Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,879 detections
Filters
Last updated
All Time
Detection languages
2,954
1,378
313
289
239
Contributors
1,807
1,529
1,304
180
173
Categories
20,460
11,847
5,879
5,158
4,866
Platforms
3,747
1,857
1,076
782
160
Products / Services
2,241
1,434
1,273
746
582
MITRE Techniques
2,448
2,151
1,129
937
790
CVEs
19
15
9
7
5
IDS Classtypes
834
334
94
23
20
IDS Protocols
689
276
235
117
23
Detects HTTP and TLS traffic patterns indicative of data exfiltration to Slack, specifically targeting hardcoded Slack API tokens, Slack channel IDs in HTTP request bodies, or traffic directed to hooks.slack.com, commonly associated with malicious npm packages.
Detects Node.js processes executing system-level reconnaissance (e.g., CPU, memory, hostname, uptime enumeration) followed by network connections to known exfiltration endpoints (Slack, Telegram API). This behavior aligns with identified npm malware campaigns using host fingerprinting for target selection and data exfiltration.
This rule detects potential command and control (C2) activity where a non-browser or non-Telegram application initiates network connections to the Telegram Bot API within 24 hours of a new entry being created in the Windows Registry Run key. This combination suggests a persistence mechanism combined with a C2 channel.
Detects network traffic from internal hosts interacting with Ethereum Sepolia testnet contracts via common blockchain infrastructure providers (Alchemy, Infura) or JSON-RPC calls. These patterns are characteristic of 'indexed-btree' malware utilizing decentralized blockchain technology for command-and-control polling.
Detects outbound network connections (HTTP/TLS) from internal hosts to a known malicious IP address associated with Adversary-in-the-Middle (AiTM) phishing infrastructure, specifically targeting Microsoft 365 credential and session cookie theft.
Detects outbound network connections (HTTP/TLS) from internal hosts to a known malicious IP address associated with Adversary-in-the-Middle (AiTM) phishing infrastructure, specifically targeting Microsoft 365 credential and session cookie theft.
Detects the use of common command-line tools (curl, wget, python, etc.) to interact with known cloud provider metadata service IP addresses or URL paths, often performed by shell processes. This behavior is frequently associated with initial reconnaissance or attempts to steal identity tokens from cloud-based virtual machines.
This rule monitors for network connections to known malicious domains and IP addresses, as well as the presence or execution of files with specific SHA256 hashes known to be associated with threat activity. The indicators focus on Vercel-hosted domains and specific file hashes linked to recent campaign activity.
This rule monitors for network connections to known malicious domains and IP addresses, as well as the presence or execution of files with specific SHA256 hashes known to be associated with threat activity. The indicators focus on Vercel-hosted domains and specific file hashes linked to recent campaign activity.
This rule monitors for network connections to known malicious domains and IP addresses, as well as the presence or execution of files with specific SHA256 hashes known to be associated with threat activity. The indicators focus on Vercel-hosted domains and specific file hashes linked to recent campaign activity.
Detects a suspicious Node.js process pattern characterized by the execution of 'sharedLoad.min.js' or detached child processes, followed by rapid outbound network communication to known messaging platforms (Slack, Telegram). This behavior is indicative of the indexed-btree malware family, which exfiltrates host fingerprint data including architecture, hostname, and system metrics.
Detects network traffic exhibiting beaconing patterns to 'dl.google.com' that may be indicative of Xray-core C2 tunneling disguised as legitimate Google traffic. The rule uses a threshold to identify consistent connection attempts.
Detects instances of MSBuild.exe executing from within the Microsoft.NET framework directory while initiating outbound network connections to a specific known command-and-control (C2) IP address associated with rmrlx infrastructure, or standalone network activity matching these parameters.
Detects instances of MSBuild.exe executing from within the Microsoft.NET framework directory while initiating outbound network connections to a specific known command-and-control (C2) IP address associated with rmrlx infrastructure, or standalone network activity matching these parameters.
Detects DNS queries for randomized subdomains (8-12 character alphanumeric labels) prepended to specific thematic .de parent domains. This pattern is characteristic of phishing infrastructure rotation and device-code phishing campaigns where adversaries dynamically generate domains to evade detection.
Detection of known Cloudflare Workers subdomains used as dead-drop resolvers for C2 communication by the QUICSILVER QUICAgent malware. The rule monitors for specific DNS queries to resolve these domains and subsequent HTTP GET requests used to retrieve C2 instructions.
Detects the creation or modification of a file named '.Outlook' within the AppData or AppData\Roaming folders, followed by network communication to known malicious domains or IP addresses by a process other than outlook.exe within a 30-minute window. This behavior is indicative of potential malware staging or command-and-control communication.
Detects outbound network traffic from internal hosts to known ClickFix campaign command-and-control infrastructure, identified by specific malicious domains (grandenoid.org, mootornot.com) and associated IP addresses.
Detects network traffic consistent with the x47.c bot performing a SOCKS5 reverse-proxy handshake to a command-and-control (C2) server. The rule triggers on the specific 'REVERSE_PROXY|' string signature within established outbound TCP connections.
Detects the execution of the Chisel C2 tool by matching its unique command-line grammar, specifically the 'client' subcommand combined with reverse remote ('R:') configurations. This detection strategy is resilient against binary renaming and infrastructure rotation by focusing on the tool's required argument structure rather than static IOCs like filenames or C2 addresses. It is specifically useful for identifying unauthorized remote tunnels used for persistence and data exfiltration.
This rule detects potential malicious activity by correlating device events against a known set of malicious file hashes, domains, and URLs. It identifies files with known malicious hashes, network connections to known malicious domains, and command-line processes attempting to download files from known malicious URLs using common living-off-the-land tools like PowerShell, curl, or wget.
Page 69 of 280