Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
532 detections
Filters
Last updated
All Time
Detection languages
207
185
44
24
19
Contributors
154
107
100
72
18
Categories
20,440
11,814
5,871
5,145
4,864
Platforms
291
209
74
56
23
Products / Services
194
142
120
110
21
MITRE Techniques
296
147
118
86
85
CVEs
5
3
1
1
1
IDS Classtypes
78
69
17
8
5
IDS Protocols
85
51
18
9
9
This rule correlates rapid file modifications (potential encryption or mass deletion) with the execution of commands known to inhibit system recovery (e.g., deleting shadow copies or modifying boot recovery settings) and significant outbound network data transfers from the same host. This pattern is characteristic of ransomware deployment.
Detects anomalous network traffic patterns communicating with the Telegram Bot API (api.telegram.org) from non-official Telegram processes. The rule identifies potential command and control (C2) activity by analyzing request frequency, specific API method usage (e.g., getUpdates, sendMessage), and beaconing-like behavior.
Detects data exfiltration using asymmetric encrypted non-C2 protocols
Detects manipulation of data in transit via man-in-the-middle position
Detects potential Browser-in-the-Middle (BitM) phishing activity by identifying a client browser that fetches the 'rrweb' session-recording library followed by a WebSocket connection to a different origin within 5 minutes. This sequence is indicative of an attacker-controlled browser streaming the victim's DOM and interaction events to a phishing infrastructure.
Detects a specific behavioral pattern associated with Bluekit Phishing-as-a-Service (PhaaS) involving WebRTC IP address leak fingerprinting. The rule identifies UDP STUN traffic (port 3478) originating from common web browsers followed within 30 seconds by an HTTPS connection to non-reputable domains, indicating a potential client-side phishing reconnaissance or identification attempt.
Detects outbound SSH connections from common applications using libssh2 to external, non-standard or untrusted servers, followed by an anomalously large inbound TCP data transfer before authentication completes. This behavior is indicative of exploitation attempts targeting CVE-2026-55200, where a malicious SSH server triggers a heap overflow in the client via a malformed packet.
This rule detects potentially unauthorized processes establishing network connections over port 8883 (MQTT/MQTTS) to major cloud IoT platforms (AWS IoT, Azure IoT Hub, GCP PubSub). It flags processes that are not common web browsers and calculates a suspicious score based on data volume, execution path (e.g., Temp or AppData), and the process name not matching known legitimate IoT software.
This rule detects network connections or DNS queries to known public tunneling services (e.g., Cloudflare Tunnel, localtunnel, bore, devtunnels) made by processes other than common web browsers. Attackers frequently use these services to bypass firewalls and establish unauthorized reverse shells or persistent C2 channels.
Detects DNS queries with exceptionally long request strings (30 characters or more), which is a common indicator of DNS tunneling or command and control (C2) communication. Adversaries often encode data within the subdomain portion of a DNS query to bypass network security controls.
This rule monitors for three categories of potentially suspicious network behavior: connections to common CDN providers over non-standard ports, high-volume HTTPS connections directly to IP addresses (IP-direct) bypassing standard domain resolution, and high-volume traffic to CDN infrastructure that may indicate domain fronting or C2 communication. Such patterns are often used by adversaries to mask egress traffic or exfiltrate data.
Detects high-frequency HTTPS network connections to Google Drive or Google APIs originating from processes that are not common web browsers or productivity software. This behavior is indicative of the GearDoor backdoor, commonly used by APT41, which leverages Google services as a command-and-control (C2) channel.
This rule detects anomalous DNS query activity that may indicate command and control (C2) or data exfiltration over the DNS protocol. It monitors for three specific indicators: excessive query volume to a single domain family within a short timeframe, the use of abnormally long DNS subdomain labels, and the transmission of TXT record queries from endpoints not acting as designated DNS servers.
Detects HTTP responses that utilize JavaScript Web Crypto API (subtle.importKey, subtle.decrypt) or AES-GCM encryption in conjunction with data decoding functions (atob, Uint8Array.from). This behavior is characteristic of malicious landing pages, such as those used by ErrTraffic ClickFix and EvilTokens campaigns, which encrypt payloads to evade static analysis by security tools.
This rule detects network traffic indicative of command and control (C2) activity using the WebSocket protocol targeting a specific suspicious destination IP (38.60.253.35). The rule identifies WebSocket connections or traffic containing specific URL parameters ('a=w64', 't=ws_') commonly associated with malicious tooling or C2 communication patterns.
This rule detects DNS queries to known public tunneling service domains, such as devtunnels.ms, loophole.site, loca.lt, and bore.pub, originating from processes other than the legitimate developer tunneling tools (devtunnel.exe, code.exe, code-tunnel.exe). This activity is highly indicative of unauthorized remote access or command-and-control communication.
This rule detects potential ransomware activity by identifying a combination of three distinct behaviors occurring on a single endpoint within a short window: high-volume file modifications (indicative of file encryption), deletion of system recovery resources (e.g., volume shadow copies, backup catalogs), and high-frequency network activity (indicative of data exfiltration). The rule uses cross-event correlation to reduce false positives by requiring all three signals to be present.
This rule monitors for large outbound network data transfers (greater than 10MB) over standard web ports (80/443) initiated by processes typically associated with office productivity applications (e.g., WinWord, Excel, Outlook) or credential dumping tools (lsass.exe). It further correlates this activity with preceding network connections to common directory service ports (LDAP/Global Catalog) on the same host, indicating potential credential collection followed by data exfiltration.
This rule detects network connections to the Telegram API (api.telegram.org) initiated by specific processes that are typically associated with scripting or unauthorized execution (BQT.exe, start.exe, python.exe, pythonw.exe), while explicitly excluding common web browsers. This behavior is often indicative of automated command-and-control (C2) communication or data exfiltration using Telegram as a transport layer.
This rule identifies potential Command and Control (C2) beaconing activity by detecting recurring, consistent HTTP(S) requests from internal hosts to unknown or newly seen external destinations, characterized by stable time intervals and low variance in response sizes. The detection logic filters out common User-Agents, indicating non-browser or automated traffic often associated with malware communication.
Detects high volume HTTPS outbound traffic (greater than 50MB within a 5-minute window) from a host that does not show evidence of preceding file encryption or volume shadow copy deletion activity. This rule is designed to identify potential unauthorized data exfiltration that deviates from typical ransomware-associated behavior patterns.
Page 17 of 26