Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
219 detections
Filters
Last updated
All Time
Detection languages
109
46
38
12
5
Contributors
46
46
32
31
21
Categories
20,443
11,831
5,872
5,155
4,866
Platforms
158
61
34
25
4
Products / Services
115
75
58
19
18
MITRE Techniques
91
48
34
27
19
CVEs
4
2
1
1
1
IDS Classtypes
50
20
16
6
5
IDS Protocols
44
23
21
9
6
Detects high-frequency DNS query responses for domains ending in '.shop' from external sources within a 10-minute window. This behavior is indicative of domain churn often associated with 'DoppelCart'-style fake e-commerce shop infrastructure.
Detects high-frequency, repeated access to a specific fraud-tracking or canary token link by sources utilizing rotating VPNs or proxies over an extended period. This behavior is indicative of automated probing or credential validation attempts associated with the Phantom Deal campaign.
This rule detects outbound network connections from internal hosts to specific IP addresses associated with known AlexHost infrastructure identified as command-and-control (C2) servers for the Bandook Remote Access Trojan (RAT), which is utilized by the threat actor Dark Caracal.
Detects periodic outbound TLS connections over port 443 exhibiting beaconing behavior (5+ established connections with a non-empty SNI from a source host within 300 seconds), consistent with BridgeAgent malware C2 heartbeat/reverse-shell maintenance. Correlate with EDR detections of a process masquerading as /usr/bin/gnome-shell running as root and persisted via a fraudulent zabbix_agent.service.
This rule monitors firewall traffic logs to identify connections directed at managed internal endpoints originating from devices not tracked by the endpoint management system. It flags potential rogue or unauthorized devices performing multi-target reconnaissance or communication across the internal network.
Detects anomalous S7comm (Siemens S7 Communication) traffic directed to port 102, which is commonly used by PLCs and ICS devices. The rule identifies potential automated, scripted, or unauthorized activity by monitoring for connections occurring outside of standard business hours (6 PM to 8 AM) or exhibiting high-frequency connection patterns (exceeding 1 connection per second), which may indicate scanning, brute-forcing, or interaction with ICS hardware by unauthorized actors.
Detects a single masquerading Kimwolf v7 binary (netd_service, TVHelper, or libdevice.so running from a disguised com.n2.systemservice path) generating at least three distinct flood traffic patterns (UDP game-protocol flood, DNS query flood, or TLS/HTTPS flood) within a 60-second window, indicative of active multi-vector DDoS command execution.
This rule monitors GCP VPC Flow logs for potential command and control (C2) or data exfiltration activity by identifying internal-to-external network connections that exhibit high novelty. It calculates the percentage of new destination IP addresses contacted by internal source IPs within a single day. Alerts are triggered when a source IP initiates connections to at least 20 unique external destinations, where at least 20% of those destinations have never been contacted by that source in the previous day. This behavioral analysis is designed to detect reconnaissance, scanning, or large-scale data exfiltration patterns.
This rule detects high-volume outbound network traffic from a Google Cloud Platform (GCP) source IP to external (non-private/non-internal) destinations. It establishes a baseline of daily outbound traffic per source IP over time and triggers an alert if the current daily outbound volume exceeds 500MB and shows a significant increase (more than 3x the established average) compared to previous days. This behavior is often indicative of unauthorized data exfiltration or abnormal network activity.
This rule monitors GCP VPC Flow logs for unusual network traffic patterns originating from internal private IP address ranges (RFC 1918). It calculates daily distinct destination IP and port counts per source IP, establishing a baseline of normal behavior. It flags anomalies where current traffic ratios for destinations or ports exceed a threshold of 3x compared to the baseline, or identifies 'new host spray' patterns where a source suddenly targets an unusually high number of ports or destinations without prior history, indicating potential reconnaissance or scanning activity.
This rule monitors Kerberos TGS (Ticket-Granting Service) requests for suspicious patterns indicative of Kerberoasting, specifically looking for the use of weak encryption algorithms (RC4 or DES) and high volumes of service ticket requests for unique Service Principal Names (SPNs). It groups activity by source host and time window, flagging activity that involves DES encryption or a significant number of unique SPN requests. Great for detecting kerberoasting activity from unmanaged or rogue devices
This rule monitors Kerberos TGS (Ticket-Granting Service) requests for suspicious patterns indicative of Kerberoasting, specifically looking for the use of weak encryption algorithms (RC4 or DES) and high volumes of service ticket requests for unique Service Principal Names (SPNs). It groups activity by source host and time window, flagging activity that involves DES encryption or a significant number of unique SPN requests. Great for detecting kerberoasting activity from unmanaged or rogue devices
Detects a suspicious proxy authentication negotiation pattern involving multiple HTTP 407 challenges followed by a WebSocket upgrade and the establishment of a SOCKS5 tunnel, indicative of the BridgeHead adversary toolset.
Detects high-frequency outbound HTTP traffic matching specific URI patterns associated with potential Adaptix C2 beaconing behavior. The rule uses a sliding window threshold (10 requests within 600 seconds) to identify repetitive check-in patterns, which is a common characteristic of malware command-and-control channels.
This rule detects UDP traffic patterns characteristic of the msaRAT C2 handshake. It specifically identifies initial WebRTC DataChannel connection frames containing the 0xFE marker combined with ChaCha-Poly1305 encryption indicators within the expected packet size range.
Detects multiple repeated web requests targeting WordPress 'author_exclude' or '/wp/v2/batch' endpoints that contain suspicious time-based SQL injection payloads. The rule specifically looks for patterns attempting to leverage SLEEP() functions to infer database information.
This rule monitors and aggregates external network connections originating from a specific host. It specifically highlights connections to external domains or IPs that have a low frequency (1-10 connections), which may indicate beaconing activity, command and control (C2) communication, or low-and-slow data exfiltration attempts.
Detects periodic, repetitive TLS network connections from internal hosts to external destinations using threshold-based analysis. This pattern is indicative of potential command-and-control (C2) beaconing, which may be used for exfiltrating stolen credentials or sensitive data from build or developer environments.
Detects established TLS traffic over WebSockets where the certificate subject field lacks a common name (CN), often indicative of non-standard, self-signed, or improperly generated TLS certificates used by command-and-control (C2) agents to bypass standard certificate validation or hide within encrypted channels.
Detects network activity initiated by a process named 'Trustrap' communicating over common ports (80, 443, 53). The rule aggregates data by endpoint, process, and port, sorting by the frequency of connections to highlight potentially high-volume communication patterns.
Detects recurring connection patterns characteristic of the SnappyClient RAT, specifically monitoring for heartbeat-like beaconing at regular intervals on ports 3333/tcp and 3334/tcp. The rule correlates traffic across both ports from the same device to the same destination to identify potential command-and-control communication.
Page 5 of 11