Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,247 detections
Filters
Last updated
All Time
Detection languages
690
140
94
67
56
Contributors
389
247
199
52
45
Categories
787
411
262
248
188
Platforms
836
265
264
169
66
Products / Services
498
157
148
133
115
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
1,247
CVEs
4
3
2
2
2
IDS Classtypes
70
58
3
3
2
IDS Protocols
66
23
15
12
9
Detects developer tooling processes such as Node.js, npm, and yarn—or processes spawned by code editors like VS Code and Cursor—establishing network connections to specific blockchain API endpoints (Tron, Binance Smart Chain, Aptos). This behavior is associated with the DEV#POPPER RAT, which utilizes these blockchain transaction channels to stage encrypted payloads and retrieve configuration keys.
This rule detects the execution of a file named 'report.bin' and correlates it with subsequent network connections originating from the same process. This behavior is indicative of a potential C2 heartbeat or exfiltration activity involving a non-standard or obfuscated executable.
Detects command-line execution (cmd.exe, powershell.exe) originating from a python.exe process tree, correlated with long-running, frequent outbound public network connections from the same python.exe process. This behavior is consistent with the SynkLoader RAT module, where a loader uses a Python process to execute system commands and maintain persistent C2 channels.
Correlates email delivery, URL click telemetry, endpoint network connections, and process execution evidence for one or more suspicious URLs or domains.
This query helps analysts identify who received an email containing a target URL, who clicked it, whether the URL was observed on managed endpoints, which devices were involved, and what processes initiated related network or command-line activity.
It is useful for phishing investigations, malicious URL exposure reviews, post-delivery impact checks, campaign scoping, and confirming whether a user interaction led to endpoint activity.
The query uses Microsoft Defender XDR advanced hunting tables including EmailUrlInfo, EmailEvents, UrlClickEvents, DeviceNetworkEvents, and DeviceProcessEvents. Microsoft documents UrlClickEvents as containing Safe Links click information from email messages, Teams, and Office apps, populated by Defender for Office 365.
This query helps analysts identify who received an email containing a target URL, who clicked it, whether the URL was observed on managed endpoints, which devices were involved, and what processes initiated related network or command-line activity.
It is useful for phishing investigations, malicious URL exposure reviews, post-delivery impact checks, campaign scoping, and confirming whether a user interaction led to endpoint activity.
The query uses Microsoft Defender XDR advanced hunting tables including EmailUrlInfo, EmailEvents, UrlClickEvents, DeviceNetworkEvents, and DeviceProcessEvents. Microsoft documents UrlClickEvents as containing Safe Links click information from email messages, Teams, and Office apps, populated by Defender for Office 365.
Detects outbound network connections to known command-and-control infrastructure associated with the Aeza Group bulletproof hosting provider. The rule monitors for connections to specific malicious IP addresses, traffic on TCP port 8133, and requests to the domain 'profitnow.io'.
Detects anomalous S7comm (Siemens S7 Communication) traffic directed to port 102, which is commonly used by PLCs and ICS devices. The rule identifies potential automated, scripted, or unauthorized activity by monitoring for connections occurring outside of standard business hours (6 PM to 8 AM) or exhibiting high-frequency connection patterns (exceeding 1 connection per second), which may indicate scanning, brute-forcing, or interaction with ICS hardware by unauthorized actors.
This rule monitors outbound email traffic per sender and flags accounts exceeding a specified hourly threshold. A sudden spike in outbound emails from a single user account may indicate a compromised mailbox being used for spam, phishing, or mass data exfiltration.
This rule detects potential command-and-control (C2) activity from the TWINLOOT malware, which utilizes Microsoft Teams TURN relay infrastructure to establish a reverse SOCKS5 tunnel. The detection identifies connections to 'worldaz-msit.relay.teams.microsoft.com' followed immediately by a SOCKS5 handshake pattern (05 01 00), indicating encapsulated tunneling within the relay communication.
Detects network connection events to specific known malicious IP addresses (45.158.196.23, 45.158.196.184) over TCP port 8888. This activity is indicative of potential command and control (C2) communication or unauthorized remote access.
Detects outbound network traffic from internal hosts to known command-and-control (C2) server IP addresses associated with C2Looper malware on port 8888.
Detects cleartext storage of a phished password to a hidden dotfile (~/.pwd) or staging directory by a non-standard process, matching AmnesiaStealer's practice of persisting captured credentials to disk for reuse throughout its collection chain.
Detects APC injection into dllhost.exe unbacked/private memory via NtQueueApcThread correlated with a subsequent outbound network connection from the same process — the ACRStealer injection-and-C2 pattern.
Detects user activity involving unsanctioned or 'Shadow IT' applications that have a low or poor Cloud Confidence Index (CCI) rating, as reported by Netskope. This rule helps identify potential security risks associated with the use of unapproved or newly observed cloud services.
This rule detects outbound network connections that were blocked by security controls due to matching a threat signature or being categorized as malicious or command-and-control (C2) traffic.
This rule detects high-frequency security alerts from Zscaler ZIA indicating that a single source IP has encountered three or more distinct threat signatures within a 15-minute window. This behavior is indicative of a host engaging in malicious activity, such as automated scanning, malware communication attempts, or accessing infrastructure associated with multiple malicious categories.
This rule detects high-frequency security alerts from Zscaler ZIA indicating that a single source IP has encountered three or more distinct threat signatures within a 15-minute window. This behavior is indicative of a host engaging in malicious activity, such as automated scanning, malware communication attempts, or accessing infrastructure associated with multiple malicious categories.
Detects anomalous, non-browser process activity interacting with Microsoft Teams APIs associated with the TWINLOOT threat campaign. The rules identify suspicious token retrieval requests and unauthorized authentication headers from processes that do not identify as legitimate browser or Teams application agents, indicating potential abuse of application access tokens and authentication flows.
Detects users who have triggered five or more blocks by Netskope security policies for high-risk web categories such as Anonymizers, Hacking, Gambling, or Adult Content. This behavior may indicate an attempt to circumvent security controls or persistent engagement with prohibited content.
Detects users who have triggered five or more blocks by Netskope security policies for high-risk web categories such as Anonymizers, Hacking, Gambling, or Adult Content. This behavior may indicate an attempt to circumvent security controls or persistent engagement with prohibited content.
Detects the correlated sudoers-based privilege escalation chain: a non-root user writing a root-owned sudoers.d policy via the Screen Sharing file-copy channel, followed by passwordless sudo execution, followed by an outbound network connection as root within bounded time windows.
Detects FortiGate web-filter events where access to selected high-risk or security-relevant FortiGuard categories was not blocked. The monitored categories include malicious websites, phishing, spam URLs, Dynamic DNS, peer-to-peer file sharing, and crypto-mining destinations. The event should be investigated according to the specific category and destination context.
Page 30 of 60