Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,879 detections
Filters
Last updated
All Time
Detection languages
2,954
1,378
313
289
239
Contributors
1,807
1,529
1,304
180
173
Categories
20,460
11,847
5,879
5,158
4,866
Platforms
3,747
1,857
1,076
782
160
Products / Services
2,241
1,434
1,273
746
582
MITRE Techniques
2,448
2,151
1,129
937
790
CVEs
19
15
9
7
5
IDS Classtypes
834
334
94
23
20
IDS Protocols
689
276
235
117
23
Detects outbound TLS traffic behavior consistent with the WaterPlum RAT, characterized by periodic, low-volume connections to non-CDN/cloud providers. The rule identifies potential beaconing activity by monitoring TLS SNI fields against a list of known legitimate service providers and applying a frequency threshold.
This rule detects suspicious clipboard access attempts initiated by common scripting interpreters (node.exe, python.exe, powershell.exe) in non-standard paths or correlated with recent external network connections. It is designed to identify potential credential theft or data staging using clipboard interaction methods often employed by malware.
This rule detects suspicious clipboard access attempts initiated by common scripting interpreters (node.exe, python.exe, powershell.exe) in non-standard paths or correlated with recent external network connections. It is designed to identify potential credential theft or data staging using clipboard interaction methods often employed by malware.
This rule monitors for indicators of compromise (IOCs) associated with a specific AutoIT-based malware delivery chain. It tracks the execution and presence of specific malicious file names and SHA256 hashes, as well as network connections to a identified command-and-control (C2) infrastructure IP address (158.51.122.136). The detection spans file creation, process execution, image loading, and network communication events to identify the multi-stage attack lifecycle.
This rule detects activity related to specific known fabricated news infrastructure domains and associated social media handles, which are indicative of influence operations. It monitors network connection events, email URL clicks, email communication patterns involving these domains, and process executions that reference these specific accounts or handles.
Detects network activity or command line parameters initiated by the Jarte text processor (Jarte.exe or GRrte.exe) originating from a JartePortable directory, indicating potential C2 activity involving the domain 'castanaksa.com' or the IP address '192.64.119.189'.
This rule monitors for execution of files with specific SHA256 hashes known to be malicious, and network connections to a known malicious domain associated with Vultr storage. It aggregates file creation, process execution, and network connection events to detect potential threat activity.
Detects outbound network traffic (HTTPS and TLS) directed at the specific S3-compatible object storage host 'ams1.vultrobjects.com'. This pattern is associated with 'HEAVYGRAM', a threat actor or toolkit using Vultr S3 buckets for potential data exfiltration.
Detects outbound HTTP POST requests to known public Ethereum RPC gateways (Alchemy and Infura) containing embedded, hardcoded API keys or references to specific contract addresses associated with the 'indexed-btree' malware campaign. This pattern indicates a compromised host leveraging legitimate Web3 infrastructure for Command and Control (C2) communication.
This rule detects network connections to known command-and-control (C2) infrastructure associated with the KREMLIN browser extension. The extension exfiltrates browser data (cookies, sessionStorage, localStorage) by masquerading data transfer within requests to .css files hosted on the attacker-controlled domain 'luizestrelhashapr.online'.
This rule monitors endpoint network events, file operations, and process executions for known malicious indicators (domains and file hashes) associated with Kremlin activity. It detects connections to suspicious remote domains and the existence or execution of specific malicious file hashes.
This rule detects periodic network beaconing patterns consistent with BabylonRAT malware. It flags established TCP connections to external networks that occur at a frequency exceeding 5 connections within a 300-second window, which may indicate a C2 check-in mechanism. Due to the heuristic nature of this detection, it is recommended to tune the threshold and correlate with payload analysis or entropy inspection to reduce noise.
This rule detects periodic network beaconing patterns consistent with BabylonRAT malware. It flags established TCP connections to external networks that occur at a frequency exceeding 5 connections within a 300-second window, which may indicate a C2 check-in mechanism. Due to the heuristic nature of this detection, it is recommended to tune the threshold and correlate with payload analysis or entropy inspection to reduce noise.
Detects network activity associated with the DarkMe RAT, including DNS lookups for its known C2 domain 'thatawful.boutique' and outbound TCP connections to a hardcoded non-standard port (7712) at a known malicious C2 IP address.
Detects network activity and HTTP request headers associated with the GhostCode phishing kit. The rule identifies specific URI patterns, custom site keys, malicious User-Agent strings, and session cookie artifacts indicative of interaction with a phishing server.
Detects outbound TLS connections to Microsoft Dev Tunnels (devtunnels.ms), which can be abused for lateral movement or protocol tunneling of services such as RDP to bypass network ingress filtering.
This rule detects a sequence of suspicious events related to the 'ENCFORGE' threat actor or toolset. It monitors for evidence of initial access (via validation/code API calls), command and control communication (to specific IP/port), and destructive impact, correlating these activities within a 4-hour window on the same host.
This rule detects outbound network communications (TLS, MQTT, and HTTP) to HiveMQ infrastructure. The pattern of activity suggests the presence of 'Bird Agent' malware utilizing the MQTT protocol for command and control (C2) communication, as well as periodic HTTP beaconing to HiveMQ broker endpoints.
Detects outbound TCP traffic from the internal network to external destinations that match characteristics of Gorilla RAT registration beacons. This includes established sessions with small packet sizes (<64 bytes) and frequent, repeated attempts as defined by the threshold.
Detects instances where the ScreenConnect remote support client initiates outbound network connections to an unusually high number of distinct remote IP addresses (greater than 5). This behavior is characteristic of unauthorized lateral movement, reconnaissance, or establishing multiple C2 tunnels via a legitimate RMM tool.
This rule monitors for execution patterns associated with the Evil-WinRM tool, a common post-exploitation framework used for remote command execution via WinRM. It identifies suspicious command-line arguments in PowerShell, the creation of configuration files typical of the tool, and network connections to WinRM ports initiated by common execution binaries like PowerShell or Ruby.
Page 97 of 280