Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,879 detections
Filters
Last updated
All Time
Detection languages
2,954
1,378
313
289
239
Contributors
1,807
1,529
1,304
180
173
Categories
20,460
11,847
5,879
5,158
4,866
Platforms
3,747
1,857
1,076
782
160
Products / Services
2,241
1,434
1,273
746
582
MITRE Techniques
2,448
2,151
1,129
937
790
CVEs
19
15
9
7
5
IDS Classtypes
834
334
94
23
20
IDS Protocols
689
276
235
117
23
Detects network activity associated with NetSupport Manager remote access software, specifically targeting DNS lookups, TLS SNI connections, and direct TCP beaconing to a known-malicious infrastructure IP. This rule is designed to identify unauthorized use of legitimate remote support tools for command and control purposes.
This rule detects network traffic indicative of the SCKIT MemTensor worm establishing a command-and-control (C2) beacon. The detection identifies TLS connections where the Server Name Indication (SNI) matches a specific pattern of a 12-character hexadecimal string followed by .skyleen.fr.
Detects network activity associated with the GHAPPIER implant beaconing to a hardcoded command and control (C2) server. The rule monitors for established TCP connections on port 15152 that contain specific JSON status indicators and the string 'ghappier' in the payload, which are characteristic of this malware's communication protocol.
Detects network beaconing activity from suspicious processes that masquerade as macOS system services, specifically filtered to only trigger when an active Cursor IDE session is detected on the host. This behavior correlates network-based C2 activity with an active development environment, potentially indicating an adversary using legitimate IDE sessions to blend in or exfiltrate development-related data.
This rule detects the execution of known lateral movement tools, including Impacket suite components and NetExec (formerly CrackMapExec), by monitoring process command lines. It specifically flags tools such as psexec.py, wmiexec.py, and secretsdump.py, which are frequently used for remote execution and credential dumping. The rule also joins these process events with network events targeting SMB port 445 to correlate tool usage with potential lateral movement activity.
This rule detects the execution of known lateral movement tools, including Impacket suite components and NetExec (formerly CrackMapExec), by monitoring process command lines. It specifically flags tools such as psexec.py, wmiexec.py, and secretsdump.py, which are frequently used for remote execution and credential dumping. The rule also joins these process events with network events targeting SMB port 445 to correlate tool usage with potential lateral movement activity.
This rule detects the execution of known lateral movement tools, including Impacket suite components and NetExec (formerly CrackMapExec), by monitoring process command lines. It specifically flags tools such as psexec.py, wmiexec.py, and secretsdump.py, which are frequently used for remote execution and credential dumping. The rule also joins these process events with network events targeting SMB port 445 to correlate tool usage with potential lateral movement activity.
Detects file, process, and network activity associated with the TraderTraitor/KelpDAO malware campaign based on known hashes, filenames, paths, and C2 infrastructure.
Detects file, process, and network activity associated with the TraderTraitor/KelpDAO malware campaign based on known hashes, filenames, paths, and C2 infrastructure.
Detects instances where the system DNS process (dns.exe) on a domain controller performs recursive DNS resolution towards a set of external IP addresses associated with suspicious infrastructure (AS202412). The rule correlates this activity with recent network connections from common web browsers or system utilities (msedge.exe, svchost.exe) on the same host to identify potential proxying of malicious DNS queries.
Detects a suspicious sequence where Microsoft Outlook launches Microsoft Edge to open a URL, and that browser process subsequently makes network connections to infrastructure associated with the ClickFix phishing campaign (e.g., rsvpopenh.one or specific malicious IP).
Detects instances where the system DNS process (dns.exe) on a domain controller performs recursive DNS resolution towards a set of external IP addresses associated with suspicious infrastructure (AS202412). The rule correlates this activity with recent network connections from common web browsers or system utilities (msedge.exe, svchost.exe) on the same host to identify potential proxying of malicious DNS queries.
This rule detects network connections from monitored devices to known cryptomining pool IP addresses and domain names. It monitors DeviceNetworkEvents for indicators of compromise (IOCs) associated with cryptomining activities, identifying potential resource hijacking on internal endpoints.
This rule detects network connections from monitored devices to known cryptomining pool IP addresses and domain names. It monitors DeviceNetworkEvents for indicators of compromise (IOCs) associated with cryptomining activities, identifying potential resource hijacking on internal endpoints.
This rule identifies non-browser processes (and those not originating from standard installation directories of common browsers) that exhibit persistent, repeated network connections to the OpenAI API. This pattern is indicative of potential C2 traffic, where adversaries abuse the OpenAI Assistants API as a covert communication channel (e.g., SesameOp).
Detects outbound HTTP GET requests containing a .ps1 file extension in the URI, originating from a host without a specified User-Agent, and targeting domains other than Microsoft or Windows Update. This pattern is characteristic of a persistence mechanism executing a PowerShell script to download a secondary payload (e.g., via Net.WebClient).
Detects unauthorized processes (non-browser) reading sensitive browser session and credential files (e.g., Cookies, Login Data) across multiple user profiles, followed by immediate outbound network connections. This behavior is highly characteristic of commodity information stealers (e.g., LummaC2, Stealc, Vidar) attempting to exfiltrate browser-stored credentials and session data.
Detects network connections from common web browsers to domains associated with the BragJack threat actor infrastructure. This activity potentially indicates an end-user accessing malicious sites used for credential harvesting, malware delivery, or C2 communication.
Detects outbound network requests to OpenAI Assistants API endpoints (threads, assistants, runs) that do not originate from common web browsers. This activity may indicate malicious usage of AI services, such as command and control communication via AI agents or automated exfiltration scripts, as opposed to legitimate user-initiated browsing.
Detects repeated TLS connections to a known suspicious IP address that masquerades as gitlab.com using the TLS Server Name Indication (SNI) extension. This pattern is indicative of potential command and control (C2) traffic from compromised or unauthorized GitRunner infrastructure.
Detects outbound network traffic to Microsoft Graph API originating from a user-agent string identified as 'python-httpx'. This behavior is characteristic of automated scripts or malicious tools using Python libraries to interact with Microsoft cloud services, potentially for data exfiltration or unauthorized API interaction.
Page 68 of 280