Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,879 detections
Filters
Last updated
All Time
Detection languages
2,954
1,378
313
289
239
Contributors
1,807
1,529
1,304
180
173
Categories
20,460
11,847
5,879
5,158
4,866
Platforms
3,747
1,857
1,076
782
160
Products / Services
2,241
1,434
1,273
746
582
MITRE Techniques
2,448
2,151
1,129
937
790
CVEs
19
15
9
7
5
IDS Classtypes
834
334
94
23
20
IDS Protocols
689
276
235
117
23
This rule monitors for known malicious file hashes, IP addresses, C2 domains, and specific URL markers associated with identified threat activity. It consolidates multiple detection vectors including file activity, process execution, network connections, and DNS queries to identify compromised devices communicating with attacker-controlled infrastructure.
This rule detects potential malicious activity by correlating device events against a known set of malicious file hashes, domains, and URLs. It identifies files with known malicious hashes, network connections to known malicious domains, and command-line processes attempting to download files from known malicious URLs using common living-off-the-land tools like PowerShell, curl, or wget.
Detects the exfiltration behavior of the Sauron Loader, where a process tree associated with rnpkeys.exe or its modules (rnp.dll, tdwp.dll) within the C:\ProgramData\keyroll directory performs a burst of numerous small HTTPS POST requests to a single destination. This pattern is characteristic of a screenshot image being fragmented into small chunks and exfiltrated.
Detects the execution of suspected Sauron Loader components staged in C:\ProgramData\keyroll\ (rnpkeys.exe or tdwp.dll) followed by an outbound network connection from the same host within a 2-minute window. This behavior correlates the staging of malicious binaries with the loader's automated outbound registration attempt.
Detects the execution of suspected Sauron Loader components staged in C:\ProgramData\keyroll\ (rnpkeys.exe or tdwp.dll) followed by an outbound network connection from the same host within a 2-minute window. This behavior correlates the staging of malicious binaries with the loader's automated outbound registration attempt.
Detects the execution of rnpkeys.exe from a specific path, followed by the loading of expected DLLs (rnp.dll or tdwp.dll) from the same directory, and a subsequent network connection on port 443. This behavior pattern is consistent with DLL side-loading used to establish a network-based command and control channel.
Detects periodic outbound network connections from rnpkeys.exe characteristic of the Sauron Loader C2 beaconing. The rule identifies a consistent heartbeat pattern (approx. 600 seconds) between successful C2 polls to the same remote host, distinguishing it from typical user-driven browser traffic.
IOC sweep against network telemetry for confirmed BengalSEO/MayaBot campaign infrastructure: the Hostmaza backend IP (5.101.140.80), Matomo tracking domains (stats.us3.org, us3.my), named MayaBot C2 domains (cus.cam, dll.lat, us99.org), and the ~170-domain Traffic Distribution System redirector fleet used to funnel victims to payload delivery. The source intel report contains no file hashes (MD5/SHA1/SHA256) -- only IPs, domains, and URLs -- so this sweep is IP/domain-only. Note the much larger corpus of single-use lure-page domains (~1,000 additional indicators) is excluded as too high-churn for static embedding.
Detects HTTP(S) requests to known SideCopy/ReverseRAT payload-delivery URLs identified in Operation SideCopy spear-phishing campaigns targeting Indian academia.
Detects network connections to known SideCopy/ReverseRAT command-and-control infrastructure, including a static C2 IP address and two C2/hosting domains (matched exactly and as proper subdomains to avoid substring false positives).
Detects HTTP POST requests characteristic of TrickBot C2 beaconing. The rule identifies specific URI structures, Content-Type headers set to 'application/octet-stream', and unique request body behaviors that are indicative of TrickBot communication patterns.
Detects the execution of known NTLM Certificate Enrollment Service (CES) relay tools alongside subsequent outbound network connections to Active Directory Certificate Services (AD CS) CES enrollment endpoints. This behavioral pattern indicates an adversary attempting to relay NTLM authentication to an AD CS server to request a certificate, typically for privilege escalation or persistence.
Detects the execution of known NTLM Certificate Enrollment Service (CES) relay tools alongside subsequent outbound network connections to Active Directory Certificate Services (AD CS) CES enrollment endpoints. This behavioral pattern indicates an adversary attempting to relay NTLM authentication to an AD CS server to request a certificate, typically for privilege escalation or persistence.
This rule monitors for network connections to known malicious domains or IP addresses, and for the presence or execution of files with known malicious file hashes (MD5, SHA1, SHA256). It consolidates detections from network traffic, file events, and process execution logs over a 30-day lookback period.
This rule monitors for network connections to known malicious domains or IP addresses, and for the presence or execution of files with known malicious file hashes (MD5, SHA1, SHA256). It consolidates detections from network traffic, file events, and process execution logs over a 30-day lookback period.
This rule monitors for network connections to known malicious domains or IP addresses, and for the presence or execution of files with known malicious file hashes (MD5, SHA1, SHA256). It consolidates detections from network traffic, file events, and process execution logs over a 30-day lookback period.
Detects outbound HTTP GET requests where the user agent is set to 'WebClient' and the URI ends in '.ps1'. This behavior is characteristic of PowerShell download cradles, which are often used by adversaries to fetch and execute remote malicious scripts directly into memory.
Detects network connection attempts to known typosquatted domains (thecovnresation.com/net) commonly associated with the CLEANGULP malware beaconing activity, specifically targeting the /beacon/pre-register URI path.
Detects anomalous HTTP POST requests to a suspected C2 endpoint ('/beacon/pre-register') on a typosquatted domain ('thecovnresation') characterized by an application/octet-stream content type, which is indicative of encrypted C2 beacon registration activity.
Detects instances where package management tools (pip, npm, docker) spawn child processes that immediately attempt to read sensitive files (SSH keys, cloud/container credentials) or perform outbound network connections. This behavior is indicative of a trojanized supply-chain package executing malicious post-install logic to exfiltrate secrets or establish initial communication with a C2 server.
Detects outbound HTTP/HTTPS POST requests where the URI, query string, or path contains evidence of sensitive credential material, such as AWS access keys, private key blocks, or common environment variable patterns, indicative of potential credential harvesting and exfiltration to an external destination.
Page 53 of 280