Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,879 detections
Filters
Last updated
All Time
Detection languages
2,954
1,378
313
289
239
Contributors
1,807
1,529
1,304
180
173
Categories
20,460
11,847
5,879
5,158
4,866
Platforms
3,747
1,857
1,076
782
160
Products / Services
2,241
1,434
1,273
746
582
MITRE Techniques
2,448
2,151
1,129
937
790
CVEs
19
15
9
7
5
IDS Classtypes
834
334
94
23
20
IDS Protocols
689
276
235
117
23
Detects network connections over common exfiltration ports (80, 443, 53) to external IP addresses originating from executables running out of uncommon, temporary, or public directories. This behavior frequently indicates custom or unrecognized malware binaries conducting data exfiltration or establishing Command and Control (C2) communication.
This rule detects potential brute force or enumeration attempts against an IIS web server by identifying a high volume of access denied (HTTP 401 or 403) responses from a single IP address within a one-hour window. A count of 20 or more such responses from the same IP is considered suspicious.
This rule detects processes making a high volume of successful network connections to GitHub's raw content (raw.github.com). This behavior can be indicative of an adversary downloading tools, scripts, or other malicious content from GitHub, potentially as part of a command and control (C2) channel or for staging purposes. The rule counts connections per hour per initiating process filename and flags if the count exceeds 5.
This rule detects processes making a high volume of network connections (10 or more within an hour) to URLs containing 'release' or 'download'. This behavior can be indicative of malware downloading additional components, updates, or exfiltrating data, but could also be legitimate software updates or large file transfers.
This rule detects potential brute force or enumeration attempts against an IIS web server by identifying a high volume of access denied (HTTP 401 or 403) responses from a single IP address within a one-hour window. A count of 20 or more such responses from the same IP is considered suspicious.
This rule detects network connections initiated by the 'teams.exe' process to public IP addresses. It specifically looks for outbound connections from the Microsoft Teams application to external, non-private IP ranges. This could be used to monitor unusual external communication patterns from Teams, although the specific intent without further context is unclear.
This rule detects potential data exfiltration attempts over non-standard network ports. It identifies devices that establish more than 5 network sessions to external (non-private IP) destinations on ports other than common ones like 80 (HTTP), 443 (HTTPS), 21 (FTP), 22 (SSH), 25 (SMTP), 110 (POP3), 143 (IMAP), 993 (IMAPS), and 995 (POP3S) within a one-hour window. This behavior can indicate an adversary attempting to bypass network monitoring by using less common ports for data transfer.
This rule detects HTTP requests to known threat intelligence portals associated with dark web monitoring. It specifically looks for hostnames containing 'intel471', 'kela.io', 'recordedfuture', or 'flashpoint'. This could indicate an analyst or system accessing threat intelligence, or potentially an adversary performing reconnaissance.
This rule detects access to known dark web credential markets by inspecting HTTP host headers for specific domain patterns. It triggers an alert if a client on the home network attempts to connect to 'genesis.market', 'russianmarket', or '2easy.shop'. This indicates potential reconnaissance or direct access to platforms where stolen credentials are traded.
This rule detects HTTP requests to known underground forums (nulled.to, hackforums.net, ogusers) via a clearnet proxy. It specifically looks for these hostnames in HTTP traffic.
This rule detects attempts to download raw payload files (PowerShell scripts, executables, DLLs, batch files, VBScripts, Python scripts, or shell scripts) from raw.githubusercontent.com. This activity is often associated with adversaries attempting to retrieve malicious tools or scripts from code repositories.
This rule detects HTTP requests made to the Shodan API (api.shodan.io). This activity is often associated with reconnaissance, where an attacker or security researcher uses Shodan to gather information about internet-connected devices and services. The rule specifically looks for the 'api.shodan.io' string within the HTTP host header, indicating an attempt to query the Shodan service.
This rule detects potential Tor network traffic by looking for specific byte patterns (TLS handshake ClientHello with version 1.0 or 1.1) in TCP traffic flowing from the internal network to any external destination. It uses a threshold of 3 occurrences within 60 seconds from the same source IP to reduce false positives. The rule specifically targets the initial bytes of a TLS handshake, which is a common characteristic of Tor's encrypted communication.
This rule detects HTTP requests where the User-Agent header appears to be faked or malformed. Specifically, it looks for a User-Agent string that starts with 'Mozilla/5.0' followed by an opening parenthesis, and then contains at least 200 characters before a closing parenthesis. This pattern is often used by malicious actors to evade detection by making their User-Agent string unusually long and potentially obfuscated, while still mimicking a common browser prefix.
This rule detects network traffic on TCP port 3333, which is commonly associated with the Stratum protocol used in cryptocurrency mining. The rule specifically looks for the initiation of a TCP connection (SYN flag) to this port from the home network to any destination. This activity could indicate the presence of cryptomining malware or unauthorized cryptomining operations within the network.
This rule detects network connections to TCP port 3334, which is commonly used by the Stratum protocol for cryptocurrency mining. The rule specifically looks for the initial SYN packet (flags:S) of a TCP connection originating from the home network ($HOME_NET) to any destination. This activity is indicative of potential cryptomining operations within the monitored network.
Detects outbound network connections initiated by 7-Zip processes. This could indicate compromise of the 7-Zip application, potentially through exploitation of vulnerabilities like CVE-2026-48095, leading to data exfiltration or command and control communication.
Detects network connections to the specific local port 8738 used by the IronWorm Exodus wallet injection module to exfiltrate stolen seed phrases and passwords. This rule specifically looks for outbound connections from the 'exodus.exe' process to localhost on port 8738.
This rule detects attempts to retrieve C2 configuration from Pastebin, specifically looking for HTTP requests to 'pastebin.com' that include '/raw/' in the URI. It uses a threshold of 5 occurrences within 300 seconds from the same source to reduce false positives.
This rule detects HTTP responses from a web server to a client that contain JavaScript code attempting to redirect the user's browser. Specifically, it looks for the string "window.location.replace" within the HTTP response body (file.data) when the HTTP referer header indicates the request originated from Google or Bing search results. This pattern is often associated with content injection attacks where malicious code is injected into legitimate search results to redirect users to malicious sites.
This rule detects unusual network beaconing activity from processes. It identifies processes that make more than 50 network connections within a 15-minute window to distinct remote IP addresses and ports, excluding common legitimate processes like svchost.exe, chrome.exe, msedge.exe, and explorer.exe. The rule then enriches this information with the last seen time of the process.
Page 251 of 280