Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,879 detections
Filters
Last updated
All Time
Detection languages
2,954
1,378
313
289
239
Contributors
1,807
1,529
1,304
180
173
Categories
20,460
11,847
5,879
5,158
4,866
Platforms
3,747
1,857
1,076
782
160
Products / Services
2,241
1,434
1,273
746
582
MITRE Techniques
2,448
2,151
1,129
937
790
CVEs
19
15
9
7
5
IDS Classtypes
834
334
94
23
20
IDS Protocols
689
276
235
117
23
ET INFO Remote Monitoring and Management (RMM) Tool in DNS Lookup (gorelo .tech)
This rule detects the 'Get-ScheduledTask' PowerShell cmdlet within the HTTP response body, specifically when the HTTP status code is 200. This could indicate an attacker enumerating scheduled tasks on a compromised system via a web-based command and control channel or data exfiltration.
ET INFO Blockchain RPC Domain in TLS SNI (api .avax .network)
ET INFO Observed RMM Domain (meshcentral .com in TLS SNI)
ET INFO DYNAMIC_DNS HTTP Request to a *.freeddns .tokyo domain
Detects suspicious command sequence that JexBoss
ET MALWARE TA569 Gholoader CnC Domain in TLS SNI (plesk .breeconsulting .net)
ET INFO Observed Commonly Actor Abused Cloud Hosting Service Domain (vercel .app in TLS SNI)
ET INFO Blockchain RPC Domain in TLS SNI (arbitrum .one)
ET INFO DYNAMIC_DNS HTTP Request to a *.anchorchain .co .za domain
ET ATTACK_RESPONSE Nishang Invoke-PowerShellTcp Shell Prompt Outbound
ET EXPLOIT_KIT LandUpdate808 Domain (dolmain .com) in TLS SNI
ET EXPLOIT_KIT LandUpdate808 Domain (forrbes .com) in TLS SNI
This rule detects HTTP traffic where the User-Agent string contains the case-insensitive substring 'iot'. This is often indicative of compromised IoT devices or botnet activity attempting to blend in or identify themselves.
ET MALWARE Observed Malicious Domain (tamku .shoplerter .opnetorologies .net in TLS SNI)
ET MALWARE Observed Malicious Domain (tamku .shop in TLS SNI)
ET INFO Blockchain RPC Domain in TLS SNI (polygon-rpc .com)
Detects network connections to blockchain APIs that are indicative of EtherHiding techniques, specifically those used by UNC5342 to retrieve malicious payloads. It identifies connections to domains containing keywords like 'explorer', 'block', 'cypher', 'eth', 'bit', 'coin', or 'crypto', combined with suspicious URL patterns such as 'eth_call' (a read-only function call for smart contracts) or 'apiKey=freekey' (a common free API key used by threat actors).
Detects outbound network connections to the OpenAI API from unusual processes, a TTP used by the SesameOp backdoor for command and control (C2).
Detects processes with names used by Qilin malware (`hosts.exe`, `dato.exe`) that are launched without a visible window and subsequently make an outbound network connection. This pattern is indicative of a hidden C2 beacon, a technique used by Qilin to evade user detection.
This detection identifies network connections to external DNS servers over TCP (port 53) initiated by common scripting engines like PowerShell, Python, or WScript. While DNS over TCP is a valid protocol, it is less common for standard queries and is often used by malware for command and control (C2) or data exfiltration through DNS tunneling.
Page 265 of 280