Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,879 detections
Filters
Last updated
All Time
Detection languages
2,954
1,378
313
289
239
Contributors
1,807
1,529
1,304
180
173
Categories
20,460
11,847
5,879
5,158
4,866
Platforms
3,747
1,857
1,076
782
160
Products / Services
2,241
1,434
1,273
746
582
MITRE Techniques
2,448
2,151
1,129
937
790
CVEs
19
15
9
7
5
IDS Classtypes
834
334
94
23
20
IDS Protocols
689
276
235
117
23
This rule detects network connections to specific domains and domain patterns that mimic legitimate entities (e.g., NinjaVan, EmiratesPost). The detection logic identifies direct matches to known malicious infrastructure and uses regular expressions to catch permutation-based typosquatting, which are common indicators of phishing or credential harvesting campaigns.
Detects the specific fingerprinting sequence associated with Mirage2FA AiTM phishing campaigns. The detection triggers when a process downloads a specific JavaScript loader from an '/xls/' path, followed closely within two minutes by an IP/geolocation lookup request to common services (api.ipify.org, api.country.is, api.ipgeolocation.io), which is a characteristic precursor to credential interception.
Detects HTTP beaconing activity characteristic of the OnyxC2 stealer malware, specifically identifying the synchronization command ('action=sync') containing hardcoded parameters for host identification and bot versioning.
Detects network traffic (DNS, TLS SNI, and HTTP Host headers) attempting to communicate with infrastructure associated with the EvilTokens Phishing-as-a-Service (PhaaS) platform. This activity is indicative of credential harvesting or adversary-in-the-middle (AiTM) attacks.
This rule performs a retrospective hunt for indicators of compromise (IOCs) associated with the ClosedQuorum malware. It identifies suspicious activity by matching against known file hashes, specific filenames, and network traffic directed towards services (such as DeepSeek, OpenRouter, Mistral, and Discord) which the malware uses for C2 or data exfiltration. The detection logic aggregates results from file system, process, and network telemetry.
Detects rapid, closely-spaced network requests from the Microsoft Edge process (msedge.exe) to Microsoft-hosted domains within a very short timeframe. This behavior is indicative of a race-condition exploitation technique (CVE-2026-55945) intended to manipulate the Edge AI agent's state transitions, specifically forcing it from 'think' mode into 'act' mode to facilitate unauthorized command injection.
This rule hunts for indicators associated with the TrustSink technique, which involves using rogue External Authentication Methods (EAM) or malicious OIDC providers to bypass authentication or maintain persistence within a cloud environment. It monitors Azure AD sign-in and audit logs, alongside DNS and network events, for references to known malicious domains and URLs used for EAM-based attacks.
This rule hunts for indicators associated with the TrustSink technique, which involves using rogue External Authentication Methods (EAM) or malicious OIDC providers to bypass authentication or maintain persistence within a cloud environment. It monitors Azure AD sign-in and audit logs, alongside DNS and network events, for references to known malicious domains and URLs used for EAM-based attacks.
This rule monitors for indicators of compromise (IOCs) associated with the Rapuncel/Cruciferra 'Bring Your Own Vulnerable Driver' (BYOVD) malware-as-a-service (MaaS) campaign. It detects malicious file hashes (associated with dropped binaries or drivers), connections to known malicious command-and-control (C2) IP addresses, and network requests to domains used by the infrastructure.
This rule identifies instances of screen capture events initiated by processes that have previously engaged in network communication with known Remote Management Tool (RMM) domains. By correlating network activity with suspicious endpoint events, it flags potential unauthorized screen scraping performed by tools often abused by attackers for post-compromise reconnaissance.
This rule detects potential unauthorized use of MeshAgent RMM software by correlating process execution events (mvtcs.exe, MeshAgent) with network traffic to specific IP addresses identified as associated with Settra command-and-control infrastructure. It specifically filters for MeshAgent activity and validates the threat by requiring an established network connection to known malicious endpoints.
This rule detects devices that have both accessed a specific suspicious external domain ('thefatshallot.com') and performed file operations involving HTML files or files containing 'chromecache' in their name within the same 24-hour period. This behavior pattern suggests a potential download of malicious web content or drive-by-download attempt where browser cache files are utilized for file staging or persistence.
This rule identifies potential activity related to the Kothamine malware by monitoring for specific file hashes associated with the malware in process and file execution events, as well as network connections to a specific malicious GitHub repository path used for payload delivery.
This rule detects unauthorized downloads of Tailscale VPN client binaries or related dependencies (such as wintun.dll) originating from a specific GitHub repository ('cphc811-ui'). Such activity is often associated with the Kothamine threat actor attempting to establish unauthorized remote access or command-and-control channels by provisioning VPN software on compromised hosts.
This rule detects unauthorized downloads of Tailscale VPN client binaries or related dependencies (such as wintun.dll) originating from a specific GitHub repository ('cphc811-ui'). Such activity is often associated with the Kothamine threat actor attempting to establish unauthorized remote access or command-and-control channels by provisioning VPN software on compromised hosts.
This rule detects unauthorized downloads of Tailscale VPN client binaries or related dependencies (such as wintun.dll) originating from a specific GitHub repository ('cphc811-ui'). Such activity is often associated with the Kothamine threat actor attempting to establish unauthorized remote access or command-and-control channels by provisioning VPN software on compromised hosts.
This rule detects unauthorized downloads of Tailscale VPN client binaries or related dependencies (such as wintun.dll) originating from a specific GitHub repository ('cphc811-ui'). Such activity is often associated with the Kothamine threat actor attempting to establish unauthorized remote access or command-and-control channels by provisioning VPN software on compromised hosts.
This rule detects anomalies in outbound network data transfer by comparing the current daily volume of data sent to external, non-private IP addresses against the historical average for those specific sources. It alerts when the daily volume exceeds 500MB and shows a significant spike (3x or more) compared to historical baseline data or when no historical data is available for a new source connection.
This rule monitors for a variety of indicators associated with malicious activity, including connections to known malicious IP addresses, the presence of specific malicious file hashes or filenames, modifications to Windows system policies (specifically Legal Notice configuration), and changes to Active Directory Group Policy Objects using specified GUIDs.
Detects outbound TCP traffic originating from internal hosts to known command and control infrastructure associated with the SilkParasite campaign and the SpiceRAT malware family.
Detects outbound TCP traffic originating from internal hosts to known command and control infrastructure associated with the SilkParasite campaign and the SpiceRAT malware family.
Page 72 of 280