Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,879 detections
Filters
Last updated
All Time
Detection languages
2,954
1,378
313
289
239
Contributors
1,807
1,529
1,304
180
173
Categories
20,460
11,847
5,879
5,158
4,866
Platforms
3,747
1,857
1,076
782
160
Products / Services
2,241
1,434
1,273
746
582
MITRE Techniques
2,448
2,151
1,129
937
790
CVEs
19
15
9
7
5
IDS Classtypes
834
334
94
23
20
IDS Protocols
689
276
235
117
23
This rule detects the Kothamine dropper chain by correlating network connections or command-line activity fetching payloads from a specific GitHub repository ('cphc811-ui/new-tails') with the subsequent creation of associated malicious files (e.g., tailscale-related binaries, injector DLLs) on the same host within a one-hour window.
This rule monitors network connections initiated by common web browsers (chrome.exe, msedge.exe, brave.exe) to known domains associated with a specific VPN proxy service or subscription-based proxy farm infrastructure. The rule flags endpoints communicating with URLs involved in proxy beaconing, fallback hosting, and subscription API calls.
Detects browser-side network activity involving known command-and-control or subscription API domains associated with a malicious VPN browser extension proxy campaign. The rule monitors for beaconing behavior from popular web browsers (Chrome, Edge, Brave) to specific domains utilized by the campaign.
Detects network connection attempts to known typosquatted domains (thecovnresation.com/net) commonly associated with the CLEANGULP malware beaconing activity, specifically targeting the /beacon/pre-register URI path.
Detects network connection attempts to known typosquatted domains (thecovnresation.com/net) commonly associated with the CLEANGULP malware beaconing activity, specifically targeting the /beacon/pre-register URI path.
Detects outbound network connections to known SectopRAT C2 infrastructure, specifically targeting the hardcoded IP 98.142.252.140 or the non-standard port 15847 often used for encrypted exfiltration.
Detects the ReportDump.exe process initiating a network connection on port 15847 followed by the loading of GDI/User32 libraries shortly thereafter. This behavior is indicative of SectopRAT establishing a command-and-control channel and initializing screen capture capabilities.
Detects host-based activity or network communication associated with the SloppyRAT remote access trojan. The rule monitors for specific malicious file hashes and connection attempts to known C2 IP addresses and domains.
This rule detects potential malicious activity by matching endpoint file events against a known list of malicious file hashes (SHA256, SHA1, MD5) and monitoring for connections to known malicious domains or URLs.
Detects anomalous DNS query patterns originating from AI agent hosts that are characteristic of DNS tunneling, such as the use of TXT or NULL records and excessively long subdomain labels. These techniques are often used by attackers to establish covert Command and Control (C2) channels and exfiltrate data by bypassing traditional HTTP/HTTPS egress filtering.
Detects outbound HTTP POST requests from an AI agent runtime environment to known external paste-sites, webhook providers, or staging services. This behavior is indicative of a compromise where the AI agent is being manipulated to exfiltrate sensitive API keys, tokens, or configuration secrets to an attacker-controlled endpoint.
Detects anomalous AI agent behavior where the agent ingests untrusted external content (e.g., tool outputs, RAG retrievals, or web fetches) and subsequently invokes high-risk or sensitive capabilities (such as shell execution, secret reading, or unauthorized network calls) within the same session. This pattern is indicative of an indirect prompt injection attack attempting to leverage the agent's internal tool-calling mechanisms for unauthorized actions.
Detects anomalous AI agent behavior where the agent ingests untrusted external content (e.g., tool outputs, RAG retrievals, or web fetches) and subsequently invokes high-risk or sensitive capabilities (such as shell execution, secret reading, or unauthorized network calls) within the same session. This pattern is indicative of an indirect prompt injection attack attempting to leverage the agent's internal tool-calling mechanisms for unauthorized actions.
Detects the Graphalgo Go-based remote access trojan (RAT) sending an initial system report containing device and user information to the Slack API. This activity occurs during the initial check-in phase before establishing a primary command and control channel.
Detects the initialization of cloud synchronization tools like rclone or MEGAsync, accompanied by the creation of configuration files and subsequent high-volume network activity directed toward common cloud storage providers, indicative of unauthorized data exfiltration.
Detects network activity associated with NetSupport Manager remote access software, specifically monitoring for connections to known malicious domains and infrastructure, as well as recurring beaconing patterns indicative of command-and-control behavior.
Detects instances where the system DNS process (dns.exe) on a domain controller performs recursive DNS resolution towards a set of external IP addresses associated with suspicious infrastructure (AS202412). The rule correlates this activity with recent network connections from common web browsers or system utilities (msedge.exe, svchost.exe) on the same host to identify potential proxying of malicious DNS queries.
This rule detects potentially malicious activity involving the execution of Node.js scripts initiated by system script proxies (wscript, cscript, msiexec) within specific paths, often associated with subsequent installation of VBScript agents or direct network communication with a known command-and-control IP address.
Detects network communication to specific Gusercontent endpoints consistent with malicious browser extensions exfiltrating captured session tokens or cookies. The rule monitors for POST requests containing parameters like leadId, email, and data, often used to transmit stolen authentication material.
This rule detects potential AI/ML supply chain compromise by monitoring for package installations (via pip, conda, poetry, etc.) from non-standard repositories, direct URLs, or version control systems within data science and CI/CD pipelines (e.g., Jupyter, Airflow, Jenkins). It further correlates this activity with subsequent suspicious outbound network connections from the host, which is indicative of slopsquatting or malicious dependency execution.
Detects a sequence of potentially malicious activity involving the bulk reading or downloading of sensitive AI-related artifacts (model files, datasets), followed by the staging of these files into a compressed archive, and finally an outbound network transfer to an external IP address. This behavior pattern is indicative of data exfiltration of intellectual property.
Page 45 of 280