Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,879 detections
Filters
Last updated
All Time
Detection languages
2,954
1,378
313
289
239
Contributors
1,807
1,529
1,304
180
173
Categories
20,460
11,847
5,879
5,158
4,866
Platforms
3,747
1,857
1,076
782
160
Products / Services
2,241
1,434
1,273
746
582
MITRE Techniques
2,448
2,151
1,129
937
790
CVEs
19
15
9
7
5
IDS Classtypes
834
334
94
23
20
IDS Protocols
689
276
235
117
23
Detects network activity associated with the Psychedelic Stealer malware, including C2 check-ins, API-based tasking, and communication with known C2 infrastructure using specific URI patterns and headers like 'X-API-Key'.
Detects a credential-theft pattern associated with Psychedelic Stealer where a process accesses the 'Login Data' file of common Chromium-based browsers, followed shortly by a network connection to a known stealer exfiltration API endpoint.
This rule monitors outbound TLS traffic to detect communication between a potentially compromised internal host and the DeepSeek API. This behavior is associated with the 'CLOSEDQUORUM' malware family, which utilizes LLM-based voting mechanisms for command and control (C2) operations via third-party AI services.
Detects HTTP traffic originating from internal hosts to external destinations on port 8989, specifically targeting '/chat/completions' URI patterns. This activity is indicative of the CARBONATO/Hermes Agent leveraging LLM gateway infrastructure as a command-and-control (C2) channel.
This rule detects a multi-tool attack chain involving the Cairn autonomous exploitation engine and the Hermes Agent. It flags the co-occurrence of outbound network traffic to both the DeepSeek API (Cairn engine) and the Anthropic Claude API (Hermes Agent) from the same host within a one-hour window. This behavior is indicative of an automated, AI-driven post-exploitation orchestration campaign.
Detects outbound network requests from non-standard Android application processes to Google's generative-AI API endpoints (e.g., Gemini). This behavior is indicative of malware, such as RatHat, attempting to exfiltrate accessibility information or UI trees to an LLM to facilitate automated screen interaction and navigation.
Detects outbound network requests from non-standard Android application processes to Google's generative-AI API endpoints (e.g., Gemini). This behavior is indicative of malware, such as RatHat, attempting to exfiltrate accessibility information or UI trees to an LLM to facilitate automated screen interaction and navigation.
Detects the loading of spoofed system DLLs (dnsapi.dll or ws2_32.dll) from non-system directories, followed by network beaconing to suspicious domains associated with the NeedyMantis malware.
Detects specific HTTP traffic patterns associated with the RatHat malware's FRP (Fast Reverse Proxy) reverse-tunneling deployment and C2 status reporting. The rule identifies the sequence of fetching configuration, initiating WebSocket tunnel links, and reporting deployment status to a remote command-and-control server.
Detects network activity associated with the NeedyMantis malware command and control (C2), including DNS queries for the domain corp.tripswithengine.com, TLS SNI identification, and specific HTTP beaconing patterns to /library/zip/ with a hardcoded user agent.
Detects HTTP traffic associated with the NeedyMantis malware, specifically identifying initial beacons to a known C2 domain using a specific User-Agent, followed by command-and-control response headers that suggest the exfiltration of reconnaissance data via the Set-Cookie field.
Detects outbound network requests to known infrastructure associated with the ClickFix Traffic Direction System (TDS), specifically targeting domains 'fsputnik.com' and 'uasputnik.com'. The rules monitor for requests to specific lure pages, tracker files, and established IP connections used by this malicious campaign to deliver fraudulent prompts or lures to victims.
Detects various indicators of compromise (IOCs) including known malicious file hashes, suspicious file names commonly associated with staging or initialization in web directories, and network communication to known malicious domains or URLs. It also monitors process execution command lines for references to these IOCs, excluding common browser processes.
Detects anomalous outbound HTTP/TLS requests to rutracker.org that contain a GUID-like identifier in the URI or deviate from normal user traffic patterns, which is characteristic of the 'VPN-for-X' browser extension acting as a command-and-control beacon.
This rule monitors for indicators of compromise (IOCs) associated with known malware and C2 infrastructure, including specific IP:port combinations, malicious domains, URLs for file downloads, and SHA256 hashes of known malware. The rule correlates data across device network events, file events, and process execution events to identify potential infections or communication with malicious infrastructure.
Comprehensive IOC sweep across endpoint file/process/network telemetry for the full set of known SilkParasite/SpiceRAT/NodeEdgeRAT/NomadRAT/BloodAlchemy infrastructure indicators reported by Hunt.io and Security Affairs: all listed C2/decoy/certificate-hosting IPs, all listed spoofed/infrastructure domains, and known file/certificate hashes (SHA256, SHA1).
This rule detects outgoing HTTP POST requests to the '/api/credentials' endpoint, which is characteristic of the AMOS (Atomic macOS Stealer) malware family communicating with its command-and-control server to exfiltrate stolen sensitive information.
This rule detects two suspicious behaviors: 1) Execution of common system binaries (e.g., rundll32.exe, powershell.exe) from a directory pattern resembling a temporary folder or droppers, and 2) Network connections initiated by the 'attrib.exe' binary, which is atypical for this utility and may indicate malicious activity or staging.
Detects HTTP beaconing patterns and TLS SNI traffic associated with the Sauron Loader malware. The rules identify specific URI structures (including versioned resources and various configuration/profile endpoints), specific URL parameters used for session management, and characteristic User-Agent strings. Additionally, it monitors for connections to known command-and-control infrastructure via TLS SNI filtering.
Detects anomalous behavior where a node.exe process establishes an outbound network connection, characteristic of a C2 registration or ping loop, followed shortly by the spawning of an interactive command shell (cmd.exe or powershell.exe) by the same node.exe process. This pattern is indicative of a RAT (Remote Access Trojan) shell handler execution.
This rule detects potential browser-based credential and session theft by monitoring for a process that accesses multiple sensitive web browser artifacts (cookies, local state, session storage) across several user profiles in a short timeframe. It correlates this activity with the subsequent creation of a compressed archive in a temporary directory followed by an outbound network connection, indicating a multi-stage exfiltration workflow.
Page 27 of 280