Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,879 detections
Filters
Last updated
All Time
Detection languages
2,954
1,378
313
289
239
Contributors
1,807
1,529
1,304
180
173
Categories
20,460
11,847
5,879
5,158
4,866
Platforms
3,747
1,857
1,076
782
160
Products / Services
2,241
1,434
1,273
746
582
MITRE Techniques
2,448
2,151
1,129
937
790
CVEs
19
15
9
7
5
IDS Classtypes
834
334
94
23
20
IDS Protocols
689
276
235
117
23
Detects network connections to Azure App Services domains containing healthcare or service-themed keywords originating from non-browser processes. Obsidian Sandstorm utilizes these tailored subdomains for C2 communications to blend in with legitimate enterprise network traffic.
This rule detects outbound Server Message Block (SMB) communications from internal devices to external (non-private) IP addresses. It specifically looks for connections on ports 137, 138, 139, and 445. The rule then aggregates these events over 10-minute intervals and flags devices that have more than 5 such SMB connections to distinct external IPs, indicating potential data exfiltration or unauthorized external communication.
This rule detects potential Agent Tesla malware activity by correlating process execution with network connections. It looks for processes named 'agenttesla.exe', 'atsvc.exe', or 'atservice.exe' that execute with command-line arguments indicative of data exfiltration (e.g., 'smtp', 'ftp', 'http.post', 'exfil'). The rule then correlates these process events with outbound network connections to non-private IP addresses, flagging instances where multiple process runs and multiple network connections occur within a 30-minute window.
Detects wscript.exe initiating outbound network connections to non-standard HTTP ports (ports other than 80, 443, or 8080), which aligns with JS.MonoGlyphRAT's C2 communication profile. This rule specifically looks for successful network connections from wscript.exe to remote IPs that are not private and are not using standard web ports, indicating potential command and control activity.
Detects Python processes (python.exe, pythonw.exe) making more than 3 connections to public IP addresses. This activity could indicate data exfiltration, command and control communication, or other suspicious network behavior originating from a Python script.
This rule detects potential C2 beaconing behavior by identifying devices that make a high number of periodic outbound connections (20 or more within an hour) to a single external IP address on common web and C2-related ports (80, 443, 8080, 8443, 4444, 5555, 8888, 9001). The rule summarizes these connections by device, remote IP, and initiating process, highlighting sustained communication patterns indicative of command and control.
This rule detects a high volume of outbound TCP communication from the home network to any destination on port 8080. This pattern can indicate a compromised server acting as a proxy or engaging in other suspicious network activity, potentially for resource development or command and control.
This rule detects attempts to enumerate domain trust relationships using LDAP queries. Specifically, it looks for TCP traffic on port 389 (LDAP) containing the string "(objectClass=trustedDomain)" in the server-bound flow. This string is commonly used in LDAP queries to discover trusted domains within an Active Directory environment, which can be a reconnaissance step for attackers.
This rule detects outbound TCP connections to port 9050, which is commonly used by Tor proxies. The rule specifically looks for the initial SYN packet (flags:S) of a TCP connection from the home network to any destination on port 9050. This activity is flagged as a policy violation, indicating the use of a Tor proxy for accessing closed source resources.
This rule detects attempts to access known online platforms used for purchasing stolen data, such as 'leakbase', 'breachforums', and 'raidforums'. It specifically looks for these keywords in the HTTP host header during client-to-server HTTP traffic.
This rule detects access to known exploit kit purchase or dark web marketplace sites by inspecting HTTP host headers for specific domain patterns. The rule triggers an alert if a client on the home network attempts to connect to any of the listed domains, which are associated with exploit kit sales or underground forums.
This rule detects HTTP requests to known data broker websites such as Spokeo, Intelius, and BeenVerified. It triggers an alert if 10 or more such requests are observed from a single source IP within a 60-second window. This activity could indicate reconnaissance efforts to gather information about individuals.
This rule detects potential Secure File Transfer Protocol (SFTP) large file exfiltration attempts. It triggers an alert when a TCP connection on port 22 (SFTP) from the home network to any destination transfers a large amount of data (greater than 65000 bytes) to the server. A threshold of 20 such transfers within 60 seconds from the same source IP is set to reduce false positives. The rule specifically looks for the SFTP protocol magic bytes '|00 00 00|' within the first 4 bytes of the payload.
This rule detects TCP connections to port 8888, which is commonly used by Remote Access Trojans (RATs) for Command and Control (C2) communications. The rule specifically looks for the SYN flag in the TCP handshake, indicating the initiation of a new connection from the internal network ($HOME_NET) to any external destination.
This rule detects network connections to TCP port 4444, which is a commonly used default handler port for Metasploit, a popular penetration testing framework. The rule specifically looks for the initial SYN packet (flags:S) of a TCP connection from any source to any destination on port 4444 within the home network. This activity is often associated with command and control (C2) communication or reverse shells established by attackers using Metasploit.
This rule detects network connections to TCP port 45700, which is a default port used by the XMRig cryptocurrency miner. The detection specifically looks for the initiation of a connection (SYN flag) from the internal network ($HOME_NET) to any external host. This activity is indicative of a system within the internal network potentially running an XMRig miner, which aligns with the MITRE ATT&CK technique T1496 (Resource Hijacking).
Detects potential WordPress malware activity that abuses Steam Community profile comments as a command-and-control (C2) channel. The malware retrieves encoded payloads hidden in Steam profile comments using invisible Unicode characters, decodes malicious URLs, and downloads additional JavaScript payloads. This rule identifies outbound connections from WordPress servers to Steam Community URLs or known malicious infrastructure associated with this campaign.
This rule detects a high volume of successful network connections to common web ports (80, 443, 8080, 8443) where the remote URL contains keywords like 'version' or 'software'. This pattern could indicate an adversary performing reconnaissance to identify installed software and their versions, potentially looking for vulnerabilities or specific applications to target. The threshold of 10 such activities within an hour for a single device is set to flag anomalous behavior.
Detects devices making a high volume (5 or more per hour) of successful network connections to remote URLs containing 'update' or 'patch' on port 443 (HTTPS). This could indicate legitimate system updates, but also potentially malicious update checks or beaconing activity.
Detects web requests containing the specific user-agent or custom secret headers used by the Moika campaign beacon to retrieve its stage 2 payload.
This rule detects suspicious network connections made by processes (excluding legitimate EDR processes like mssense.exe and senseir.exe) to URLs commonly associated with EDR command and control (C2) infrastructure. This could indicate an attempt by an adversary to communicate with or manipulate the EDR agent.
Page 253 of 280