Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,879 detections
Filters
Last updated
All Time
Detection languages
2,954
1,378
313
289
239
Contributors
1,807
1,529
1,304
180
173
Categories
20,460
11,847
5,879
5,158
4,866
Platforms
3,747
1,857
1,076
782
160
Products / Services
2,241
1,434
1,273
746
582
MITRE Techniques
2,448
2,151
1,129
937
790
CVEs
19
15
9
7
5
IDS Classtypes
834
334
94
23
20
IDS Protocols
689
276
235
117
23
Detects a multi-stage network communication pattern characteristic of agent sandbox evasion and subsequent data exfiltration. The rule first identifies an unusual volume of connections to URL-shorteners using encoded fragments in the URI, and subsequently flags calls to common screenshot or rendering services containing 'url=' parameters, suggesting possible pixel-based data exfiltration over a command and control channel.
Detects a multi-stage attack chain where an AI-agent's configuration file (e.g., mcp.json) is modified, followed immediately by the execution of a tool process (node/python) spawned by the agent, the subsequent spawning of a shell process, and finally an outbound network connection to a rare, non-standard domain. This sequence is indicative of AI agent tool poisoning, where malicious tool definitions are introduced to execute arbitrary commands and exfiltrate data. Coverts T1195.002, T1565.001, T1059
Detects network traffic consistent with a hardcoded C2 channel used by PolinRider or NullReceiver malware families. The rule monitors TCP traffic directed to a specific IP address (193.26.115.131) and port (15152) that contains serialized command/status structures formatted with specific JSON-like content patterns.
This rule detects internal users submitting potentially sensitive data to public generative AI applications (e.g., ChatGPT, Claude, Gemini) where Microsoft Purview DLP or a comparable inspection service has triggered a policy match. It correlates cloud application outbound signals with content inspection logs to identify high-risk exfiltration events while excluding sanctioned enterprise-licensed AI instances.
Detects network activity, including HTTP requests and TLS SNI traffic, directed towards the known GRIMWEDGE C2 domain 'ocr.opusaccel.top'. This includes monitoring for repeated polling behavior indicative of a command and control heartbeat mechanism.
Detects a network request to download a file named 'msgbox.exe' using the curl command-line utility, consistent with the activity observed from threat actor UTA0560 (GRIMWEDGE). This rule monitors for HTTP GET requests targeting the specific file path while the User-Agent string begins with 'curl/'.
Detects network indicators associated with the BambooToken C2 infrastructure, including DNS lookups for specific domains, TLS SNI mismatches, non-standard MQTT port usage, and specific command-and-control tasking keywords within MQTT payloads.
Detects periodic outbound network traffic to the Telegram Bot API (api.telegram.org) indicative of potential command and control (C2) beaconing, specifically monitoring for repeating connections over extended time intervals.
Detects outbound HTTP GET requests containing an 'auth=' parameter with a long string of alphanumeric characters, characteristic of an OAuth token exfiltration attempt by a malicious Twitch extension (JeetBot). The rule flags requests to external destinations that are not official Twitch, Twitch Video Network, or JTV domains.
Detects network traffic associated with the WallStealer malware, including the download of malicious payloads from a known C2 server, communication with a cryptominer C2, and the use of Steam Community profiles as dead-drop resolvers for C2 instructions.
Detects network communication associated with the Cyclops Blink modular malware, specifically targeting known Sandworm C2 IP addresses and non-standard ports used for firewall rule manipulation and C2 beaconing. The rule identifies both inbound and outbound traffic, including potential TLS handshakes on specific non-standard ports.
Detects network traffic associated with the RatHat Android RAT, specifically monitoring for HTTP and TLS connections to the command and control (C2) delivery domain 'kingbss.com', as well as detecting characteristic FRP (Fast Reverse Proxy) client login handshake patterns used for tunnel establishment.
Detects network communication associated with the Rapuncel MaaS (Malware-as-a-Service) campaign, specifically identifying the Command and Control (C2) connection, GitHub Pages-based redirect chains, and subsequent delivery of large, suspicious ZIP archives containing renamed executable/system files.
Detects instances where PowerShell scripts are executed via the Windows Task Scheduler from within potential staging directories (ProgramData with randomized folder names). The rule identifies execution that uses common PowerShell obfuscation flags (e.g., -EncodedCommand) and requires secondary hardening bypass flags (e.g., -WindowStyle hidden), followed by correlated network activity to a specific suspicious C2 domain.
Detects the execution of known NTLM Certificate Enrollment Service (CES) relay tools alongside subsequent outbound network connections to Active Directory Certificate Services (AD CS) CES enrollment endpoints. This behavioral pattern indicates an adversary attempting to relay NTLM authentication to an AD CS server to request a certificate, typically for privilege escalation or persistence.
Detects malicious network activity associated with TokenGrabber stealer malware, specifically identifying outbound HTTP requests to public IP lookup services (api.ipify.org) followed by chained geolocation lookups (ip-api.com). This behavior is characteristic of an initial reconnaissance phase where the malware determines the victim's external network footprint.
Detects a behavioral chain where a process establishes persistence using a 'WindowsUpdate' Registry Run key or a scheduled task, followed within five minutes by an outbound network connection from the same process. The rule specifically excludes cases where a ZIP file was written to disk, identifying potential in-memory staging for exfiltration.
Detects malicious network activity associated with TokenGrabber stealer malware, specifically identifying outbound HTTP requests to public IP lookup services (api.ipify.org) followed by chained geolocation lookups (ip-api.com). This behavior is characteristic of an initial reconnaissance phase where the malware determines the victim's external network footprint.
Detects HTTP responses containing SocGholish (FakeUpdates) malware delivery signatures. The rule monitors for a 200 HTTP status code, a content type of 'javascript', and the presence of the specific string 'NDSW' in the response body, which is a known indicator of the SocGholish JavaScript-based loader.
Detects outbound HTTP POST requests to known blockchain RPC endpoints (bsc-dataseed and rpc.ankr.com) that utilize the 'eth_call' method. This behavior is associated with the ClearFake malware strain using the EtherHiding technique, where malicious scripts or payloads are hidden or retrieved via blockchain smart contracts.
This rule monitors HTTP traffic for requests containing 'bp.dat', which is associated with the registration phase of the Latrodectus malware downloader. It detects both URI-based and request body-based attempts by an infected host to register with a command and control server.
Page 40 of 280