Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,879 detections
Filters
Last updated
All Time
Detection languages
2,954
1,378
313
289
239
Contributors
1,807
1,529
1,304
180
173
Categories
20,460
11,847
5,879
5,158
4,866
Platforms
3,747
1,857
1,076
782
160
Products / Services
2,241
1,434
1,273
746
582
MITRE Techniques
2,448
2,151
1,129
937
790
CVEs
19
15
9
7
5
IDS Classtypes
834
334
94
23
20
IDS Protocols
689
276
235
117
23
In DeviceNetworkEvents, we can find both JA4 and JA4S inside AdditionalFields for some TLS connections. This is interesting because we can look at both sides of the same TLS communication. We can compare clients, servers and JA4/JA4S combinations, and look for patterns or connections that behave differently from what we normally see. The following KQL extracts and decodes both fingerprints from the same network event.
Detects outbound network traffic from internal hosts to Telegram shortened URLs (t.me). The detection looks for TLS SNI strings or HTTP requests targeting t.me domains, specifically focusing on non-browser user-agent strings which are indicative of Vidar-style malware using Telegram as a dead-drop resolver for C2 operations.
Detects outbound HTTP POST requests characterized by a specific 'Accept' header configuration commonly associated with Vidar Stealer command and control (C2) communication. This signature relies on the consistency of HTTP header patterns often observed in Vidar infections.
This rule detects anomalies in outbound network data transfer by comparing the current daily volume of data sent to external, non-private IP addresses against the historical average for those specific sources. It alerts when the daily volume exceeds 500MB and shows a significant spike (3x or more) compared to historical baseline data or when no historical data is available for a new source connection.
This rule monitors endpoint telemetry (File, Process, and Network events) to identify activity associated with a pre-defined set of known malicious file hashes, IP addresses, and domains. It correlates these indicators to detect potential malware execution, persistence, or command-and-control communication on monitored devices.
This rule detects unauthorized or suspicious processes (like Python scripts or random executables) accessing Telegram Desktop's local 'tdata' directory, which contains user session information, and simultaneously exhibiting network activity directed towards Telegram API domains. This behavior is highly indicative of infostealer activity, where a malicious process attempts to harvest local Telegram session data for exfiltration.
Detects network handshake patterns associated with the Fast Reverse Proxy (FRP) client, specifically identifying outbound traffic containing identifiers used in common FRP reverse tunnel configurations. This behavior is indicative of unauthorized remote access tools or tunneling software establishing a connection to an external command-and-control server.
Monitors network connections initiated by the Logitech Options Plus agent process (logioptionsplus_agent.exe) on a specified host. This rule facilitates tracking of outbound communications generated by this background service.
This rule monitors for network connections and process activities associated with known malicious indicators, including file hashes, C2 IP addresses, domains, and specific URLs. It maps these activities to identify potential command and control communication or other malicious network activity occurring on endpoints.
This rule detects HTTP GET requests to a specific GitHub repository path (raw.githubusercontent.com/omskiwdcvoiuyfd0998/) identified as staging infrastructure associated with Konni/VelvetCake malware operations. This activity is indicative of a compromised host attempting to download malicious payloads or stage tools from actor-controlled infrastructure.
This rule detects HTTP GET requests to a specific GitHub repository path (raw.githubusercontent.com/omskiwdcvoiuyfd0998/) identified as staging infrastructure associated with Konni/VelvetCake malware operations. This activity is indicative of a compromised host attempting to download malicious payloads or stage tools from actor-controlled infrastructure.
Detects specific command-and-control (C2) communication patterns associated with the VelvetCake malware. The rules identify initial authentication with a hardcoded password string, module enumeration requests, and session termination signals transmitted over TCP.
Detects specific command-and-control (C2) communication patterns associated with the VelvetCake malware. The rules identify initial authentication with a hardcoded password string, module enumeration requests, and session termination signals transmitted over TCP.
Detects specific command-and-control (C2) communication patterns associated with the VelvetCake malware. The rules identify initial authentication with a hardcoded password string, module enumeration requests, and session termination signals transmitted over TCP.
Detection of network traffic associated with VelvetCake (Konni) malware, identifying communication with known hardcoded C2 infrastructure, domain lookups, and exfiltration attempts via HTTP/TLS and raw TCP protocols.
Detection of network traffic associated with VelvetCake (Konni) malware, identifying communication with known hardcoded C2 infrastructure, domain lookups, and exfiltration attempts via HTTP/TLS and raw TCP protocols.
This rule detects network traffic directed at known command and control (C2) domains associated with the Koktevrat malware, specifically targeting the domain 'fb-market-play.cc'. This pattern is indicative of compromised hosts attempting to communicate with attacker infrastructure, often following an initial infection phase initiated via malicious links.
Detects the specific TCP handshake pattern characteristic of the Fast Reverse Proxy (FRP) client (frpc) initiating a connection to a command-and-control server. The rule inspects established traffic for specific metadata strings ('privilege_key', 'run_id', 'pool_count') within the initial handshake payload.
Detects outbound network connections from internal devices to a set of known malicious IP addresses (217.156.122.129, 37.221.66.43) across commonly abused command-and-control ports (8080, 3480, 9998, 9999, 4444).
Detects outbound network connections from internal devices to a set of known malicious IP addresses (217.156.122.129, 37.221.66.43) across commonly abused command-and-control ports (8080, 3480, 9998, 9999, 4444).
This rule detects suspicious clipboard access attempts initiated by common scripting interpreters (node.exe, python.exe, powershell.exe) in non-standard paths or correlated with recent external network connections. It is designed to identify potential credential theft or data staging using clipboard interaction methods often employed by malware.
Page 88 of 280