Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
532 detections
Filters
Last updated
All Time
Detection languages
207
185
44
24
19
Contributors
154
107
100
72
18
Categories
20,440
11,814
5,871
5,145
4,864
Platforms
291
209
74
56
23
Products / Services
194
142
120
110
21
MITRE Techniques
296
147
118
86
85
CVEs
5
3
1
1
1
IDS Classtypes
78
69
17
8
5
IDS Protocols
85
51
18
9
9
Detects a multi-stage browser-based web skimming attack. The rule identifies a specific sequence of network activity: a device fetching an obfuscated loader script from 'paste.sh', followed by retrieving payload fragments from the 'Google Sheets Visualization API', and concluding with network interactions with crypto-transaction services 'SwapZone.io' or 'SimpleSwap.io', characteristic of a browser-based wallet-drainer campaign.
Detects the specific C2 handshake pattern associated with HVNC (Hidden Virtual Network Computing) remote access trojans. The rule monitors for a unique sequence of markers, specifically CLIENT_ID, COMPUTER, IDENTIFIER_CHANNEL, and a version string, indicating a malware-specific communication protocol.
Detects the specific C2 handshake pattern associated with HVNC (Hidden Virtual Network Computing) remote access trojans. The rule monitors for a unique sequence of markers, specifically CLIENT_ID, COMPUTER, IDENTIFIER_CHANNEL, and a version string, indicating a malware-specific communication protocol.
Detects FTP STOR commands associated with the transfer of files with a .pcap extension, which may indicate the exfiltration of captured network traffic from a network device or server.
Detects S7comm 'PUT' or 'Write Var' commands directed at a PLC via port 102 when no authorized maintenance window is active, indicating potentially unauthorized industrial control system (ICS) modifications.
Detects C2Looper v1 malware communication patterns, specifically plaintext HTTP beaconing to /api/beacon or /api/result endpoints with characteristic JSON body fields (id, user, host, pid, cmd, arg, seq), as well as direct network connections to known C2Looper command-and-control infrastructure on TCP port 8888.
Detects unauthorized S7comm 'GET' or 'Read' operations directed at Siemens S7 Series PLCs over TCP port 102. These commands are often used in reconnaissance phases of ICS/OT attacks to map memory blocks, read ladder logic, or identify system state before executing more disruptive operations.
Detects S7comm 'GET' or 'Read' operations directed at Programmable Logic Controller (PLC) data areas such as Data Blocks or Ladder Logic from unauthorized IP addresses. This activity is indicative of industrial reconnaissance or unauthorized interaction with control systems.
Detects network traffic patterns associated with the msaRAT remote access trojan, specifically identifying suspicious WebRTC DataChannel creation, binary data handling, and custom window messaging bindings used for command-and-control communication.
Detects repeated network requests to specific JSON files hosted on GitHub (e.g., beacon.json) initiated by processes other than standard web browsers or git. This behavior is indicative of a C2 heartbeat mechanism where an agent periodically retrieves configuration or tasking files from a public repository.
This rule monitors Netskope cloud application events to detect potential data exfiltration. It triggers if there is a significant volume anomaly (z-score >= 2) for any cloud application activity, or if a 'Share' or 'Upload' activity occurs that is only configured to 'Alert' rather than being blocked. This helps identify unusual spikes in data movement or sensitive operations that bypass formal enforcement controls.
Detects malicious JavaScript injection attempts by msaRAT that leverage the Chrome DevTools Protocol (CDP) Runtime.evaluate method. The malware attempts to execute specific code snippets to facilitate flow-controlled data transfers over WebRTC DataChannels using Base64ToArrayBuffer conversions and a 24KB buffer threshold.
This rule identifies potential DNS tunneling or exfiltration attempts by monitoring for high volumes of DNS queries, a high count of distinct subdomains, or the usage of unusual DNS record types (TXT, NULL) within Zscaler Internet Access logs.
Detects high-risk user behavior associated with unsanctioned or restricted Generative AI applications, specifically targeting large data uploads (potential data exfiltration) or repeated access following a coaching intervention.
Detects data exfiltration by the Kynx Stealer ChunkSender module which uses HTTP POST requests to a specific ingestion path.
Detects HTTP POST requests characteristic of the Kynx Stealer's ChunkSender module. The rule monitors for specific URI patterns used during the exfiltration phase, where stolen data categories like passwords, cookies, and system information are sent to a remote C2 panel.
Detects instances where sensitive or organizational data is uploaded to public text storage repositories like Pastebin or GitHub Gists through Netskope, which may indicate data exfiltration.
This rule identifies potential DNS tunneling or exfiltration attempts by monitoring for high volumes of DNS queries, a high count of distinct subdomains, or the usage of unusual DNS record types (TXT, NULL) within Zscaler Internet Access logs.
Detects high-risk user behavior associated with unsanctioned or restricted Generative AI applications, specifically targeting large data uploads (potential data exfiltration) or repeated access following a coaching intervention.
This rule detects data synchronization activities between sanctioned enterprise applications and unsanctioned or personal cloud applications using Netskope logs. This pattern often indicates potential shadow IT usage or unauthorized data exfiltration from controlled environments to personal storage services.
Detects instances where sensitive or organizational data is uploaded to public text storage repositories like Pastebin or GitHub Gists through Netskope, which may indicate data exfiltration.
Page 10 of 26