Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,247 detections
Filters
Last updated
All Time
Detection languages
690
140
94
67
56
Contributors
389
247
199
52
45
Categories
787
411
262
248
188
Platforms
836
265
264
169
66
Products / Services
498
157
148
133
115
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
1,247
CVEs
4
3
2
2
2
IDS Classtypes
70
58
3
3
2
IDS Protocols
66
23
15
12
9
KQL Query
Detects user activity involving unsanctioned or 'Shadow IT' applications that have a low or poor Cloud Confidence Index (CCI) rating, as reported by Netskope. This rule helps identify potential security risks associated with the use of unapproved or newly observed cloud services.
This rule detects outbound network connections that were blocked by security controls due to matching a threat signature or being categorized as malicious or command-and-control (C2) traffic.
This rule detects network communication attempts (connection success, request, or failure, or any traffic on port 443) targeting a specific malicious domain (notepadreleased.com) or IP address (85.158.110.78), while explicitly excluding common public DNS providers.
This rule detects outgoing TCP traffic to port 1082 that initiates or utilizes a SOCKS5 proxy connection, specifically identifying patterns associated with the Myxa VPN tool. The detection monitors for the specific SOCKS5 handshake byte and identifies known hardcoded IP addresses associated with this tool's proxy infrastructure.
This rule detects network communication attempts (connection success, request, or failure, or any traffic on port 443) targeting a specific malicious domain (notepadreleased.com) or IP address (85.158.110.78), while explicitly excluding common public DNS providers.
Detects sustained outbound Stratum mining-protocol connections to Monero mining pools from a compromised host (5+ connections within 5 minutes), consistent with post-exploitation cryptomining following Screen Sharing compromise.
Detects outbound network connections initiated by the Internet Information Services (IIS) worker process (w3wp.exe) to non-Microsoft IP addresses on suspicious or high-range ports. This behavior often indicates compromised web servers being used for command-and-control (C2) communication, reconnaissance, or data exfiltration.
Detects python.exe/pythonw.exe executing compiled bytecode (.pyc/.pyz) from a non-standard installation path (excluding venv/site-packages/Program Files) with an outbound connection to a non-standard port within 5 minutes, consistent with DeviceManager RAT execution.
Detects file access/modification/creation events targeting .env files or browser credential storage artifacts, combined with process command lines referencing API_KEY/TOKEN alongside environment-variable access patterns, indicative of infostealer malware harvesting developer secrets and browser-stored credentials, followed by an outbound network connection consistent with exfiltration.
This rule monitors GCP VPC Flow logs for potential command and control (C2) or data exfiltration activity by identifying internal-to-external network connections that exhibit high novelty. It calculates the percentage of new destination IP addresses contacted by internal source IPs within a single day. Alerts are triggered when a source IP initiates connections to at least 20 unique external destinations, where at least 20% of those destinations have never been contacted by that source in the previous day. This behavioral analysis is designed to detect reconnaissance, scanning, or large-scale data exfiltration patterns.
This rule detects suspicious activity originating from the Node.js runtime environment. It specifically monitors for 'node.exe' or 'node' processes accessing sensitive credential-related files (such as .npmrc, .netrc, .git-credentials, or id_rsa) followed closely (within 5 minutes) by network connections to public IP addresses. This behavior is indicative of an npm-based malware or malicious package attempting to harvest locally stored credentials and exfiltrate them to an external, potentially attacker-controlled server.
This rule detects potentially suspicious data exfiltration activities by identifying a pattern where a user authenticates or interacts with the Microsoft Purview service, followed closely (within 15 minutes) by a connection to an external domain that the organization has not established a historical communication pattern with in the last 30 days. This behavior may indicate an adversary is attempting to exfiltrate session tokens or sensitive data to an external server.
Detects outbound network connections initiated by the Internet Information Services (IIS) worker process (w3wp.exe) to non-Microsoft IP addresses on suspicious or high-range ports. This behavior often indicates compromised web servers being used for command-and-control (C2) communication, reconnaissance, or data exfiltration.
Detects the execution of processes related to 'SKILL.md', 'npx', 'mcp-server', or 'invoke_skill' followed closely by read or copy actions on sensitive file locations (SSH keys, AWS credentials, environment files, or AppData). The rule further correlates this activity with subsequent outbound network connections from the same device.
This rule detects suspicious activity originating from the Node.js runtime environment. It specifically monitors for 'node.exe' or 'node' processes accessing sensitive credential-related files (such as .npmrc, .netrc, .git-credentials, or id_rsa) followed closely (within 5 minutes) by network connections to public IP addresses. This behavior is indicative of an npm-based malware or malicious package attempting to harvest locally stored credentials and exfiltrate them to an external, potentially attacker-controlled server.
Detects the malicious Open VSX "recon" extension variant checking whether its own extension ID is referenced in the workspace devcontainer.json or .vscode/extensions.json to determine if the install was configuration-driven versus human-initiated
Detects HTTP network traffic containing the endpoint's local hostname transmitted within 30 seconds of a process starting, consistent with 'evil twin' Open VSX extensions that harvest developer environment metadata immediately upon activation.
This rule detects potential data exfiltration by monitoring for anomalous user behavior across integrated SaaS applications. It flags accounts that perform high-frequency read, search, or view activities across three or more monitored SaaS platforms (Confluence, Jira, Slack, Google Workspace, Microsoft 365, or Bitbucket) within a 5-minute window, followed immediately by an upload or post activity to an external, non-integrated domain.
This rule detects potential data exfiltration by monitoring for anomalous user behavior across integrated SaaS applications. It flags accounts that perform high-frequency read, search, or view activities across three or more monitored SaaS platforms (Confluence, Jira, Slack, Google Workspace, Microsoft 365, or Bitbucket) within a 5-minute window, followed immediately by an upload or post activity to an external, non-integrated domain.
This rule detects potentially suspicious data exfiltration activities by identifying a pattern where a user authenticates or interacts with the Microsoft Purview service, followed closely (within 15 minutes) by a connection to an external domain that the organization has not established a historical communication pattern with in the last 30 days. This behavior may indicate an adversary is attempting to exfiltrate session tokens or sensitive data to an external server.
Page 31 of 60