Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,879 detections
Filters
Last updated
All Time
Detection languages
2,954
1,378
313
289
239
Contributors
1,807
1,529
1,304
180
173
Categories
20,460
11,847
5,879
5,158
4,866
Platforms
3,747
1,857
1,076
782
160
Products / Services
2,241
1,434
1,273
746
582
MITRE Techniques
2,448
2,151
1,129
937
790
CVEs
19
15
9
7
5
IDS Classtypes
834
334
94
23
20
IDS Protocols
689
276
235
117
23
Detects network activity associated with SectopRAT malware. The rule identifies C2 beaconing behavior on a non-standard port using a custom protocol with a specific 5-byte length header and 16-byte initialization vector, filtering out standard HTTP/TLS traffic.
Detects HTTP POST requests directed to the URI path '/api/credentials' over the non-standard TCP port 8133, which is indicative of AMOS (Atomic macOS) Stealer exfiltrating stolen credentials to a C2 server.
Detects host and browser fingerprinting reconnaissance behavior associated with the Macfinger/ClickFix infection chain. The rule identifies multiple disparate indicators (ClickFix tracker domain, ipinfo.io geolocation lookups, and known AMOS C2 IP contact) occurring on the same device within a 15-minute window, effectively reducing noise from isolated or benign network lookups.
Detects periodic, repetitive outbound HTTPS network connections from AI agent-runtime environments to domains that are not in the predefined allow-list. This behavior is consistent with C2 beaconing disguised as application API traffic, potentially indicating an AI agent has been compromised or misused for unauthorized external command communication.
Detects an AI agent or automated process that accesses sensitive data sources (such as vaults, databases, or documentation platforms) followed by an outbound HTTP POST request to known high-risk SaaS or web services (e.g., paste sites, file sharing, or webhook services) with a suspicious or large payload.
Detects anomalous activity where a single compromised AI agent identity attempts to connect to a high volume of internal agent, API, or RPC endpoints within a short time window. This behavior is indicative of lateral movement across an interconnected agent mesh.
IOC hunt across DNS, network, and file-hash telemetry for the Ledger Google Ads phishing campaign. Vercel redirect domains are matched by exact hostname (DNS query name / parsed URL host) rather than substring, eliminating false positives from unrelated strings that merely contain a look-alike domain fragment. GCS bucket and Google Sites path IOCs remain substring-matched since the bucket IDs and page slugs are already highly specific.
Detects clicks on sponsored search engine ads that redirect users to Google Cloud Storage (GCS) buckets with names or paths designed to impersonate the 'Ledger' brand. These artifacts are indicative of a malvertising campaign using typosquatted storage paths to deliver malicious payloads or credential harvesting pages.
Detects network activity (TCP, DNS, TLS, HTTP) associated with the UNC6240 threat actor's infrastructure, specifically targeting communications with known malicious IP addresses and domains used in a campaign leveraging PeopleSoft-related lures.
Detects DNS queries and TLS SNI traffic directed towards the suspicious domain 'corp.tripswithengine.com', which is associated with the NeedyMantis malware C2 infrastructure.
Detects network activity associated with the NeedyMantis malware, specifically identifying C2 beaconing behavior. The rule looks for HTTPS GET requests to specific URI paths ('/library/zip/') with a WebSocket upgrade header and suspicious cookie patterns, as well as TLS SNI traffic targeting the hardcoded domain 'corp.tripswithengine.com'.
Detects network requests to known domains (acrobat-reader-installer.com, 03webzoominvite.us) masquerading as Microsoft Store resources to deliver malicious MSI installers. This activity is associated with RMM-based RAT deployment chains.
This rule monitors for indicators of compromise (IOCs) associated with the Lunex Malware-as-a-Service (MaaS) campaign. It aggregates telemetry from file creation, process execution, and network connections to identify the presence of known malicious hashes, C2 IP addresses, phishing-related domains, and specific payload URLs.
This rule detects network traffic originating from internal hosts to the domain 'msfconfig.icu'. It specifically monitors for GET requests to '/tmp/system.txt' and TLS connections using the same domain as an SNI, which are associated with the delivery of ClickFix XMRig miner payloads.
This rule detects HTTP GET requests to Vercel subdomains targeting a specific path (/secure.html). This behavior is characteristic of phishing campaigns, specifically those masquerading as RMM-related lures to trick users into providing access codes or credentials.
Detects anomalous network traffic associated with Vidar Stealer 2.0, where an HTTP GET request for a .jpg file is directed to a bare IP address, and the server's response header fails to indicate an image content type despite the requested file extension.
This rule detects known malicious activity including network connections to a specific C2 IP address (69.48.229.140), downloading files from specific C2 URLs, the presence of known malicious file hashes (SHA256), and communications involving specific actor-associated email addresses.
This rule detects a node.exe process initiating a network connection to a specific remote IP (69.48.229.140) on port 8080, followed by the termination of that same process within 45 seconds of the connection. This behavior is indicative of a short-lived beaconing process or an ephemeral network task associated with command-and-control activity.
Detects a suspicious sequence of events where a host performs multiple reconnaissance-style probes (health checks, documentation, or OpenAPI definitions) followed within 10 minutes by access to sensitive artifact-related URLs on the same remote host. This pattern is indicative of an attacker profiling a target server for metadata and then proceeding to exfiltrate files or sensitive artifacts.
This rule monitors for known malicious file hashes, command and control (C2) domains, and specific download URLs associated with identified threats. It correlates these indicators across process execution, file activity, and network connection logs to identify potential compromises or malicious activity related to the aware-cr1 infrastructure.
Detects outbound HTTP POST requests destined for 'aware-cr1.com' targeting the URI '/api/beacon', which is indicative of command-and-control (C2) communication associated with the 2CLoader malware.
Page 31 of 280