Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,879 detections
Filters
Last updated
All Time
Detection languages
2,954
1,378
313
289
239
Contributors
1,807
1,529
1,304
180
173
Categories
20,460
11,847
5,879
5,158
4,866
Platforms
3,747
1,857
1,076
782
160
Products / Services
2,241
1,434
1,273
746
582
MITRE Techniques
2,448
2,151
1,129
937
790
CVEs
19
15
9
7
5
IDS Classtypes
834
334
94
23
20
IDS Protocols
689
276
235
117
23
Detects outbound network connections to a known PCPcat C2 server IP address on specific ports used for API communication, reverse tunneling, and payload distribution. This rule identifies potential command and control activity and data exfiltration attempts by monitoring network traffic to a hardcoded malicious IP and associated non-standard ports.
Detects when legitimate .NET utilities, often abused for process hollowing, make outbound network connections. This is anomalous behavior and may indicate that the process has been injected with malicious code to bypass defenses.
Detects outbound network connections to a list of IP addresses identified as high-confidence command and control (C2) infrastructure for the Clop ransomware group. This infrastructure has been observed across multiple campaigns, including the exploitation of vulnerabilities like CVE-2025-61882 (Oracle E-Business Suite), CVE-2023-34362 (MOVEit), and CVE-2023-0669 (GoAnywhere).
This rule detects PowerShell processes that are initiated by a LOLBAS binary and subsequently establish an outbound network connection to a public IP address. It leverages an external LOLBAS JSON data source to identify suspicious parent processes. This behavior could indicate an adversary using a Living Off The Land Binary or Script (LOLBAS) to execute PowerShell for malicious purposes, such as command and control or data exfiltration.
Detects outbound network connections from common web server processes to the Telegram API domain (api.telegram.org). This behavior is indicative of the BlackForce phishing kit exfiltrating stolen credentials, as newer versions use a server-side component to relay data to a Telegram channel.
Detects network connections to Discord webhook URLs from non-standard processes. This technique is often used by malware, such as Phantom Stealer, to exfiltrate stolen data.
This rule detects the presence and activity of the ShadyPanda malware campaign, specifically focusing on malicious Chrome extensions and their associated command and control (C2) and data exfiltration domains. It identifies the creation of files with known malicious Chrome extension IDs (ending in '.crx') and network connections to hardcoded C2 and exfiltration domains linked to the ShadyPanda campaign.
This rule detects the presence and activity of the ShadyPanda malware campaign, specifically focusing on malicious Chrome extensions and their associated command and control (C2) and data exfiltration domains. It identifies the creation of files with known malicious Chrome extension IDs (ending in '.crx') and network connections to hardcoded C2 and exfiltration domains linked to the ShadyPanda campaign.
Detects a distinctive User-Agent string used by the initial RedLoader DLL for command and control (C2) communications. This activity is associated with the GOLD BLADE threat group (also known as RedCurl).
Detects network connections to dedicated IP addresses previously used to host Evilginx phishing proxies. While the threat actor has reportedly shifted to using Cloudflare, these IPs represent past infrastructure and should be monitored for potential reuse.
Detects network connections originating from notepad.exe to suspicious domains or IP addresses. This is a high-fidelity indicator of compromise associated with the SERPENTINE#CLOUD campaign, where a malicious payload is injected into the notepad.exe process for C2 communications.
Detects potential Command and Control (C2) communication from the AK47C2 backdoor over HTTP. The backdoor sends a hex-encoded JSON payload via HTTP POST requests. This rule specifically looks for HTTP POST requests with a request body longer than 100 characters that consists entirely of hexadecimal characters, indicative of the AK47C2 communication pattern.
This detection identifies Command and Control (C2) communication associated with the FormBook RAT, specifically targeting connections to a known malicious IP address and dynamic DNS domain on an unusual port. Detecting C2 activity is crucial for identifying active compromises and preventing data exfiltration or further malicious commands.
This search detects network connections to a specific webhook.site URL known to be used by the Shai-Hulud 2.0 worm for data exfiltration.
This rule detects command-line activity indicative of downloading payloads from a Cloudflare Tunnel (`.trycloudflare.com`). This technique is used by the SERPENTINE#CLOUD threat actor to deliver malicious stages of their attack chain. The rule looks for common download utilities or specific WebDAV paths being invoked by command-line interpreters such as cmd.exe, powershell.exe, or pwsh.exe.
Detects network connections to known Command and Control (C2) IP addresses associated with the LANDFALL Android spyware. While the spyware is known to target Samsung Android devices, this rule detects connections from any device to provide broader coverage against infrastructure reuse.
This rule detects potential DNS command and control (C2) activity from the AK47C2 backdoor. The backdoor communicates by sending long, hex-encoded strings as subdomains to a C2 server, specifically targeting the domain 'update.updatemicfosoft.com'. The detection logic looks for DNS queries to this specific domain where the subdomain is longer than 40 characters and consists of hex characters, optionally prefixed with 's', '1', '2', or 'a'.
Detects the execution of a malicious JAR file, a technique used by the Bloody Wolf APT group to download and execute NetSupport RAT components.
This rule detects potential DNS command and control (C2) activity from the AK47C2 backdoor. The backdoor communicates by sending long, hex-encoded strings as subdomains to a C2 server, specifically targeting a typosquatted domain of 'updatemicfosoft.com'. The rule identifies these communications by checking for the specific C2 domain, a subdomain length greater than 40 characters, and the subdomain consisting of hex characters with optional prefixes 's', '1', '2', 'a'.
Detects outbound network connections from common messaging or gallery apps on Samsung Android devices to command and control (C2) infrastructure associated with the LANDFALL spyware.
Detects network traffic to a known Command and Control (C2) server (136.243.146.46:8898) associated with the YiBackdoor malware.
Page 263 of 280