Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,937 detections
Filters
Last updated
All Time
Detection languages
1,930
3
2
1
1
Contributors
592
477
360
250
124
Categories
995
927
834
546
538
Platforms
1,753
214
81
54
41
Products / Services
1,868
1,144
65
51
17
MITRE Techniques
564
412
305
201
175
CVEs
4
4
4
2
2
IDS Classtypes
1,937
503
461
381
236
IDS Protocols
1,098
362
201
171
37
This rule detects the download of executable files (such as .exe, .dll, .bat, .ps1, .vbs, .hta) over HTTP. It specifically looks for the 'MZ' header, which is characteristic of Windows executables, and checks the HTTP URI for common executable file extensions. This activity is often associated with initial access or command and control techniques where adversaries download malicious payloads.
This rule detects a high rate of DNS queries originating from a single source IP address within a specified time frame, which can be indicative of DNS Command and Control (C2) beaconing activity. Specifically, it triggers an alert if a source IP makes 50 or more DNS queries within a 60-second window. This behavior is often associated with malware attempting to communicate with a C2 server by encoding data within DNS requests or using DNS as a covert communication channel.
This rule detects the upload of a PNG image file over HTTP using a POST request. This could indicate an attacker exfiltrating screen captures, which aligns with MITRE ATT&CK technique T1113 (Screen Capture). The rule specifically looks for the HTTP POST method and the PNG file signature (89 50 4E 47) within the file data.
Detects the full infection chain of a trojanized Proxifier installer hosted on GitHub (lukecodix/Proxifier releases) distributing ClipBanker RAT. Active since early 2025 with 2,000+ confirmed victims (India/Vietnam focus). The malicious wrapper adds Defender exclusions for TMP/powershell/conhost, creates a ~1.5KB stub (Proxifier*.tmp) as a donor process, injects api_updater.exe and proxifierupdater.exe, then hollows into conhost.exe and fontdrvhost.exe to deliver a fileless C++ ClipBanker payload that replaces crypto wallet addresses across 26+ blockchains (BTC, ETH, SOL, XRP, DOGE, LTC, XMR, ADA, BNB, etc.). Multi-stage payload retrieved from pastebin, snippet.host, chiaselinks.com, rlim.com, paste.kealper.com, and secondary GitHub/Gitea repos. Persistence via HKLM\SOFTWARE\System::Config (Base64 PowerShell) + scheduled task. 12 queries covering known hashes, trojanized binary names, Defender exclusion abuse, registry persistence, schtask-to-PowerShell-to-registry chain, process hollowing into OS binaries, C2/payload domains, Pastebin/Gist exact-path IOC hits, fontdrvhost/conhost outbound anomaly, Proxifier*.tmp stub detection, GitHub-release-to-execution correlation, and full kill-chain correlation.
Detects the full kill-chain used by modern ransomware operators (RansomHub, LockBit affiliates, BlackCat/ALPHV, FIN7) who deploy EDR killers (EDRKillShifter, AvNeutralizer/AuKill, Terminator, RealBlindingEDR, GhostDriver/Poortry, Backstab) in the pre-encryption phase. These tools use the BYOVD (Bring Your Own Vulnerable Driver) technique — loading a legitimately-signed but vulnerable kernel driver (rtcore64.sys, gdrv.sys, truesight.sys, dbutil_2_3.sys, mhyprot2.sys, procexp152.sys, aswarpot.sys, zam64.sys) as a kernel service, then abusing its IOCTLs to terminate protected EDR processes from kernel space, bypassing PPL. This pack contains 10 queries covering vulnerable driver loads, drivers dropped to user-writable paths, kernel service creation, known EDR-killer binaries, Defender/EDR service tampering, mass security-process termination bursts, unsigned kernel loads, registry-based Defender tampering, full driver→service→kill chain correlation within 1h, and a hash-free behavioural catch-all (unsigned loader → sc.exe create kernel service within 60s).
This rule detects network connections initiated by specific executables (clawdbot, node, moltbot, openclaw) from a local port (18789, 3000, or 8080) to a remote IP address that is not localhost, not within private IP ranges (10.0.0.0/8, 192.168.0.0/16, 172.16.0.0/12), and not within the 17.0.0.0/8 CIDR block. This could indicate command and control (C2) communication or unauthorized data exfiltration by potentially malicious bots or applications.
Intellexa PREYHUNTER - HTTP
Suricata
Intellexa PREYHUNTER - HTTP response contains distinctive iOS build/artifact strings
COLDRIVER ROBOT chain - DNS lookup for TI delivery/C2 domains
UNC5142 CLEARSHORT - injected Web3 + BSC contract addresses in HTTP response
DPRK EtherHiding (UNC5342) - DNS lookup for blockchain explorer APIs (multi-provider)
This rule set detects various stages of the OysterLoader malware activity, including its registration and login attempts to a command and control (C2) server, specific C2 communication patterns via HTTP URIs, and connections to known OysterLoader C2 domains and IP addresses. The rules look for specific HTTP URI paths like "/reg" and "/login" combined with distinct User-Agent strings ("WordPressAgent" and "FingerPrint"), as well as specific API paths under "/api/" and hardcoded C2 domains and IP addresses.
This rule detects HTTP requests for 'install.sh' from the domains 'clawd.bot' or 'openclaw.ai'. These domains are associated with the OpenClaw/Clawd malware, indicating an attempt to download a malicious installation script.
This rule set detects network communication associated with macOS infostealers, including C2 infrastructure, SHub stealer heartbeat and exfiltration, and ClickFix staging and landing pages. It identifies specific hostnames and URI paths used by these malicious campaigns.
ET TROJAN Microsoft ClickFix IOC IP
ET PHISHING Microsoft ClickFix Landing Domain
ET PHISHING Microsoft ClickFix Landing Domain
Detects specific User-Agent strings associated with the DDoSia malware, which is used by the NoName057(16) hacktivist group for DDoS attacks. The rule looks for two distinct User-Agent patterns in HTTP traffic.
This rule detects WebSocket C2 authentication attempts by the Frogblight mobile banking malware. It specifically looks for the hardcoded login key '{"login_key":"fg_a1b2c3d4e5f6"}' within TCP traffic destined for external networks.
This rule detects command and control (C2) beaconing activity associated with the SHADOW-VOID-042 malware family. Specifically, it looks for HTTP POST requests containing the string "get_module_hello" in the request body, which is indicative of a C2 communication pattern used by this malware.
This rule detects DNS Command and Control (C2) activity associated with the Linux/BPFDoor malware. It specifically looks for DNS queries containing a magic value "X:" followed by a dot "." at the beginning of the query, indicating a potential C2 communication channel used by BPFDoor. The rule also includes a byte test to ensure the query length is greater than 20 bytes and a threshold to limit alerts to 3 occurrences within 300 seconds from the same source.
This rule detects the download of Android Application Package (APK) files from Amazon S3 buckets, where the HTTP URI contains keywords related to gambling (slot, bet, play, jackpot). This activity is indicative of potential malware distribution, specifically targeting Android devices with gambling-themed applications, as observed in Indonesian gambling ecosystems.
Page 89 of 93