Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,879 detections
Filters
Last updated
All Time
Detection languages
2,954
1,378
313
289
239
Contributors
1,807
1,529
1,304
180
173
Categories
20,460
11,847
5,879
5,158
4,866
Platforms
3,747
1,857
1,076
782
160
Products / Services
2,241
1,434
1,273
746
582
MITRE Techniques
2,448
2,151
1,129
937
790
CVEs
19
15
9
7
5
IDS Classtypes
834
334
94
23
20
IDS Protocols
689
276
235
117
23
Detects P7 DarkSword implant C2 beaconing: HTTP/1.0 JSON POSTs to /beacon, /event or /a with the hardcoded iPhone OS 18_5 Safari 18.5 User-Agent. Requires the full combination of protocol version, method, URI, UA and content type, and alerts only after 3 matching requests from one source within 120 seconds (detection_filter) to suppress one-off matches.
Detects endpoint connections to known DarkSword/Coruna exploit-host and C2 infrastructure. The shared AWS IP is only matched on C2 ports 8881/8882 to reduce collateral hits.
Detects devices reaching P7 DarkSword exploit-delivery hosts (cdn/js.gotoiphone.com, mzpo30.cam) and the agdx53.cc C2, with delivery-then-C2 chaining surfaced as the highest-confidence match. Matching is limited to the exact listed hosts and successful/attempted connection events.
Correlates ARTEX tool artifacts on a device with that device contacting the ARTEX host, xcai.pro, or the DeepSeek API within 24 hours.
This rule monitors for known malicious file hashes, command and control (C2) domains, and specific download URLs associated with identified threats. It correlates these indicators across process execution, file activity, and network connection logs to identify potential compromises or malicious activity related to the aware-cr1 infrastructure.
Detects HTTP, TLS, DNS, and TCP communication with known AhsayCBS campaign infrastructure and Alibaba OSS storage buckets used for payload delivery.
Detects DNS lookups, TLS connections, and network traffic associated with the PoeLLM cryptominer communicating with Kryptex mining pools, as well as Stratum mining protocol login attempts.
This rule detects successful network connections to known malicious IP addresses or the domain 'forgitlab.com', which are associated with the Azazel malware threat infrastructure.
Detects connections from internal hosts to the ARTEX-linked actor host 38.244.50.120, including requests for the exposed .claude/CLAUDE.md file and its open-directory port 18899.
Detects endpoint and network activity matching known Indicators of Compromise (IOCs) associated with BPFDoor, AVERAT, and Rekoobe backdoors based on Rapid7 research. The query checks for specific file hashes, IP addresses, and domain names across process, file, image load, network, and DNS events.
Detects outbound SMTP traffic associated withAVERAT malware, tracking the EHLO sequence, STARTTLS command negotiation, server acceptance, and subsequent custom TLS ClientHello patterns on port 25.
Detects outbound SMTP traffic associated withAVERAT malware, tracking the EHLO sequence, STARTTLS command negotiation, server acceptance, and subsequent custom TLS ClientHello patterns on port 25.
Detects HTTP responses and TLS client connections associated with Adobe-themed device code phishing lure pages hosted on workers.dev, utilizing specific patterns and keywords such as 'Confirm to open document', 'VERIFICATION CODE', and long hyphenated domain structures.
Detects potential remote shell behavior where a process named libgcrypt establishes an outbound connection on TCP port 9999 and spawns a shell (such as sh, bash, dash, zsh, or ash) within a short time window.
This rule detects network communication, DNS queries, email interactions, and URL clicks associated with known TA419 threat actor infrastructure. It monitors multiple telemetry sources to identify indicators of compromise (IOCs) such as specific domains, IP addresses, and email addresses.
This analytic detects the usage of the Utility osascript on a macOS device initiated a network connection lasting longer than 10 minutes (600 seconds).
Adversaries may abuse osascript and AppleScript shell execution to establish long-lived command-and-control or remote connections.
Adversaries may abuse osascript and AppleScript shell execution to establish long-lived command-and-control or remote connections.
Detects outbound network traffic matching XMRig Monero cryptocurrency miner stratum login behavior originating from an internal host.
Detects HTTP, TLS, DNS, and TCP communication with known AhsayCBS campaign infrastructure and Alibaba OSS storage buckets used for payload delivery.
IOC sweep for P7 DarkSword / Coruna: known file hashes, C2/exploit-host IPs, domains and URLs against Defender device file and network events. Tightened to public IPs, connection action types, exact hosts/subdomains and path-qualified URLs; the shared AWS IP is only matched with its C2 port.
IOC sweep for P7 DarkSword / Coruna: known file hashes, C2/exploit-host IPs, domains and URLs against Defender device file and network events. Tightened to public IPs, connection action types, exact hosts/subdomains and path-qualified URLs; the shared AWS IP is only matched with its C2 port.
IOC sweep for P7 DarkSword / Coruna: known file hashes, C2/exploit-host IPs, domains and URLs against Defender device file and network events. Tightened to public IPs, connection action types, exact hosts/subdomains and path-qualified URLs; the shared AWS IP is only matched with its C2 port.
Page 6 of 280