Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,879 detections
Filters
Last updated
All Time
Detection languages
2,954
1,378
313
289
239
Contributors
1,807
1,529
1,304
180
173
Categories
20,460
11,847
5,879
5,158
4,866
Platforms
3,747
1,857
1,076
782
160
Products / Services
2,241
1,434
1,273
746
582
MITRE Techniques
2,448
2,151
1,129
937
790
CVEs
19
15
9
7
5
IDS Classtypes
834
334
94
23
20
IDS Protocols
689
276
235
117
23
Detects instances where a single process on a device communicates with two or more distinct hosted LLM provider APIs (OpenAI, Anthropic, DeepSeek, Google) within a 24-hour window. This behavior is indicative of multi-model orchestration or 'consensus' techniques, which may be employed by sophisticated implants for automated tasking, data processing, or evasion.
This rule monitors DeviceNetworkEvents and DnsEvents for any network connection attempts or DNS queries directed towards the known malicious domain 'hyundaiservisiankara.com'. This pattern is indicative of a host attempting to communicate with an external C2 infrastructure.
This rule detects network connections to known cryptomining pool IP addresses and domain names, as well as file or process executions matching specific hashes associated with known miner samples. It monitors for communication to command-and-control (C2) servers potentially used for cryptomining operations.
Detects indicators of the Bazinga macOS backdoor and Polygon-C2 campaign, including specific command-and-control domains, C2 infrastructure IP addresses, persistence mechanisms via launch agent property lists, and associated cryptographic indicators like file hashes and wallet addresses.
Detects indicators of the Bazinga macOS backdoor and Polygon-C2 campaign, including specific command-and-control domains, C2 infrastructure IP addresses, persistence mechanisms via launch agent property lists, and associated cryptographic indicators like file hashes and wallet addresses.
Detects outbound HTTP requests to 'relay.php' that include the 'X-Captcha-Track: 1' header, which serves as a telemetry beacon for the CRPx0 ClickFix social engineering campaign. This activity is indicative of a user interacting with a malicious webpage designed to trick them into executing harmful commands via copy-paste actions.
Detects indicators of the Bazinga macOS backdoor and Polygon-C2 campaign, including specific command-and-control domains, C2 infrastructure IP addresses, persistence mechanisms via launch agent property lists, and associated cryptographic indicators like file hashes and wallet addresses.
Detects outbound HTTP requests to the Telegram Bot API (/sendMessage) which are often used by malware (such as 'Exvicy' or 'Small Sieve') for command and control or exfiltration notification, utilizing the Telegram bot token structure in the URI.
Detects outbound network traffic from internal hosts directed toward identified Exvicy command-and-control (C2) infrastructure IP addresses. This includes both general beaconing attempts and established TLS handshake sessions potentially linked to post-ClickFix malicious activity.
Detects HTTP POST requests directed to the '/api.php' endpoint with specific patterns characteristic of Exvicy/ClickFix malware C2 communication. The rule identifies suspicious action parameters (check, dl, or cb) and a specific 48-character hexadecimal 'k' parameter used for identifying infected state.
This rule detects suspicious outbound network connections originating from processes frequently abused in the Exvicy/ErrTraffic ClickFix malware delivery chain, specifically powershell.exe, msiexec.exe, and putty.exe. It also monitors for direct communication to known C2 IP addresses associated with the Exvicy threat actor, providing coverage for both the initial payload delivery and post-compromise C2 phases.
Detects outbound HTTP POST requests to the 'vpugy.vcqi' domain, which is associated with RevStealer malware exfiltration. The rule specifically looks for traffic using a spoofed Chrome/147 user-agent and specific cookie artifacts used for session tracking in the exfiltration communication.
Hunts network, HTTP, and email-URL telemetry for known ARToken infrastructure (operator backend IPs and phishing/panel domains). Bounded to a 30-day lookback and tiers matches by confidence: domain hits are high-confidence (attacker-registered infrastructure), while IP hits are medium-confidence since the IPs sit on shared DigitalOcean hosting that can be reassigned to unrelated tenants once ARToken's infrastructure is taken down. Empty/unparsed indicator fields are excluded to avoid spurious matches in the HTTP event parsing branch. No known file hashes are associated with this intel.
Detects outbound network traffic from internal hosts to known PIVOTPIPE-associated infrastructure, including attempts to access open directories for payload distribution and suspected Cobalt Strike command-and-control communications.
Detects network traffic associated with the GHAPPIER campaign using specific Vercel-hosted staging infrastructure. The rule monitors for requests to known malicious Vercel subdomains and identifying URI parameters often used for campaign tagging during beaconing or payload delivery.
Detects network traffic consistent with PIVOTPIPE command-and-control activity and potential Cobalt Strike beaconing to known malicious infrastructure on specific ports.
Detects network traffic associated with PIVOTPIPE Cobalt Strike beacon activity communicating with a known suspicious external IP address on port 8088. This includes generic TCP, HTTP-based beaconing, and TLS-encrypted C2 sessions.
Detects file, process, and network activity associated with the TraderTraitor/KelpDAO malware campaign based on known hashes, filenames, paths, and C2 infrastructure.
Detects outbound web or proxy connections to known consumer-grade cloud storage and file-sharing services. This activity is often indicative of data exfiltration, where an adversary uploads staged or archived sensitive data to third-party file hosting services (e.g., Mega, Dropbox, transfer.sh, pastebin) to bypass traditional enterprise exfiltration controls.
Detects outbound network traffic directed to Bitbucket (via TLS/443) or using the git protocol (via port 9418). Such connections from internal systems to unverified or unauthorized external Git repositories may indicate malicious activity, including the potential installation of malicious plugins or code via supply chain compromises (e.g., Plugin4Shell).
Detects the execution, network connections, and service installation of MeshAgent or associated binaries (e.g., mvtcs.exe). The rule identifies potential unauthorized or malicious use of this remote management software by looking for process activity, specific network connections to known infrastructure, and service persistence mechanisms.
Page 74 of 280