classtypes
834
334
94
23
20
IDS Protocols
689
276
235
117
23
This rule detects a high volume of network connections (10 or more within an hour) from a single process to remote URLs containing 'artifact' or 'maven' on standard HTTP (port 80) or HTTPS (port 443) ports. This activity could indicate legitimate software development or build processes, but also potentially malicious activities such as supply chain compromise, data staging, or exfiltration of development-related artifacts.
This rule detects unusually large network uploads from devices. It identifies successful network connections where individual transfers exceed 100MB and aggregates these transfers by account name and hour. The rule then flags any account that has uploaded a total of 1TB or more within a single hour. This pattern could indicate data exfiltration, unauthorized data synchronization, or other malicious activities involving significant data transfer volumes.
Detects network connections to a specific malicious GitHub raw URL path used by Miasma to download 5th and 6th stage payloads. This rule specifically targets the URL 'raw.githubusercontent.com/letsgo0/sayyadina-phibian-159'.
This rule detects network connections from devices to a predefined list of known malicious domains. It identifies attempts by internal systems to communicate with command and control servers, phishing sites, or other infrastructure associated with threat actors.
This rule detects outbound Server Message Block (SMB) communications from internal devices to external (non-private) IP addresses. It specifically looks for connections on ports 137, 138, 139, and 445. The rule then aggregates these events over 10-minute intervals and flags devices that have more than 5 such SMB connections to distinct external IPs, indicating potential data exfiltration or unauthorized external communication.
Detects outbound network activity to the known malicious domain sfrclak.com or IP address 142.11.206.73. This behavior may indicate malware beaconing, command-and-control communication, or interaction with attacker-controlled infrastructure.
This rule detects suspicious network connections originating from internal IP addresses to common service ports (DNS, SMB, RDP, WinRM) on remote, non-internal IP addresses. It flags instances where a single process on a device makes 10 or more such connections within an hour, which could indicate reconnaissance, lateral movement, or data exfiltration attempts.
This rule detects an unusually high volume of network connections to common proxy ports (3128, 8080, 80, 443) initiated by critical system processes such as 'services.exe', 'svchost.exe', or 'rundll32.exe'. This behavior can indicate the installation and use of a trojan proxy or other malicious software attempting to exfiltrate data or establish command and control through a proxy.
Detects C2 beaconing and token validation activity via GitHub API commit searches using the exact strings hardcoded in the Miasma payload. The worm uses these searches to validate connectivity and verify stolen token legitimacy.
This rule detects HTTP connections to known paid intelligence databases. It specifically looks for hostnames containing 'silobreaker.com', 'sixgill.io', or 'cybersixgill' in HTTP traffic flowing from the home network to any destination. This could indicate an internal system or user accessing external threat intelligence platforms, which might be a normal operation for security teams but could also be an indicator of reconnaissance activity by an adversary.
Detects outbound network connections to known Command and Control (C2) IP addresses associated with the OP-512 threat actor, which are used as fallback infrastructure, including Meterpreter. This rule specifically looks for connections to '43.160.202.246' and '140.206.161.227'.
Detects issuance of free SSL certificates for newly registered attack domains
Detects instances where rundll32.exe executes with missing or minimal DLL arguments and subsequently establishes outbound network connections. This behavior is uncommon in legitimate Windows operations and has been observed during ACR Stealer infections, including executions originating from remote SMB shares and memory-loaded payloads.
This rule detects the upload of virtual machine disk images (VMDK, OVA, OVF, QCOW2, VHD) to cloud storage via HTTP PUT requests. The rule specifically looks for HTTP PUT methods, URIs ending with common VM image file extensions, and a minimum file size of 1MB, indicating a substantial file transfer. This activity could signify an attacker attempting to upload a backdoored or malicious VM image for persistence or to establish a foothold in a cloud environment.
This rule detects attempts to establish a raw socket connection that is not TCP, UDP, or ICMP. This behavior can be indicative of a socket filter backdoor, where an attacker uses raw sockets to bypass standard network stack processing and potentially sniff or inject arbitrary network traffic. The rule specifically looks for outgoing connections from the home network to any destination where the IP protocol is not 6 (TCP), 17 (UDP), or 1 (ICMP).
This rule detects when an Office Add-in is loaded from a remote URL, specifically targeting graph.microsoft.com. It looks for HTTP POST requests where the host is 'graph.microsoft.com' and the URI contains 'addIns'. This activity could indicate an attempt to establish persistence or execute malicious code via Office Add-ins.
This rule detects the use of TCP port 5938, which is commonly associated with the TeamViewer protocol. The rule is specifically looking for established connections to this port, indicating potential remote command and control (C2) activity. A threshold is set to trigger an alert if three such connections are observed from the same source within 60 seconds, aiming to reduce noise from legitimate, infrequent TeamViewer usage while still catching suspicious patterns.
Detects Node.js or Bun processes making network connections to the GitHub API. This rule is designed to identify potential exfiltration attempts, specifically referencing the Miasma campaign which spoofs a 'python-requests/2.31.0' User-Agent to evade network detection while exfiltrating credentials to api.github.com/repos/.
Offshore VPS Provider API Access
Suricata
This rule detects HTTP traffic to specific domains associated with offshore VPS providers (frantech.ca, serverius.net, combahton.net). This could indicate API access or other interactions with these services, which might be suspicious depending on the environment.
This rule detects suspicious HTTP traffic indicating a LinkedIn message that contains an external link. It specifically looks for HTTP requests to 'linkedin.com' with a URI containing '/messaging/' and triggers if 10 such events occur within 60 seconds from the same source IP address. This pattern is often associated with social engineering attempts where attackers use LinkedIn messaging to direct users to malicious external sites.
This rule detects an unusually high volume of successful network connections over SMB (ports 135, 139, 445) originating from a single account within a one-hour window. This behavior can be indicative of lateral movement, reconnaissance, or data exfiltration activities using SMB/RPC.
Page 248 of 280