Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,879 detections
Filters
Last updated
All Time
Detection languages
2,954
1,378
313
289
239
Contributors
1,807
1,529
1,304
180
173
Categories
20,460
11,847
5,879
5,158
4,866
Platforms
3,747
1,857
1,076
782
160
Products / Services
2,241
1,434
1,273
746
582
MITRE Techniques
2,448
2,151
1,129
937
790
CVEs
19
15
9
7
5
IDS Classtypes
834
334
94
23
20
IDS Protocols
689
276
235
117
23
Detects when a Network Attached Storage (NAS) or Internet of Things (IoT) device establishes multiple or high-volume outbound SSH/SFTP connections to an external IP address. This behavior can indicate that the device has been compromised and is being used as an 'Operational Relay Box' (ORB) to proxy malicious traffic, mask C2 communications, or exfiltrate data.
Detects network traffic on TCP port 18789, the default gateway port for OpenClaw. Monitoring for unauthorized external access to this port helps identify exposed admin dashboards or exploitation.
Detects network connections to domains and IPs associated with the Notepad++ supply chain attack. These indicators are linked to the distribution of Cobalt Strike and the Chrysalis backdoor.
The query, as constructed, is primarily focused on detecting large outbound traffic volumes to external destinations on a per source-destination pair basis within daily aggregations. Adjust the threshold and aggregation criteria based on your specific security requirements and typical network behavior patterns.
Detects network connections to or from a known malicious Command and Control (C2) IP address (91.92.242.30) associated with malicious OpenClaw/ClawdBot skills.
Detects a sequence of system reconnaissance commands followed by data exfiltration to temp.sh, a TTP used in the Notepad++ supply chain attack.
This rule detects when popular Remote Monitoring and Management (RMM) tools initiate network connections to public IP addresses. This behavior can be indicative of legitimate administrative tasks, but also of malicious activity where adversaries use these tools for remote access and control within a compromised environment. The rule specifically filters out connections to private IP ranges to reduce false positives related to internal network communication.
This rule detects outbound network connections to command and control (C2) domains and identifies files by name or hash associated with malicious PDF editor campaigns (e.g., ConvertMate, PDFClick, PDFSkills). These campaigns use malicious PDF editors for C2 communication, to download additional payloads, and for initial execution.
Detects Bash /dev/tcp with HTTP request construction - high fidelity detection for payload download via raw sockets
Apt28 Cloud Storage C2
YARA-L
Detects outbound network traffic to legitimate cloud storage domains (filen.io, icedrive.net, koofr.net) known to be abused by APT28 for Command and Control (C2) and data exfiltration as part of Operation Phantom Net Voxel.
Detects UserAccountBroker.exe being spawned by explorer.exe, which is an unusual parent-child relationship. The rule is enriched by looking for subsequent outbound network connections from the UserAccountBroker.exe process, a behavior observed in ValleyRAT infections.
This alert generates a log when a device onboarded is seen connecting to a known malicious domain within the ThreatIntelIndicators table. The TimeGenerated field should not be changed as the table refreshes every ~10 days.
Detects the suspicious spawning of UserAccountBroker.exe by explorer.exe, which is then observed making an outbound network connection. This behavior is characteristic of a watchdog mechanism used by the ValleyRAT malware to maintain persistence and C2 communication.
This rule detects large volumes of outbound network traffic originating from Azure Kubernetes Service (AKS) clusters to external destinations over non-standard ports. It specifically looks for traffic allowed by Palo Alto firewalls, excluding common ports like 80 and 443, and flags transfers exceeding a defined data threshold (e.g., 100MB). This behavior can indicate data exfiltration attempts where adversaries use alternative protocols to bypass standard monitoring.
Detects Microsoft Office applications establishing outbound network connections to non-private, non-Microsoft IP addresses. This behavior can be indicative of exploitation of vulnerabilities like CVE-2026-21509, where an embedded OLE object or malicious macro attempts to download a payload or beacon out.
Detects the use of curl.exe to upload files to the temp.sh service while simultaneously passing the resulting temp.sh URL within the User-Agent string to a C2 server. This specific exfiltration and beaconing TTP was observed in the Notepad++ supply chain attack.
Chrysalis Backdoor Network IOCs
Cortex XDR
Detects network connections to known command and control (C2) infrastructure associated with the Lotus Blossom threat group and the Chrysalis Backdoor. This rule identifies suspicious outbound network activity to specific IP addresses and hostnames linked to this threat actor.
Detects network traffic to or from known IP addresses associated with TA584 command and control (C2) servers and hosting infrastructure. This actor is a known initial access broker, and infections can lead to ransomware.
Detects a behavioral sequence where an AI agent runtime (e.g., Node.js, Python) spawns a shell to execute a web request utility like curl or wget. This pattern is a strong indicator of automated data exfiltration, often resulting from a successful prompt injection attack that instructs the agent to steal and send data to an attacker-controlled server.
This rule identifies network activity that could be indicative of command and control (C2) communication or reconnaissance. It specifically looks for two patterns: DNS queries to 'api.ipify.org', which is a service used to determine the public IP address, or outbound network connections on port 7712 to external IP addresses (excluding common private IP ranges). Both of these activities, especially when combined, can be associated with malicious software like the MonsterV2 C2 framework, which might use such methods for initial reconnaissance or C2 communication.
Detects when an Azure Kubernetes Service (AKS) worker node initiates an outbound connection to a public IP address over a non-standard or unexpected port. This could indicate data exfiltration using custom tools or protocols.
Page 261 of 280