Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,879 detections
Filters
Last updated
All Time
Detection languages
2,954
1,378
313
289
239
Contributors
1,807
1,529
1,304
180
173
Categories
20,460
11,847
5,879
5,158
4,866
Platforms
3,747
1,857
1,076
782
160
Products / Services
2,241
1,434
1,273
746
582
MITRE Techniques
2,448
2,151
1,129
937
790
CVEs
19
15
9
7
5
IDS Classtypes
834
334
94
23
20
IDS Protocols
689
276
235
117
23
Detects network communication with known malicious domains and IP addresses, as well as the presence of known malicious file hashes on the system. The rule correlates network connection events, file creation events, and process creation events against predefined lists of C2 infrastructure and malware indicators.
Detects network traffic directed towards Telegram shortened URLs (t.me) which is a common command-and-control (C2) communication channel used by Vidar and other malware families to exfiltrate data or retrieve instructions.
Detects network activity associated with the ErrTraffic malware, specifically targeting JSON-RPC 'eth_call' requests to Polygon blockchain smart contracts used for C2 resolution and subsequent DNS queries to known malicious domains used for C2 infrastructure.
Detects outbound network traffic from internal hosts to known IP addresses associated with Exvicy Malware-as-a-Service (MaaS) Command and Control (C2) or hosting infrastructure. This rule acts as an indicator of compromise (IOC) match to identify potential infected hosts communicating with malicious external servers.
This rule detects DNS queries, TLS Server Name Indication (SNI) lookups, and HTTP Host header requests directed towards a list of known domains associated with 'Exvicy' malicious activities (lure domains).
This rule detects a raw TCP authentication handshake associated with the VelvetCake malware family. It specifically monitors for established connections to a known malicious C2 IP address (111.92.246.145) over port 12345 containing the specific hardcoded 'PASSWORD' string used for initial communication.
Detects outbound HTTP POST requests associated with the VelvetCake malware and Konni threat actor to the command-and-control (C2) domain 'medianewsonline.com'. The rule matches specific URI patterns ('/logout.php') and query parameters ('OKey=', 'Who=', 'Areyou=') commonly used for reconnaissance and data exfiltration.
Detects RevStealer malware attempting to use blockchain infrastructure for C2 communication or failover. The rules identify specific 'eth_call' JSON-RPC method calls to Polygon smart contracts containing hardcoded indicators, as well as TLS connections to known public RPC providers used as fallback C2 infrastructure.
This rule monitors for a variety of indicators associated with malicious activity, including connections to known malicious IP addresses, the presence of specific malicious file hashes or filenames, modifications to Windows system policies (specifically Legal Notice configuration), and changes to Active Directory Group Policy Objects using specified GUIDs.
This rule detects network connections from internal devices to a list of known malicious domains and IP addresses. These indicators are commonly associated with command and control (C2) infrastructure or malicious activity, and alerting on these connections can help identify compromised systems within the environment.
The following analytic detects potential data exfiltration using plain HTTP POST requests. It leverages network traffic logs, specifically monitoring the `stream_http` data source for POST methods containing suspicious form data such as "wermgr.exe" or "svchost.exe". This activity is significant because it is commonly associated with malware like Trickbot, trojans, keyloggers, or APT adversaries, which use plain text HTTP POST requests to communicate with remote C2 servers. If confirmed malicious, this activity could lead to unauthorized data exfiltration, compromising sensitive information and potentially leading to further network infiltration.
This rule monitors for execution of suspicious files or processes and network communication associated with known malicious indicators (hashes, domains, and IP addresses) typically used by specific threat actors for command and control (C2) and payload delivery.
This rule monitors for execution of suspicious files or processes and network communication associated with known malicious indicators (hashes, domains, and IP addresses) typically used by specific threat actors for command and control (C2) and payload delivery.
This rule monitors for execution of suspicious files or processes and network communication associated with known malicious indicators (hashes, domains, and IP addresses) typically used by specific threat actors for command and control (C2) and payload delivery.
This rule identifies suspicious command and control (C2) activity by monitoring network connections to specific known malicious domains, detection of specific authentication tokens in process command lines, and the use of spoofed User-Agent strings associated with predefined C2 URI paths.
This rule identifies suspicious command and control (C2) activity by monitoring network connections to specific known malicious domains, detection of specific authentication tokens in process command lines, and the use of spoofed User-Agent strings associated with predefined C2 URI paths.
This rule identifies suspicious command and control (C2) activity by monitoring network connections to specific known malicious domains, detection of specific authentication tokens in process command lines, and the use of spoofed User-Agent strings associated with predefined C2 URI paths.
This rule monitors for network connections and process activities associated with known malicious indicators, including file hashes, C2 IP addresses, domains, and specific URLs. It maps these activities to identify potential command and control communication or other malicious network activity occurring on endpoints.
This rule monitors for network connections and process activities associated with known malicious indicators, including file hashes, C2 IP addresses, domains, and specific URLs. It maps these activities to identify potential command and control communication or other malicious network activity occurring on endpoints.
This rule monitors for network connections and process activities associated with known malicious indicators, including file hashes, C2 IP addresses, domains, and specific URLs. It maps these activities to identify potential command and control communication or other malicious network activity occurring on endpoints.
Detects outbound TCP traffic originating from the internal network destined for a known RMRLX RAT command and control (C2) server on port 4561. This signature identifies the client-side 'hello' beaconing behavior characteristic of this specific malware.
Page 62 of 280