Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,879 detections
Filters
Last updated
All Time
Detection languages
2,954
1,378
313
289
239
Contributors
1,807
1,529
1,304
180
173
Categories
20,460
11,847
5,879
5,158
4,866
Platforms
3,747
1,857
1,076
782
160
Products / Services
2,241
1,434
1,273
746
582
MITRE Techniques
2,448
2,151
1,129
937
790
CVEs
19
15
9
7
5
IDS Classtypes
834
334
94
23
20
IDS Protocols
689
276
235
117
23
Detects periodic outbound network connections (beaconing) to rare remote destinations initiated by processes running from non-standard or user-writable locations. The rule calculates the interval coefficient of variation (CV) between successful connections to identify regular, consistent patterns indicative of command and control communication while excluding known legitimate update and service traffic.
This rule detects network activity associated with known command-and-control (C2) infrastructure. It monitors for connections to specific malicious domains, IP addresses, or URI paths combined with unique HTTP headers or request body markers indicative of C2 beacons or data exfiltration.
Detects outbound network traffic (TLS and DNS queries) directed towards AWS S3 endpoints, which may indicate the use of s5cmd or similar tools for unauthorized data exfiltration to cloud storage.
Detects potential ClickFix-style social engineering attacks where a victim is prompted to execute an encoded PowerShell command (often via copy-paste into a terminal). The rule specifically monitors PowerShell processes initiated by shell environments (explorer.exe, cmd.exe, or WindowsTerminal.exe) that execute encoded, hidden scripts to perform multiple suspicious network requests for files (e.g., .zip, .enc, .bin) from non-standard domains.
This rule monitors DeviceNetworkEvents for any outbound network connections to a specific list of known malicious domains. The rule identifies potential command and control (C2) communication by matching remote URLs against a hardcoded set of domains associated with known threats.
Detects network and DNS activity associated with the SideCopy threat group, specifically monitoring for connections to known C2 domains, C2 IP addresses, or the usage of port 5863 typically associated with the ReverseRAT backdoor.
This rule monitors for user interactions with specific domains and URLs known to be associated with suspicious or malicious activity. It aggregates data from multiple sources, including email clicks (UrlClickEvents), device network activity (DeviceNetworkEvents), device browser events (DeviceEvents), and DNS queries (DnsEvents), to identify potential exposure to these indicators of compromise.
Detects HTTP connections between internal hosts and suspected C2 infrastructure associated with the Operation SilkParasite campaign. The rule specifically monitors for connections to known malicious IPs and identifies the retrieval of a cloned RTX Corporation homepage content, which acts as a decoy for the SpiceRAT malware.
Detects network traffic to the domain 'trace-flow.ru', which is associated with the 'Max Messenger' malware's concealed telemetry and C2 channel. The rules monitor for TLS connections to this domain, including instances where the certificate subject contains 'VK LLC' and 'Moscow'.
Detects network communication to identified SpiceRAT Command and Control (C2) infrastructure over TCP port 443. This includes monitoring for standard TCP connections and TLS sessions to known malicious IP addresses.
Detects network communication associated with the SilkParasite campaign, specifically identifying TLS traffic using fraudulent certificates impersonating the Uzbekistan railway authority (azure.uzrailwaystax.com) and connections to identified malicious infrastructure using specific JA4X TLS fingerprinting.
Detects HTTP POST requests to the Telegram Bot API (/sendPhoto) containing patterns indicative of data exfiltration. The rule identifies suspicious message content, such as URLs leading to VK.com or reconnaissance data like Shodan host links and IP location query templates, suggesting the use of Telegram as a Command and Control (C2) channel for exfiltrating sensitive information.
Detects outbound RDP-over-TLS connections using non-standard high-numbered ports (64350, 64330, 65535, 65111, 61256), characteristic of SilkParasite command and control infrastructure. The rules trigger on known C2 IP addresses and general suspicious RDP behavior on these specific ports.
Detects network communication to known SpiceRAT Command and Control (C2) IP addresses and DNS queries for known SpiceRAT-related domains. The rule identifies potential compromise by flagging outbound traffic or DNS resolutions associated with SpiceRAT infrastructure.
This rule monitors for two distinct stages of potential account recovery abuse. First, it detects the execution of suspected Python scripts on an endpoint that contain command-line arguments related to password recovery or authentication codes. Second, it monitors network proxy/web logs for a high volume of API requests to the 'easy4ipcloud.com' domain associated with password reset or device probe endpoints, which may indicate automated credential stuffing or unauthorized device account recovery attempts.
Detects outbound network traffic from internal hosts to known IP addresses associated with the SpiceRAT malware command and control infrastructure.
Detects outbound HTTP requests to the Telegram Bot API that indicate the exfiltration of sensitive camera credentials or snapshots. The rules identify specific API endpoints such as '/sendPhoto' and the presence of Markdown-formatted text containing 'Login:', 'Password:', and 'Model:' fields within the request body.
Detects outbound TLS-encrypted network traffic directed towards known SilkParasite infrastructure using non-standard high ports commonly associated with RDP-over-TLS (NLA). The rule identifies potential Command and Control (C2) activity by flagging connections to suspicious IP/port combinations typical of this adversary cluster.
Detects network communication associated with the SilkParasite campaign, specifically targeting TLS connections that use spoofed certificates impersonating azure.uzrailwaystax.com or communication with known SpiceRAT command-and-control server IP addresses.
This rule detects network and email activity associated with a list of known suspicious or 'ghost' domains. It monitors email sender and recipient addresses, email URL links, and DNS query logs for matches against the predefined domain list, identifying potential spearphishing or command-and-control communication.
Detects network communications between internal hosts and known malicious infrastructure associated with SpiceRAT, including TLS-based command channels and HTTP requests for decoy pages.
Page 89 of 280