Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,879 detections
Filters
Last updated
All Time
Detection languages
2,954
1,378
313
289
239
Contributors
1,807
1,529
1,304
180
173
Categories
20,460
11,847
5,879
5,158
4,866
Platforms
3,747
1,857
1,076
782
160
Products / Services
2,241
1,434
1,273
746
582
MITRE Techniques
2,448
2,151
1,129
937
790
CVEs
19
15
9
7
5
IDS Classtypes
834
334
94
23
20
IDS Protocols
689
276
235
117
23
This rule detects HTTP requests where the 'Host' header matches patterns commonly associated with serverless function domains, specifically AWS Lambda URLs, Azure Websites, and Google Cloud Functions. The rule is designed to identify potential command and control (C2) infrastructure utilizing serverless platforms. It triggers an alert if 10 such requests are observed from a single source IP within a 60-second window.
This rule detects HTTP traffic where the 'Host' header contains 'workers.dev'. This domain is associated with Cloudflare Workers, which can be used by attackers to deploy attack infrastructure such as command and control (C2) servers, phishing pages, or data exfiltration points. The rule is configured to trigger a threshold alert if 10 such connections are observed from a single source IP within 60 seconds, indicating potential automated activity or repeated attempts to access or deploy malicious worker scripts.
This rule detects outbound TCP connections on port 9050, which is commonly used by the Tor anonymity network. The rule is configured to trigger an alert if there are at least 3 such connections from the same source within a 60-second window, indicating potential use of Tor. The message suggests this activity is related to accessing an Initial Access Broker market.
This rule detects HTTP network connections to common Cloud Virtual Private Server (VPS) providers (DigitalOcean, Vultr, Linode, Hetzner) where the URI content includes the word 'create'. This combination suggests an attempt to set up new infrastructure, potentially for malicious purposes, aligning with resource development tactics.
This rule detects large data uploads over HTTPS (port 443) from the home network to any external destination. Specifically, it triggers if the data size in a single TCP flow to the server exceeds 65,000 bytes. To prevent excessive alerts, it uses a threshold of 20 such events within 60 seconds, tracked by the source IP address. This behavior is indicative of potential data exfiltration.
This rule detects TCP network connections originating from the internal network ($HOME_NET) to any external destination on port 1337. The detection is specifically for the initial SYN packet of a TCP handshake (flags:S) and is categorized as 'trojan-activity'. Port 1337 is commonly associated with Remote Access Trojans (RATs) for Command and Control (C2) communications, aligning with MITRE ATT&CK technique T1219.
This rule detects sustained outbound network traffic with a data size greater than 1000 bytes, originating from the home network. It triggers an alert if 200 such connections are observed from the same source IP address within a 300-second window. This behavior is indicative of automated exfiltration, where an attacker continuously sends data out of the network.
Detects cURL making direct HTTP requests to raw IPv4 addresses specifically seeking 'installer' binaries. This specific command-line pattern is a documented staging technique used by UNC3753 to deploy RMM payloads on victim machines.
Detects modifications to the 'SSLKEYLOGFILE' environment variable in the Windows Registry. This variable is often used by applications like web browsers to log SSL/TLS session keys to a file, which can then be used to decrypt encrypted network traffic. Malicious actors might enable this to capture sensitive data.
This rule detects high-volume data exfiltration attempts over common HTTPS ports (443 or 8443). It identifies network connections where more than 1MB of data is sent in a single connection, then aggregates these connections over one-hour intervals per device and remote IP. Finally, it flags any device that has sent a total of 50MB or more within that hour to a specific remote IP, indicating potential data exfiltration to a command and control server.
This rule detects suspicious outbound DNS queries originating from a device that are not directed to common public DNS servers (Google DNS, Cloudflare DNS). The rule specifically flags queries where the remote DNS name contains keywords like 'malware', 'c2', or 'c&c', and where at least 5 such queries occur within an hour from the same device. This pattern can indicate potential malware communication or command and control (C2) activity.
This rule detects a high volume of outbound network connections (20 or more within an hour) from a single device and process to non-RFC1918 IP addresses on ports commonly associated with Remote Access Trojans (RATs) or Command and Control (C2) communication. The ports monitored include 443, 8443, 8080, 80, 4444, 5555, 6666, and 7777. This pattern can indicate a compromised host attempting to establish C2 with an external adversary.
Detects network connections to the '.cfd' TLD originating from common web browsers. This cheap TLD is increasingly abused by attackers to host phishing redirect pages delivered via malicious SVG files.
Detects generic application layer protocol abuse for C2 communications
Detects junk data padding in HTTP requests used to obfuscate C2 communications
Detects compromised host participating in botnet C2 beaconing
Detects automated social media account registration used for fake identity infrastructure
This rule detects DNS queries for TXT records that contain specific patterns indicative of DNS calculation C2 (Command and Control) activity. The pattern searched for is a PCRE regex matching two alphanumeric strings, each 4 to 8 characters long, separated by a dot (e.g., 'abcd.efgh.'). This type of activity is often associated with malware using DNS TXT records to encode C2 instructions or data, potentially involving IP math for dynamic C2 server resolution. The rule includes a threshold to prevent excessive alerts, triggering if 5 such queries are observed from the same source within 60 seconds.
This rule detects potential callback activity from a remote hardware implant. It specifically looks for HTTP requests where the URI contains common callback patterns like '/callback', '/checkin', '/ping', or '/heartbeat', and the User-Agent header indicates a scripting tool such as 'python', 'curl', or 'wget'. The rule also specifies that the HTTP body size should be between 1 and 199 bytes, and it uses a threshold to trigger an alert if 10 such events occur within 60 seconds from the same source.
Detects network traffic to known Command and Control (C2) IP addresses and ports associated with the ClickFix Python RAT.
Detects network connections over common exfiltration ports (80, 443, 53) to external IP addresses originating from executables running out of uncommon, temporary, or public directories. This behavior frequently indicates custom or unrecognized malware binaries conducting data exfiltration or establishing Command and Control (C2) communication.
Page 250 of 280